zahllos

I can believe he wasn't sure mathematics was his calling during high school. I wasn't sure I would do a degree in mathematics until near the end, then I did (am no way near a fields medalist). But this is time up to 18-19. There's a lot of time after that.

However he took a course high in mathematical content and it sounds like he must have switched to mathematics for grad school, I.e. after his undergraduate or masters. In other words, he did the preparation. If it is anything like physics courses I have seen they feature a lot of mathematics courses anyway.

Some people have a lot of natural ability in mathematics but this is not enough to do good research. There's no way around hard work.

Also, dropping out of high school in many places significantly reduces your chances of going to university because you do the qualifications you need at the high school equivalent.

Why are fantasy settings by and large medieval (and not evolving) probably has some interest (often the setting involves lost technology, "a great civilisation has disappeared". Tolkien does this too, with the silmarils, the fall of numenor). In fact per Tolkien law all the amazing elves are basically dying out and we're gonna be stuck with boring mortal men in the fourth age. So arguably all the good stuff has happened and we're on the road to ruin. Wonder if he read the daily mail?

A significant portion of authors might just be emulating Tolkien, I suppose. Also hard to have a secret elven forest base with high resolution satellite imagery, thermal imaging and precision guided weapons.

You don't need the books though, you can check online to see about the scouring of the shire and Saruman in general, which for the Tolkien case makes his views pretty clear.

If you really want to waste some time, consider that the eagles came and rescued Frodo/Bilbo from mount doom near the end. They could easily have flown them _into_ mordor in the first place, especially since at that time the Nazgul were not airborne, saving a very extensive tour of New Zealand (uh I mean middle earth) in the process. Would've needed far less elven bread and a smaller fellowship and got them more air miles. Gandalf could've also taken a spa holiday instead of an arduous hike, bungee jump with a balrog, death and resurrection, which I'm fairly sure weren't covered by his travel insurance and likely not recommended by his doctor.

Ultimately it is a story. In some senses alternative worlds allow you to compare "what ifs?" and this can be fun. However you have to be careful how much you read tvtropes...

It is also clear that the author hasn't actually read the lord of the rings.

It doesn't feature in the films but the scouring of the Shire happens after the defeat of Sauron, in which Saruman and Wormtongue take over the Shire and push the same industrialization they were pushing at Orthanc. They have a small battle, Saruman is killed by Wormtongue, who is killed by Hobbits and then everything is right again for the last chapter.

I'd also say an industrial revolution of sorts is definitely a component of the story and unambiguously considered bad.

Hmmm, I see. I would have considered a political exemption to cover issues of political dissent, but I suspect espionage to be a gray area where it very much depends on political sensitivities. I.e. the US probably wouldn't try to extradite a UK citizen working for the UK intelligence community to not ruffle feathers, and the US simply outright won't extradite its own spies regardless. Sure, probably not fair, but there you are. Assange though is neither a US, nor a UK citizen, has definitely annoyed the US and crucially his acts if committed against the UK would count as crimes locally, which is usually one test for extradition in many treaties (haven't checked if it applies to the UK-US one).

For example, searching around, it looks like the US has asked spies to be extradited before and succeeded: https://www.nytimes.com/2018/10/10/us/politics/china-spy-esp...

I'm still not sympathetic even if he has a political defence, however. Wikileaks has published at least one classified UK document, which means he can be charged under the OSA in the UK anyway under the onwards disclosure clause (I don't know if they'll do this. Probably not, I would guess, due to lack of evidence. I do know there is a consultation ongoing to revamp the OSA partially in response to Snowden: press: https://www.bbc.com/news/uk-politics-57998950, law commission review: https://www.lawcom.gov.uk/project/protection-of-official-dat... consultation: https://assets.publishing.service.gov.uk/government/uploads/...). I think he would have stood a better chance of avoiding extradition pretty much anywhere else than the UK, including Sweden, which is why I am not sympathetic (if you're going to spit in the eye of the US, the UK is probably not one of the places to be when you do it). I'm also... perplexed, to put it charitably, as to why he'd avoid the Swedish extradition, as I think he would have had a better chance of avoiding extradition from Sweden to the US than the fight he currently has (where he has pretty much zero chance).

