steelframe

> Autoimmune issues I'm feeling much less confident about. It seems like so many of the therapies are "turn down the immune system".

The immune system has many branches, and you can effectively deplete one branch of the immune system while preserving the other branches to fight infection. For example with MS a very effective treatment is CD20+ B cell suppression, as rituximab does. For many people diagnosed with MS this has been effectively a "cure," in the sense that while they need to continually deplete their CD20+ B cells, their disease doesn't progress in any meaningful way, and their immune systems remain largely able to fight infection.

So we don't need to wholesale "turn down" the entire immune system for many autoimmune diseases. Rather, we need to surgically target specific parts of it and either suppress those parts or modify their behavior. Given the success we've seen with ritixumab and MS I'm more optimistic about our prospects for finding effective treatments for autoimmune conditions.

A rough approximation might be a Pixel 7a running GrapheneOS in grayscale mode. That's my daily driver.

I had to use one of these services once after I lost the MFA app for a domain registrar when switching phones. I wouldn't be at all surprised if my driver's license has been compromised from that company's S3 bucket (or wherever they're stuffing the images) since then. Regardless I was super-annoyed to have to jump through that hoop. The subsequent emails from them pleading with me to re-enable MFA have since gone straight to the bit bucket.

Mullvad takes cash, and if they are to be believed an attempt at a search warrant didn't work out for the authorities. https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

Regardless I'm not really trying to defend myself against state actors. If they target me, I know I'm screwed. What I am trying to do is reduce the amount of my private information non-government entities collect on me while raising the cost of mass surveillance.

Qubes OS would work great too. I just prefer Debian, so I've hacked together a poor-man's sandbox on that platform. While it doesn't provide the degree of host-level isolation that Qubes does, I think it's pretty effective for what this RFC is about.

One of my privacy techniques has been to build a container with a new network namespace, randomly select a VPN server from the set of ~5k that my VPN provider has running across the globe and connect to it within that namespace, spawn a fresh instance of a web browser with no cookie history or anything of the sort, run DNS filtering and ad-blocking components, and then perform the individual task I want to perform with it before shutting the whole thing down.

I have all of this scripted to launch trivially within a few seconds, and it reduces the effectiveness of most of the attacks this RFC describes.

Pay for stuff with cash.

Their protocol only uses cryptographic hash functions, which means that it's post-quantum secure. One reason why this is significant is because existing post-quantum public key algorithms such as SPHINCS+ use much larger keys than classic public key algorithms such as RSA or ECDH.

*Edit: As other have pointed out, for SPHINCS+ it's the signature size and not the key size that's significantly larger.

Reality is reality regardless of what you perceive.

Presumably the argument is that training a neural net from a basis of complete ignorance is inefficient because we have facts with which we can initialize the model.

So far as applicability to TFA, we can and probably should initialize or bias models that select candidates so their inferences reflect our values.

Actually whenever I give one my sweet middle finger it's stuck in SF traffic and I'm zipping around it on my bike.

You can buy it from Google by becoming an app developer.

https://www.dli.tech.cornell.edu/post/facebook-and-google-ar...

With a regular taxi I just call from a phone in a hotel lobby and ask to be picked up a block or so from my location. No reason there can't be a dispatch service you can call for self-driving taxis too.

Crime happens, but that's why there's insurance. It's not like cab drivers don't get robbed too. It doesn't (and shouldn't) stop cash commerce.

My trick is to walk a block or two on either end of the trip.

> But you're already doing all of that by carrying an Android phone.

I'm not.

Cool. Can I take one without my identity and travel patterns being tracked? Like, suppose I want to get picked up from work and dropped off at my girlfriend's house in San Mateo. Something I might not want my soon-to-be-ex's lawyer to be able to subpoena. There's one of those machines onboard that are all over the place in supermarkets where I can feed bills right?

Or maybe not. Okay then, Luxor Cab it is. Cheaper, better conversation, more aggressive about squeezing through traffic, and doesn't violate my privacy.

I'm not against automated taxi services in principle. I'm just not interested if it's a package deal where I have to surrender my physical comings and goings to a scummy data broker like Google.

