179 karma · joined May 7, 2017
Catch-all HTTP 401s and 403s are there to thwart https://en.wikipedia.org/wiki/Oracle_attack - unfortunately, servers cannot afford to be "helpful" when it comes to unauthenticated clients.
!=
"I don't have to worry about $PARTICULAR_DISASTER_SCENARIO because I'm generally organized and well-situated above a certain threshold: If you picked a random disaster scenario $x out of a hat, chances are pretty good that I'd already be equipped to handle it."
P.S. Not trying to "counter-argue", just sharing a different perspective.
It took me several months of strictly non-4G-related work to recognize vanity license plates again.
Display timestamps however the user wants.
Do not roll your own timestamp code. See "Falsehoods programmers believe about time".
Is this a "human validation" that P!=NP ? ;)
But that got me thinking... what if it was a philosophical question, the kind of question that prompts responses that tell you what it's really like to work in [x].
HN, what's it really like to work in [Distributed systems, ML/AI, Crypto]?
Example: the Voyager record. Any sufficiently-intelligent alien who comes across it is likely to conclude "That object probably wasn't an accident".
Compare this to tabloid articles with stories like "The face of Jesus appeared in my toast this morning!". Regardless of whether you're an atheist or not, the Voyager record undeniably offers a higher standard of evidence that some intelligent entity intentionally produced it. Somebody spent time and energy to make it look exactly like that.
I like this definition because it acts as an interesting litmus test.
Fantasy novels? Art.
A toilet? Definitely intentional, but how much thought went into every little aspect? How much of the design and production was left to chance?
An extremely ergonomic and well-designed toilet? Inching more towards "art", because it's not just any old toilet -- it's that toilet.
Plain white canvas in a fancy modern art museum? Debatable. Why does it look like that? Is the intent intrinsically obvious? Maybe it's obvious to serious art critics with a background in this stuff, but maybe it seems meaningless to everybody else.
Random squiggles in a fancy modern art museum? Still debatable, but more obvious than the white canvas - even if it was all random, somebody decided that they really liked those squiggles, and made the call that the squiggles were "done", and they decided to put it up on a wall instead of trashing it. From the artist's perspective, this is definitely art - it encodes a number of judgement calls on the part of the artist. To everybody else, it might just look like squiggles, so everybody else doesn't have to agree that it's art.
To learn about some cryptography fundamentals:
* Read Katz & Lindell's Introduction to Modern Cryptography
* If you're missing math background, read Timothy Gowers' blog
* Supplement: Take Jonathan Katz' and Dan Boneh's MOOCS (links in post)
To get to the point where you can "design/analyze crypto protocols" (and maybe know what you're doing):
* Read Oded Goldreich's Foundations of Cryptography (Volumes 1&2)
* Try to have quasi-intelligent conversations with real cryptographers (advice for this in blog post)
* Get a PhD somewhere with a good crypto program
edit: formatting
I disagree that this would be a low/mid level position. In fact, I think it would be one of the highest ranking technical positions on a team, on the level of "library maintainer".
Documentation is useful because it allows the writer to transfer their own mental model to the reader. Like any data transfer, the fidelity of the reader's copy cannot exceed that of the writer's copy. So the writer ought to be the person on the team with the best mental model.
Unfortunately, newer developers tend to generate the most documentation by organic processes (in the form of notes and questions based on conversations with more experienced developers). In contrast, more experienced developers tend to silently figure things out without consulting another person.
Another issue is that developers with the best mental models tend to do a good job of assimilating that information into their global "context". This assimilation can make it difficult for these experienced developers to serialize their mental models into documentation, since the boundary between "mental model" and global "context" disappears.
For example - think about how you'd explain HTTP to a random stranger who has never programmed before. It's difficult to know where to start! Beyond that, it's hard to know what mathematical background to assume, how to topologically-sort topics s.t. you never use a term before it's introduced, how to prevent confusion, and everything else that makes teaching difficult.
In conclusion, I maintain that it really takes someone knowledgeable to write documentation which is: 1. scoped to a coherent audience and purpose 2. accurate across multiple layers of abstraction 3. resistant to documentation rot (without resorting to ambiguity)
Ideally, technical documentation would be written by the most knowledgeable person available.
Today, there's a "Block Public Access" button which basically says "I solemnly swear that I don't want anyone outside of my account to see this S3 bucket. Please don't put this bucket on the public internet, even if I screw up my bucket policy and/or ACLs"
The option is off by default, but it's easy to find, simple to understand, and doesn't force powerusers to give up control.
[0] https://aws.amazon.com/blogs/aws/amazon-s3-block-public-acce...
[1] https://github.com/karlicoss/cloudmacs/blob/master/asEnvUser [2] https://security.stackexchange.com/a/153016
Please don't comment about the voting on comments. It never does any good, and it makes boring reading.
* Take notes furiously in meetings. Don't try to organize the information as you go. Just get down as much info as you can. Take 10-15 minutes after each meeting to decipher your notes and pull out the key takeaways & action items.