> And where will I host my box? I'm my apartment?

You seem to imply that the options are only cloudflare or your apartment. This simply isn't true: there are a plethora of companies that will lease you a dedicated box of some Us in one of their racks, as the sibling commenter replies. Alternatively, you can search for co-location services. Options range from 1U/2U co-location, to half rack units, to full racks, to dedicated areas of the datacentre ranging from cages to whole rooms (I've been in at least one datacentre where an entire room was under separate access control and leased to one customer only).

Usually datacentres are located quite strategically. For example the location of many datacentres in Zürich corresponds with two separate power supply grids that meet (so they can pull from both).

Some of the companies involved are resellers and don't actually operate the datacentres they use. Others actually do. Usually the service is more or less the same, from the point of view of renting a 1U, or co-locating one.

If you want reliability features of a datacentre, e.g. for your office services, but might move, you may find your local city surprising. In Manchester, UK, there's a large amount of dark fibre under the city (fibre that is laid, but not in use), owned by some of the DC companies. Sometimes you can connect your office to said datacentre via dedicated fibre.

> That’s not really how I see it. The case is shocking in that it has revealed that some rights that we thought that we had, cannot be enforced in law.

I don't know what right this is, but in the UK there's no right to do anything with classified information. Directly the opposite: the official secrets act makes it a crime to share it, distribute it, etc. The only real legal option you have if you find some classified information lying on a train (say) is to hand it to the police.

There's no exemption for journalism and it doesn't matter if you have been 'notified' under the act (that just changes the penalties) or if you are British or not (You're on UK soil, UK law applies). Classified information belonging to foreign allied governments would definitely fall under the OSA.

If that's shocking, ok, but that's the law and has been since the last time the OSA was updated.

I am not a lawyer, but I don't think sharing classified information unredacted would count as a political defence in the UK. I suspect that definition refers to political views and activities that don't break UK laws, e.g. I would expect the US would not be allowed to extradite someone purely for their belief that the US should become a communist state. However if they hacked the computers of th US fed, then they'd be fair game.

The treaty itself is problematic and the US recently refused the Saacoolas extradition. So the next time a British citizen is on the line we should refuse as well. But I also agree: this particular case is about the least troubling extradition ever.

In this case then I mean local local market, not devs working remotely for SV. I am aware. One of my friends does this and earns 2x what I do, in cash.

Ok well I can fix that. Hi, I'm a research software engineer and I don't have a PhD.

I'm in Europe. My salary is definitely better than the PhD students' salaries, and I have a proper adult pension as that's a legal requirement here. My salary is approximately equal to what a graduate might earn 1-2 years after graduating in the local market, so doesn't match my actual experience, but I accepted the post for pandemic-induced reasons. Certainly the salary does not, nor will ever, compare to levels.fyi/FAANG type jobs or a large corp in country.

However it is true that my position officially is very much a curiosity. We don't have a defined RSE type role, so the slot I fit in is "staying on to help out on project after graduating". My job is a fixed term contract that can only be renewed a certain number of times and I'm approaching that limit soon. There isn't any viable track to joining the ranks of researchers - I would have to do a masters first, and this ironically would require doing an internship, in spite of the fact I have more actual industry (non-university) experience than the entire lab combined.

I'm also not sure if my lab head bent the rules or not on hiring me - it might be the case that I am supposed to have a PhD or at least a masters.

