tveita

You see this blatantly abused all the time already - real example, first site I tested:

  Use limited data to select advertising
    Consent (91 vendors)
    Legitimate interest (41 vendors)
  Measure advertising performance
    Consent (97 vendors)
    Legitimate interest (58 vendors)

Which shouldn't be just finable but jailable.

Seems to be common on conspiracy and meme stock Reddits.

"I asked ChatGPT if <current_event> could be caused by <crackpot theory>." and it confirmed everything!

This is very relevant for compiler optimization and video codecs as well - both involve testing changes on lots of small benchmarks. Almost any change will hurt some benchmarks and help others. Maybe one benchmark improves a lot while causing a small slowdown on many others. The overall improvement for any one change can be minuscule, less than one percent. And yet if you keep doing these small improvements it adds up, hopefully to the point of improving every benchmark over time.

You want to know if a new model is actually better, which you won't know if they just added the specific example to the training set. It's like handing a dev on your team some failing test cases, and they keep just adding special cases to make the tests pass.

How many examples does OpenAI train on now that are just variants of counting the Rs in strawberry?

I guess they have a bunch of different wine glasses in their image set now, since that was a meme, but they still completely fail to draw an open book with the cover side up.

For a more substantial explanation see e.g. "A gentle introduction to elliptic-curve cryptography"

https://media.ccc.de/v/31c3_-_6369_-_en_-_saal_1_-_201412272...

The US has the "libel-proof plaintiff".

https://www.haynesboone.com/news/publications/the-libel-proo...

Storing the bcrypt password in the entry would make a dump of the cache almost as good as a dump of the password database. At least this way a dump of the cache makes the key opaque and requires you to guess both the username/id and password together, assuming they're not repeated in the cache value.

According to the security advisory this cache was for AD/LDAP delegated authentication, so they don't have their own password database with a version field or similar for sensible invalidation.

I guess the requirements could be something like:

  - different username/password combinations must have separately cached results

  - mitigate a potential data leak by putting all the entropy we have available together with the password material and using a slow password hashing function

Out of curiosity, have you seen the debate between Peter Miller and Saar Wilf, summarized in https://www.astralcodexten.com/p/practically-a-book-review-r...?

There are 40 setup cards with 4 possible rotations that specify agent placements, so it's theoretically possible to do some kind of memorization.

Personally I'd find that kind of play style very unfun, and would rather switch to fully randomized boards if I played enough that it became a problem.

https://danluu.com/codenames/

Not going to post this link to every post where it's relevant, but:

  Trump returned to that theme in November 2022, when he officially launched his 2024 presidential campaign. "We're going to be asking everyone who sells drugs, gets caught selling drugs, to receive the death penalty for their heinous acts," he said.

https://reason.com/2023/10/24/trump-who-freed-drug-offenders...

You'll note there are comments here saying saying that he generally keeps his campaign promises. On the bright side I don't agree, but on the other hand I think he does often enough, especially for the "well of course he didn't literally mean that" ones.

Being a drug kingpin is not considered "something relatively small" under US law, as you can see from the sentencing. Being the leader of a large drug operation and ordering hits to protect your business would be considered worse than trying to take out a hit for whatever "personal reasons".

Obviously the hits are a lot messier to prosecute as well with the misconduct of the FBI agents, maybe you could hammer that enough to confuse a jury. But people are commenting like the evidence outright didn't exist - I can only think they have either heard it told second-hand, or are employing motivated reasoning.

> afaik Ulbricht didn't sell drugs himself

FWIW he kickstarted the marketplace by selling shrooms that he grew himself.

Hardly the worst he did. Note a certain Trumps position on the issue though:

"We're going to be asking everyone who sells drugs, gets caught selling drugs, to receive the death penalty for their heinous acts,"

https://reason.com/2023/10/24/trump-who-freed-drug-offenders...

His sentence was severe in part because he fell under the "kingping statute". This is based on the amount of drug trade he facilitated, the amount of money he made, and the actions he took as an "organizer". The hits didn't help.

> For conviction under the statute, the offender must have been an organizer, manager, or supervisor of the continuing operation and have obtained substantial income or resources from the drug violations

https://en.wikipedia.org/wiki/Continuing_Criminal_Enterprise...

There was plenty of evidence that he ordered the hits, and the defense had the opportunity to address the evidence in court. The chat logs go far beyond "insinuation"

It's ridiculous that people are pretending there is any doubt about his guilt because they like crypto and/or drugs.

> the usage of their algorithms allows the app to influence how Americans think about different issues.

Yes, speech does that. "The algorithm" is curation but the content we are talking about is mostly Americans talking to other Americans. The goal is to control and suppress that communication.

There are perfectly valid arguments to ban TikTok. And hey, there are arguments to be made that free speech shouldn't be absolute. But that doesn't fit into the American self image, so the argument must be obscured to reduce the dissonance. Your argument in particular maps perfectly to "Some kinds of speech are dangerous and people must be protected from them."

Assuming you mean this:

  According to the Federal Bureau
  of Investigation, TikTok can access “any data” stored in a
  consenting user’s “contact list”—including names, photos,
  and other personal information about unconsenting third
  parties. Ibid. (emphasis added). And because the record
  shows that the People’s Republic of China (PRC) can require TikTok’s parent company “to cooperate with [its] efforts to obtain personal data,” there 
  is little to stop all that
  information from ending up in the hands of a designated
  foreign adversary. Id., at 696; see id., at 673–676; ante, at
  3. The PRC may then use that information to “build dossiers . . . for blackmail,” “conduct corporate espionage,” or advance intelligence operations.