I've owned a Tesla and now currently own 3 (non-Tesla) EVs.

Let's just say we come from different planets when it comes to automotive aesthetics.

One of my other cars is a 2019 Jaguar I-PACE. It's generally been rather reliable over the past 5 years. The main problems have been how it tends to like to brick itself when something electronically doesn't go quite right.

For example when I had it turned on and running the A/C on the Edmonds-Kingston ferry it decided that the suspension was borked and refused to release the emergency brake once the ferry arrived at dock. You know what happens when you can't push your bricked car off the ferry? They put cones around your car and load everyone else on the ferry around you while you try to explain to the tow company on the phone how you have a luxury AWD EV bouncing back and forth across the Puget Sound that needs to be winched onto a flatbed.

Then when the auxiliary battery died it decided to roll into the middle of a parking lot and gradually glitch out and clamp down on the emergency brakes again as the main 12v battery then died, and you get to have it winched onto another flatbed as it's also impossible to release the emergency brakes once the 12v batteries have given up the ghost.

Hence why my most recent vehicle has a clutch pedal, a stick attached to a gearbox, and an emergency brake attached to a lever via a cable.

My fresh-off-the-lot 2024 Toyota GR Corolla got nearly its entire side mangled by a red light runner on day 8 of ownership. Mind you this is a brand-new model, first released in 2023. Once my insurance finished dragging their heels on doing their assessment -- as they didn't yet have any of the parts for it in their internal database -- it took another week to get on the schedule with one of the ~20 auto body shops in a 15-mile radius of where I live. An entire door and two windows needed replacing, along with a fender, trim, and so forth. The shop apologized that some of the parts were delayed by a whole week, and in the end it took 5 weeks to restore the vehicle to its original state.

And this sort of thing is precisely why I chose to go with an established automaker with a strong reputation for reliability and serviceability. This has become so much more important to me than almost any other feature in a motor vehicle.

Metadata about someone's sexual activity is super-valuable to advertisers. Categories of services and products are too many to list here, but they include prophylactics, ED medications, STI medications and treatments, sex toys, pregnancy and maternity products such as pillows, stretch mark cream, pregnancy tests, and ovulation tests, private investigators, couples therapists, divorce lawyers, etc., etc.

As part of my job I interview a lot of candidates from FAANG companies. That's included several who have worked on Google Home and Amazon Alexa.

I've learned that on those teams someone's always trying to "innovate" with what they can do with an "always-listening" microphone. Lots of ideas go over the line of creepiness/invasiveness, but then the product management tries to come up with ways to make it "okay" again. "Well it's for their own good. What if one of these noises sounds like someone's in distress? Wouldn't it be super-helpful if we could save someone's life by calling 911 for them?"

At the very least some of these features have included trying to categorize types of noises and collect telemetry on them. When they happened, how long they happened for, and so forth. With an always-on microphone, there's no harm in just collecting metadata on when and how often noises that may or may not be related to sexual activity happen, right?

Any incidental information about identified voiceprints or locations that phones report won't be correlated by any human being, of course, but don't be surprised when someone starts getting ads for private investigators and divorce lawyers.

Speaking of divorce lawyers, I can think of some metadata for which they'd probably be thinking about a subpoena or two.

Why couldn't they fix this with a phone call? So much suckage.

Mental note 1: Verify whether I can file a claim over the phone before I give a travel insurance company my money.

Mental note 2: Don't travel without being able to VPN through a U.S. endpoint. Preferably something sitting in my house.

Because I'm a senior engineer I am giving a lot of "Expertise" interviews for my company. Recruiters tend to presume that seniority implies broad expertise. In my case it doesn't. There's really only one subject that I feel I'm qualified to assess for expertise, but hardly anyone who interviews at the company claims anything about that subject on their resume.

Ninety percent of the time when I interview on that subject the candidate ends up getting a "hard no" from me just based on the first ~10 minutes of the interview, but on a very rare occasion I run across someone who's actually an expert in the field. I'll know because we'll quickly blast past all of the "<subject> 101" questions in the first 5 or 6 minutes, and then I can quickly adapt to deep-dive into technical details, giving them what I know to be fairly novel problems in the domain and then seeing how they apply first principles to tackle them. The "interview" ends up looking more like a collaborative brainstorming session at that point. It's incredible when that happens, which sadly is only maybe once or twice a year.