I would agree with top level post in most points. It is interesting work, but I don't "belong" anywhere in "the system". This might change in 10-20 years. Artefact evaluation is very much becoming a thing in systems research, because being able to reproduce other people's work is quite important, and very occasionally you will stumble upon papers whose claims are, ah, more expansive than the associated github project can fulfil. As more research relies on software that graduate students are simply ill-equipped to write (by virtue of having no experience in anything and by being taught by professors most of whom no experience writing production code) the role of an RSE might become more important in time, but like anything it'll be a slow change.

Didn't realize Heegner was in that list.

To translate his result for people not familiar, unique factorization means that a number uniquely decomposes into primes. You almost certainly learned this happened in school for integers (Z), but it does not apply to all cases.

Quadratic Numbers in Algebraic Number Theory terms are Q[sqrt(-d)], that is, a+b\sqrt(-d) where a and b are rational numbers. d=5 is the first number we can pick where unique factorization does not hold.

In fact, the Stark-Heegner theorem tells us something even more powerful: if d is squarefree, the only imaginary quadratic fields containing unique factorization are when d=1, 2, 3, 7, 11, 19, 43, 67, and 163. Any other choice (or any choice containing a square of any prime, e.g. 4=2^2), and unique factorization will fail.

I've left out what a prime, or indeed an irreducible, mean in this case, but what's astounding at least to me is that there are only 9 such numbers where it works, and this is provable. Heegner did that aged 50+.

Yeah, ISA says you can. I wouldn't be surprised if other people pick other implementations, I'm not entirely sure why ARM felt the need for QARMA in the first place given there are already extensive choices for lightweight block ciphers, but... there you are.

I would not call it the "Manhatten Project" for elliptic curves. Sure, he found a curve that, when used with Diffie Hellman, allows us to treat any 32-byte string as a public key, but note that I said only Diffie Hellman. Edwards25519 does not have this property unless you map from Curve25519 keys. In addition, you can't clamp and preserve the group structure, and you also can't assume said decoding lands in the desired prime order subgroup, because it doesn't.

Curve25519's group of points over the whole curve is not of prime order. By Lagrange, the subgroups are the prime factorization of the group order. Luckily we do have a large prime order subgroup, but we also have a subgroup of order 8 and consequently of order 4 and 2 also. If you by chance decode a point into one of these groups, scalar multiplication has a high chance of hitting the identity point. In Diffie Hellman, this isn't a problem: we call it "non contributory behaviour".

If however you care about each party making a contribution and group properties, you end up having to check group membership anyway. Not having to do that is one of the main selling points of Curve25519.

Looking through the SafeCurves criteria, there are now complete addition law for prime-order weierstrass curves, negating another safecurves benefit. Since the NIST curves form a prime order group, they don't have the same subgroup problem (all Montgomery curves, by contrast, have a subgroup of order at least 4).

We owe the "fix" to this to Mike Hamburg, effectively, who came up with a mapping to and from a Jacobi Quartic form that allows you to encode and decode directly into the prime order subgroup. This is Decaf, one of the contributions of his Ed448-Goldilocks paper, and was applied to Curve25519 under the name Ristretto.

We can go further if you like. There's extensive literature on appropriate choices of pairing friendly curves, and I'm not aware of any DJB contributions here. There are also faster curves at the 128-bit security level for Diffie Hellman, i.e. FourQ, which uses the GLV decomposition and Q-curves. ---

While DJB has made some very notable contributions and helped push the state of the art along, he's not the only contributor to the field by a very long way. At the very least, we should also mention Peter Montgomery and Harold Edwards, but these are by no means the only names.

True. I was mainly responding to the ARM encrypted pointers part with that bit. ARM also didn't invent memory tagging, which might also have come from SPARC ADI (I'm not sure), but they also plan to include that. QARMA itself looks to be designed by Qualcomm engineers: https://eprint.iacr.org/2016/444.pdf

A lot of good stuff has come from SPARC :)

> I think apple (maybe as just an arm feature?) can do encrypted pointers, with a per application key tracked by the kernel.