It basically just says that the app asks for the user's contact list, and that if the user grants it, the phone OS overshares information. That's really thin as evidence of wrong-doing. It doesn't even say that this capability is currently coded into the app. This sounds more like an Android/iOS problem - why is the contact sharing all or nothing? Would the ban still be OK if the app didn't have read contact permissions?

All spyware should be illegal. A law to reign in the ubiquitous data collection on everyone's computing devices would be great. Maybe start by requiring all data collection to be opt-in and for a specific purpose. Make it illegal to deny functionality that doesn't strictly require the requested data. "Paying with your privacy" shouldn't be a thing. Crush every data broker.

This law is different to that, it's all about specific actors, not about behavior and actions. A "people we don't like" list. CNN could be on a similar list soon. All constitutional of course - the law will specifically mention how this is all for national security. And no one's speech is being suppressed, the journalists can always write for a different news channel.

Musk famously hates short sellers, the Trump Social CEO has done the "blame the short sellers" bit, Eric Trump is hyping crypto coins, Trump himself is eager to take credit whenever the market goes up... I think it's almost guaranteed that they'll target short sellers specifically at some point. They're a easy target to blame, and divert attention from the the fact that they are actually fleecing investors right at this moment.

Soon the only crime will be exposing fraud.

> Participating in header bidding gives you data similar to what you would see from operating a popular mobile website.

A popular mobile website can only geolocate its own visitors based on IP and will have no idea what apps they have installed and what they do whenever they are not visiting that website.

The ad exchange gets information any time the users opens any of thousands of apps, without them ever interacting with the exchange.

"This device opened Grindr at this exact GPS coordinate, then Candy Crush at the church wifi, then a month later played Yahtzee for three hours near a military base in Afghanistan"

Then they package up that historical data and sell it. You can have years of location data for whatever purpose you can think of.

A thread on using this for surveillance from about a year ago:

https://news.ycombinator.com/item?id=38289337

As I commented there, while the antitrust case against Google is well-deserved, one effect of breaking their ad monopoly is opening up for even more actors to receive real-time header bidding data.

A look at the resolution of position data you can get:

https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i...

This will be correlated and joined with the geoip data from the apps without location data.

A bit meandering but it does paint a picture of a particular time.

For more about Margaret Mead maybe read this interview with Mead and Bateson, they both come across as extraordinarily sharp:

https://web.archive.org/web/20210116040013/http://www.oikos....

Discussed here: https://news.ycombinator.com/item?id=20315632

"a significant amount of this geolocation dataset appears to be inferred by IP address to geolocation lookups, meaning the vendor or their source is deriving the user's geolocation by checking their IP address rather than by using GNSS [Global Navigation Satellite System]/GPS data. That would suggest that the data is not being sourced entirely from a location data SDK."

Probably it would use the location if the permission was enabled, otherwise fall back to IP geolocation

Real-time bidding is a privacy nightmare - basically spraying your actions in real-time to every ad provider, with a pinky promise that they won't abuse it.

fertilize.us

I found Clickhouse easier to handle than pure SQL for this - as an analytics database it has conveniences like parsing input files with regexp, user defined functions and array functions. It's often possible to treat it more like an array programming language. But I still sometimes couldn't avoid the tuple explosion problem.

https://clickhouse.com/docs/en/integrations/data-formats/tem...

It's a somewhat well-known startup "hack" https://learningloop.io/plays/spoof-landing-pages

> For example, the typical distance computation complexity between two D-dimensional vectors is O(D^2), but compressing floats into bits reduces this by a factor of 1024 (32x32).

This isn't right, cosine distance between two vectors is definitely O(D)…

Of course replacing float multiplications with xor+popcount is a nice speedup in computation, but assuming you're memory bandwidth limited, speedup should be linear.

Is the full rendered documentation available anywhere?

https://github.com/briangu/klongpy/blob/main/docs/quick-star... links to an "API Reference" and a "REPL Reference", but the links are broken.

I didn't realize Jedis was an official Redis client now, looks like it has been since 2020 without any major impact to the development.

I guess they are unlikely to add any features to support alternative servers.

For all people say things like "Linux has been trying to catch up with the NT Kernel's IO Completion Ports", is there anywhere that translates to Windows being faster than Linux at disk or networking?

Or is it just a matter of conceptual elegance or programmer convenience?

This doesn't depend on BouncyCastle AFAICT, by default it uses javax.crypto but you can change it for a BouncyCastle security provider.

https://github.com/FusionAuth/fusionauth-jwt/blob/main/src/m...

It doesn't work here because there's a mismatch between the format and the intended message.

She forgot his birthday but scrambles and buys him a 7-eleven hot dog - funny, self-aware. 7-Eleven doesn't actually believe the hot dog is a very good birthday gift.

She forgot his birthday but scrambles and buys him a Rolex - materialist, not for everyone but will appeal to some. Not very funny.

She forgot his birthday but scrambles and buys him a cheap fake Rolex - not that funny, just an ad for counterfeits?

Does Apple think that having an AI slap together some images without your involvement is a thoughtful birthday gift? Then why show it so clearly as insincere and low-effort?

Or do they think it's a bad gift? Then what are they trying to say about their product? We assume they want to be perceived as a premium brand.

The ad could have just played it straight. Like, couple sits in couch, "Remember when we were at Ibiza?" "Let's relive those moments" (types "Ibiza vacation" into phone) (music swells as couple looks at phone screen with fake smiles)

But that would be tacky. Funny at their expense. So they add a twist, make it so they are in on the joke. But now the messaging isn't coherent. Is the product good? bad? premium? cheap?