But usually I end up giving an "Expertise" interview for whatever it is they claim expertise in, whether I myself possess expertise in that subject or not. For the past several months the most prominent subject on literally every single resume has been AI/ML. I certainly don't claim expertise in that field, although I did take a graduate course on computational machine learning theory at university. That gives me "just enough" of a handle to not come across as a completely incompetent interviewer, but it feels like a farce.

With all this AI/ML hype I feel like the "Expertise" interview just ends up being someone pretending to have expertise in AI/ML being interviewed by someone pretending to be able to assess expertise in AI/ML.

First, be cock-sure in your own ability to do something as simple and straightforward as identifying mushroom species because of your innate ability to recall every minutia of the field guides and your astonishing powers of perception and attention to detail. Then analyze closely the cap shape, scales, the gill/teeth/ridges/pore patterns in the cap underside including shape, width, spacing, depth, and color, the ridges, and the stalk, including a partial veil and/or annulus. Proclaim confidently when you have determined with 100% assurance that you know precisely what species of mushroom you have in your hand, because you are a mushroom genius.

At that point you can take a few bites. If you end up needing a liver transplant, then you know it was toxic.

I'm aware that car prices are falling across the board, but I see EVs being hit harder than ICEs. I've heard from some local dealerships I visited recently that new EVs are sitting on the lot for longer too.

My I-PACE cost me over $80k when it was a one-of-a-kind vehicle, an EV from a mature car manufacturer with a luxury interior, sporty performance, hatchback, AWD, and heat pump. It won the 2019 World Car of the Year award (https://www.worldcarawards.com/web/2019_results.asp). It can easily make it the 150 miles from Seattle to Yakima over the PNW Cascade mountain pass in driving snow without needing to stop to charge. It was a bit of a stretch for me to spend that much on a car, but to me it was -- and still is -- a great car.

It wasn't too long before some other EVs with similar characteristics entered the marketplace, and at lower prices. Probably the biggest differences include slightly more splashy range on the spec sheet, although I would argue Jaguar is being more conservative than they really need to be with their advertised specs, and a faster charge rate. In other words, the newer EVs can get from point A to point B with less time spent at the rapid chargers.

Therefore my I-PACE's auction value is almost down to $20k, in spite of being low mileage and in excellent condition. I still get as much range out of it as I did the day I bought it. There are a few reasons for the precipitous price drop, but I suspect the overriding one is that nobody wants an EV that charges at 80kW.

Personally I use my gas car when doing road trips that would otherwise require a rapid charging stop, and I exclusively charge the I-PACE overnight in my garage. So I guess it's still worth a heck of a lot more than $20k to me, which is why I don't think I'll part ways with it until something really expensive breaks on it.

Meanwhile those who have EVs that don't use Tesla's supercharger network are stuck with the likes of Electrify America when they're road tripping. In that case I'm not sure your overall experience is going to be all that better whether your car is capable of pulling 80kW or 150kW at 35% SoC. I imagine people in 6-figure Taycans capable of pulling 270kW sitting in the same line as the $15k used Bolts capable of pulling 50kW for one of only 2 functioning chargers at an Electrify America site in a rural Walmart parking lot to open up, and then the charger ends up only being able to put out 100kW if you're lucky. The charging capabilities of your EV don't mean much if you can't take advantage of them.

Maybe the "unwashed masses" are starting to hear about the horror show that non-Tesla charging networks are as non-enthusiasts are suckered into buying one off the lot without the dealership being completely forthright with them about the true state of things, and that's being reflected in the relative price of used EVs.

It sounds like you left pretty close to when Greg did? What precipitated that, if you don't mind my asking?

I used to work on Windows at Microsoft, prior to Windows 10. I've always kept some Windows machines around because I felt that Windows was actually not that bad of an operating system, having personally reviewed a good amount of its source code and seen what the engineering culture was back at the time I was there.