ARM has added both pointer authentication codes and memory tagging extensions to their ISA, from (I think) ARMv8.5-A. Apple are the only ones to implement silicon that supports PAC that anyone can buy today but a) this will change fast and b) I might've missed something else.

I wouldn't say "encrypt". You can still read what the pointer is, you just can't forge it. It is more like a message authentication code, or keyed hash. Confusingly, the ARM ISA suggests you use the block cipher QARMA, a lightweight block cipher of their design. This is not a mistake - from a crypto academic's perspective the distinction between block cipher and hash is not so easy to draw as it tends to be communicated: you can get a block cipher out of the SHA family of hash functions (called SHACAL) and so on. There was a line of work on finding a suitable family of permutations (e.g. Gimli) that could be hardware-accelerated and appropriate constructions built from that.

tl;dr it is kinda a "signed pointer", and if you forge the pointer but get it wrong you don't get another chance because the CPU triggers a fault, so you can use lower security lightweight ciphers and still make exploitation very unreliable.

Now Fuchsia:

As to how Fuchsia does it, we can just look at the source:

1) https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/z... 2) https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/z... 3) https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/z...

For example. I don't think there's any magic here: the kernel maintains some structure to reference jobs, tasks or whatever we are calling our isolated privilege boundaries, in which the capabilities are described. On the face of it this "looks" a lot like the traditional permission-style system, but the key difference is that the root job will hand out capabilities to processes it has created. An example is probably the best way to proceed: on a linux system, you might decide your process needs to read `/system/sensitive_file`. To allow this to happen, you might grant access to the user using some other command: chown .../chmod ..., or you might set an selinux policy, semanage fcontext -a -t myprocess_t /system/sensitive_file. In a capability-based system, chmod/chown and even running the process as a user don't exist as concepts. You would need to use a process authorized to transfer a capability to your target process to access this file. In some ways, this is closer to selinux, in the sense that semanage fcontext updates policy, except that the policy is somewhat dynamic here: if your controlling process provides the capability, then the child process gets it.

In a microkernel-based architecture, the idea is that "servers" (jobs that are arguably part of the system, but don't need to be in kernel) are similarly userspace processes subject to said capabilities also.

Of course, some part of the code still needs to be privileged here, let's call it the "executive". This code is doing the capability enforcement, and if that code contains bugs, all bets are off, as always. You can't defend such code from itself, even with capabilities.

The real disappointment is that Zircon is written in C++. Granted it was probably started before Rust was a thing, but while Ada/SPARK might be considered a bit unfashionable, it has some formal verification available, and if you're going for a software solution this should help reduce exploitable bugs. Personally I also wonder what about seL4 made it unsuitable for this: granted, it is not complete as a system, but neither is Zircon alone.

Yes exactly, and your numbers are a lower bound, because the professor must do a few things: supervision of the PhDs, teaching (prep, lecturing, admin), grant applications, peer review (if not delegated to PhDs/postdocs) etc. The actual time the professor has for pure research is... not as much as you'd think.

Which means that having more PhD students means you can explore more of your own ideas by assigning them to it. It also means more teaching assistants and so on for your course. So the chances you will take and graduate one at a time are very low. Also, you know some fraction won't make it, so you need to account for that too.

There are three types of jobs a PhD could go into: A) industry job (just job to us mortals), B) industrial research lab (a company, but does research. An example would be IBM or Microsoft Research in CS), or C) a professor. For context, I work in a research group in a building full of PhDs, postdocs and professors.

For A, PhDs ought never be short of work. They were likely good students, they also spent 3-5 years looking at the state of the art in their field. Something should've rubbed off along the way. So a PhD is usually a good signal (but many smart people decide not to do PhDs, as well).

For B - the supply of places which will pay you to do actual research rather than company-specific goal stuff is much reduced compared to the supply of PhDs. This is why you'll find plenty of PhDs at Google doing software engineering - sure they're PhDs and they're smart, but they're likely not still publishing much. Whereas MSR/IBM research groups do publish (and in many ways act like a university).