* Keep a written debugging log. You see [weird behavior], so you want to check logs? Write the weird behavior down first. See recurring errors in the logs? Write down the error and traceID so you can find it later. Don't assume that you will "just remember" - you can't, and you won't.
* Use a whiteboard for planning tasks of any size. Make a rough plan of the commits you'd like to have at the end of the day. If the plan changes, go back and update your whiteboard. Make sure you know why you're doing whatever you're doing.
Indeed, that sounds like a hard problem.
So the question becomes "how much of the hundreds of millions in R&D are being allocated to solve the record-deletion problem?". I'd like to see spending reports, new research publications from Facebook (e. g. retroactive record-deletion, attempts to build models that are robust to deletion, attempts to build k-anonymity into models from the start).
> I know there are more nuances here, but I think there are some challenges Facebook has in implementing this, and business wise it's a drain on resources that will hurt them.
I can give Facebook the benefit of the doubt and suppose that they're trying to figure out how to transition smoothly without destroying their models. But I'd also like to see a hard timeline when they promise to roll out user.delete.all.data() anyways (business value be damned).
The real test of whether a company really "takes your privacy seriously" is whether they ever reach a point where privacy becomes a priority, i. e. whether there are decisions to do the right thing even when it could be bad for the bottom line (under the current business model).
c0nducktr's claim "By trying to prevent them, we lessen their effects" is backed up by the summary. In particular, the summary addresses the following question:
What would happen if...
(A) we could magically go carbon neutral right now? (i.e. "what are the lingering/2nd-order effects of the all of our carbon emissions so far?")
(B) we curbed emissions so global warming[2] stabilized to 1.5°C by $TARGET_YEAR (without "overshooting" that goal [3])
(C) we "overshot" and let global warming exceed 1.5°C... but then got it down <= 1.5°C by $TARGET_YEAR
(D) we curbed emissions so global warming stabilized to 2.0°C by $TARGET_YEAR
It turns out that there are real differences between each outcome -- even between (B) & (C) (See A.3.2). Section B addresses specific differences wrt how bad things will get at different levels of global warming (mainly 1.5°C vs. 2°C).
For example:
(A) Immediate effects (B.3.1): "Of 105,000 species studied, 6% of insects, 8% of plants and 4% of vertebrates are projected to lose over half of their climatically determined geographic range for global warming of 1°C, compared with 18% of insects, 16% of plants and 8% of vertebrates for global warming of 2°C (medium confidence)"
(B) Secondary effects ("Reason for Concern #5"): "Large-scale singular events: are relatively large, abrupt and sometimes irreversible changes in systems that are caused by global warming. Examples include disintegration of the Greenland and Antarctic ice sheets." If a marginal increase in the level of global warming causes a singular event to happen, then that increase causes a disproportionate amount of suffering via its secondary effects.
(C) Lingering effects (A.2): "Warming from anthropogenic emissions from the pre-industrial period to the present will persist for centuries to millennia and will continue to cause further long-term changes in the climate system, such as sea level rise, with associated impacts (high confidence)"
That said, you are totally right that we still need to prepare for the effects, and we need to do it sooner rather than later. E.g. "(B.6.2) Adaptation is expected to be more challenging for ecosystems, food and health systems at 2°C of global warming than for 1.5°C (medium confidence)."
Unfortunately, global warming is expected to have disproportionate impact on some vulnerable regions/ecosystems (e.g. coasts & tropical regions). Some of these vulnerable regions are Least Developed Countries and/or small countries with correspondingly small infrastructure budgets (e.g. some island nations). On an individual level, it may be "advantageous" for less-vulnerable nations to focus on improving their own infrastructure, rather than reducing their carbon footprint. In economics, this "advantage" is called a "negative externality"[4] (aka "tragedy of the commons")... it's part of what got us into this mess in the first place.
----------------------------------
FOOTNOTES:
[1] https://www.ipcc.ch/sr15/chapter/summary-for-policy-makers/
[2] Note: the term "global warming" is an average value -- robust to normal fluctuations in temperature. It's defined as the average temperature at the earth's surface over a period of 30 years. So the "1950's level of global warming" is the average surface temp over the period [1950 - 15, 1950 + 15] == [1935, 1965].
[3] "overshooting" here means "letting the peak levels of global warming exceed 1.5°C". Note: if we let global warming[2] exceed 1.5°C for just a few years (and still get down to <= 1.5°C by $TARGET_YEAR), it still counts as "overshooting".
[4] https://www.economicsonline.co.uk/Market_failures/Externalit...
Every month, I have to spend a day (or five) dealing with the nightmare that is filling my prescription so that I can function like a normal human being.
THE RULES: 0. For ADHD people such as myself, being forced to go a day without meds is like being forced to go a day without your favorite text editor. It's not fun. In addition, I don't feel safe driving then. If I want to go someplace without meds, I'm taking a cab.