I gave ChromeOS a try for some machines I might otherwise have run Windows on, but I kept the Windows machines around for gaming and for the occasional oddball proprietary software package that some family member just had to have. About the time Google dropped its unofficial motto "Don't Be Evil" I started moving away from ChromeOS and back to trusty old Debian.

I've recently purchased a Framework 16 with an AMD Radeon RX 7700S GPU and installed Arch Linux and Steam on it. All the games I care about playing at the moment, including Elden Ring and Baldur's Gate 3, run phenomenally well on it. It's 100% stable driving a 2560x1600 display at 60+fps with high graphics settings. I can plug in a PS5 controller and it "just works."

With that I now feel truly free of anything Microsoft, in the sense that I don't feel like I'm making any compromises at all with how I want to use my computers by using Linux rather than Windows. I'm going to be installing Arch or Debian Linux on my remaining Windows boxen over the summer.

So this is my final adieu, my old friend Microsoft. How far our paths have diverged since we first parted ways. Hit me up again when you've extricated your OS from your cloud and stopped showing ads and integrating privacy-hostile features. I won't be holding my breath though.

It's a HUNSN RJ36. It came preloaded with pfSense, as many of them do, but I immediately made a full disk backup and then wiped and installed with a Linux distro because, well, "This is Linux. I know this." You're going to find a lot of people who strongly prefer one over the other, and you may find you prefer pfSense over a "do-everything-yourself" Linux distro if you give it a shot. There are also Linux distros that are targeted for network appliances, and setting them up (correctly) can be easier if the distro is built for the task.

There are quite a few machines in this category, and what's in stock at any given time tends to rotate relatively quickly. I think the one I bought might still be available, but you will want to check to see if there is something with specs that will work better for your use case.

For my home network I've purchased a networking appliance form-factor computer, which is basically a regular old an i3 with VT-x support in a fanless case and 4 2.5GiB NICs. I've installed my favorite stable Linux distro that gets regular automated security updates in both host and a VM, and I've device-mapped 3 of the NICs into that VM. The remaining NIC remains unattached to anything unless I want to SSH in to the host. I'm running UFW and Shorewall in the VM to perform firewall and routing tasks. If I want to tweak anything I just SSH in to that VM. I have a snapshot of the VM disk in case I mess something up so I can trivially roll back to something that I know works.

I've purchased a couple of cheaper commercial WiFi access points, and I've placed them in my house with channels set up to minimize interference.

Prior to this I've gone through several iterations of network products from the likes of Apple, Google, and ASUS, and they all had issues with performance and reliability. For example infuriating random periods of 3-5 seconds of dropped packets in the middle of Zoom conferences and what not.

Since I've rolled my own I've had zero issues, and I have a higher degree of confidence that it's configured securely and is getting relevant security updates. In short, my home network doesn't have a problem unless some significant chunk of the world that's running the same well-known stable Linux distro also has a problem.

From TFA:

> The massive uptick in Fedora/EPEL activity puts additional pressure on Fedora web proxies for mirror data and then the mirrors themselves that tend to be volunteer run. Much of this new traffic is coming from the Amazon/AWS cloud.

Something irks me about volunteers spending real money to support all the OSS freeloading businesses. I'm talking about companies with a market cap in the $Billions. Almost none of them can be bothered to kick back even a modicum of financial support to the authors of the software that runs their business, and to add insult to injury, they in fact soak the members of community who distribute the binaries for their bandwidth.

In my experience nonce reuse doesn't happen because of a probabilistic collision. It happens instead because people who don't know the history or context of what they're doing make a change to the code base that results in the nonce being reused, and there were guardrails missing that should have been there to help prevent it.

It stems from hubris I see repeatedly in the software engineering industry. "I know the constraints and am capable of engineering to them, so don't lecture me about the potential dangers. I'll just make sure we do it right, because I'm smart and capable and can do it right."

They think the problem they need to solve is to write code that's correct today, while the actual problem they need to solve is that it remains correct tomorrow, next quarter, next year, and next decade. Based on repeated failures in this category I've personally witnessed, the majority of software engineers with fewer than ~10 years of industry experience lack an intuition about how software changes over time as people come and go.