1. Adderall is classified by the DEA as a schedule II stimulant. Some other schedule II drugs: cocaine, opium, morphine. If you opt for a paper prescription, it usually has security features like microprinting, watermarks, or holograms. You're going to be asked for an id (or three) when you fill the prescription. After all, you might as well be getting a prescription for cocaine.
2. There are no refills on your prescription, ever. You have to get a new prescription every month, which means calling in to your clinic and reciting all of the details. Nurses are not allowed to copy-paste these details, so you can bet your ass that I've dealt with a number of typos over the years. Sorting out typos usually takes a few business days.
3. A doctor must sign each prescription.
4. Some doctors flat-out refuse to sign prescriptions that they didn't prescribe. That's totally reasonable, except it means that you need to call in for a new prescription on a day when your prescribing physician is in the office. That means that you need to either learn their work schedule, or call in at least 3-5 business days before you need to fill your meds.
5. Most insurance companies will not allow you to fill your medication even one day early -- if you want to do that, you're paying the sticker price yourself. For my dose, the sticker price is $500-600.
6. In some states... - if you send a prescription to a pharmacy, then it MUST be filled there, and may not be transferred.
- pharmacies may not answer questions over the phone about whether medication is in stock. They might be able to answer in person.
- pharmacists may not call other pharmacists or access any sort of database to find out whether there is any pharmacy in the area with medication
- if there is not enough medication in stock, then the pharmacy may partially fill your medication with the available stock, but you void the unfilled portion of your prescription. Your insurance will probably not allow you to fill your meds early, even if the pharmacy is out of stock and you choose to fill a partial prescription.
Remember that you can't bring your prescription somewhere else, or call in advance to inquire about stock. So you have to remember to ask the pharmacist about their stock before you hand the prescription over, in case they don't have enough stock. That gives you the opportunity to blindly search the neighborhood for a pharmacy that has them in stock. Remember, you can't call about any of this, so you're going to be doing quite a bit of travelling.
7. Some pharmacists are antsy about filling a prescription for drugs in the same category as cocaine. I've met pharmacists who will insist upon verifying the prescription with your prescribing clinic. If you try to fill your meds when your prescribing clinic is not open, tough luck. Come back tomorrow.
8. Because of the effects that large-ish daily doses of amphetamines may have on one's heart, most doctors that I've met will insist on meeting with patients every few months to check your blood pressure, heartrate, etc. That is, your prescription is not getting filled unless you make a clinic visit every few months. Because I actually have ADHD, the conversation usually goes something like this: "Are you having trouble sleeping?" Nope. "Have you been fidgeting?" Nope. "Has your heart been racing?" Nope. "Have you noticed a change in eating habits?" Nope. "Do you want to lower your dosage?" Nope.
On one hand, I understand why it's smart to keep tabs on my cardiovascular system. On the other hand, it's obnoxious to force me to get a checkup every 3 months just to fill the same prescription that I've had for the past decade.
COMMENTARY ON THE RULES: Because it's relatively easy to acquire an Adderall prescription, the DEA makes it a pain in the ass to fill it, as a way to restrict the supply for the illegal Adderall market. These rules make it as obnoxious as possible to fill an Adderall prescription.
The thing is, a drug dealer with a bogus prescription isn't going to be too bothered if they're forced to wait a week to get an Addy refill. Sure, it's a loss of income, but it's not going to temporarily ruin their life.
I think the solution here is to make it easier to refill an existing prescription, but make it harder to get one in the first place.
ADHD TESTING: In particular, I think that people should be required to get formally tested for ADHD in order to get a prescription for amphetamines. Usually, you can obtain a prescription just by telling your doctor that you think you might have ADHD, describing your experience, and then answering some basic screening questions.
But there is a more formal test. At the behest of my parents (who were skeptical about ADHD), I got formally tested. It was a 12-hour test, split up into three 4-hour chunks. I was not allowed to take any stimulant meds (not even coffee) during -or in the 24-hour period before- the test.
The test measured my IQ, short-term memory, and ability to deal with monotonous or distracting tasks.
For instance, one of the tasks was to transcribe a page of symbols using a substitution table. The problem was that the substitution table was printed on the inside front cover of a stapled booklet, and I was transcribing pages inside the booklet. I was not allowed to remove the staples, so I had to flip back and forth a ton. To make matters worse, I had to transcribe each blob of symbols onto the back of the same page. More flipping back and forth.
Another task was to listen to a list of numbers, and recite them back in order, or recite them in reverse order, or recite them in sorted order. The number of numbers that you could recite correctly in the latter two situations was used as a proxy measure for attention span, and for immediate short-term memory in the former situation.
These are exactly the sorts of tasks with which I have severe difficulty.
The test did screen for mental health issues by asking some standard, but nonetheless subjective questions about anxiety/depression/well-being etc.). But on the whole, I thought that the test was largely scientific, and did a good job of measuring my cognitive impairment in a fairly objective manner. Admittedly, the test did not involve any brain scans, so it might not be the best thing available.
But in any case, it would make my life a hell of a lot easier if the inconvenience of obtaining and filling an Adderall prescription could just be front-ended!