For C - the chances of getting to tenure-track professorship are low, and when people say there aren't enough jobs for PhDs this is generally what they mean: there aren't enough academic jobs. The usual process is to become a postdoc and then to become junior faculty - a professor, but not tenured. Then you must seek promotion into a tenured role. Sometimes people skip steps, but this is the path people I've talked to have taken. Each stage is competitive: you have to convince a professor to take you on as a postdoc, then you must convince hiring committees you should become faculty and that you have the potential to become tenured. All the while, you must deliver enough research output to back that up.

At each of those stages, there's a relatively high attrition rate, and this is amongst people who obtained PhDs.

Told you it drives people nuts.

So big-O implies that the runtime is "dominated" by the term in brackets, or put another way, if I say something is O(n^2) I'm stating that as n->infinity the runtime of the algorithm |R| <= c * n^2, where c is some constant.

This is still true of exp^n, since |R| <= cn^2 <= dexp^n. Or at least based on my analysis background I'd expect this behaviour. It is of course a little pointless to say the algorithm is O(exp^n), but that's a different issue. It is still an asymptotic upper bound.

I just checked my copy of Sipser. Example 7.3 on page 249 if you care. They give an example that f_1 is O(n^3) and state it is O(n^4) also, since n^4 is also an (asymptotic bound) bound.

But this is not the point. I have no formal computer science education at all (my background is mathematics, some logic if that counts, but I've never studied algorithms) but many interviewers insist on this one specific area of CS, and yet if you attempt to engage them on the meaning of the things then unless you are very lucky they will a) make some excuse about how they'd have to check, their degree is a while ago, or b) they're actually only reciting also.

I'm strongly of the view this is a massively cargo-culted interview question of questionable to no value for most software engineering jobs, given that interview time is very limited and there are many more important factors to evaluate.

My favourite approach to big-O questions to to reply O(exp^n) to everything. When asked I point out that whatever it is, exp^n surely bounds it. This'll go either two ways. The interviewer will reflect on whether it is a least upper bound or not (and whether my statement is right) which makes for an interesting discussion about the other types of Landau notation. Or they'll get angry.

Ultimately I'm not convinced based on my own personal experience that many of the people asking the question truly understand either. I see it in a somewhat negative light because I feel it is essentially a cargo culted interview technique - recite a few 0()s, yeah we all did CS degrees, great (or not). If you actually try to get into the weeds...

I also don't think understanding big O notation is a great predictor of success of a software engineer. As well to ask if the series 1/n converges versus 1/n^2. What I'd rather see is that they can actually implement a solution. Take an ORM for example - a junior candidate knows how to use it and maybe how to debug it. A senior candidate might know that ORMs often emit very poorly optimised SQL and have some ideas on how to fix it. Example picked arbitrarily, ORMs aren't even my area.

Even in my actual area of specialty the number of industry programmers who understand say what an elliptic curve with complex multiplication actually is, or even undergrad group theory, is quite limited. And they don't need to - I mean it is ideal if they do, but you can still implement ecc without much theoretical knowledge. There's also a bunch of "not academic" knowledge on various implementation techniques that academics might not know or care about.

Brings me back to my ORM point. I'd much rather the person understands how the tools might fit together and more importantly learns any gaps or asks questions and identifies performance issues in the whole.

That's not to say that time and space bounds don't matter. They do. But 99% of my use of this knowledge has been to answer interview questions.

That's not quite what I said. I said the article's insinuation that D-Notices are some mysterious gag order and are being used as part of the UK Government's campaign of terror on Assange is wrong. I might be reading too much into the implications, but I don't think I am, feel free to disagree.

What D-Notices are is effectively a polite request not to publish certain sensitive information. Editors at newspapers can decide whether or not to comply with the request. Have a look here: https://www.dsma.uk/how-the-system-works/ and notice the explicit "DSMA notices have no legal standing". The very idea that this is a secret censorship conspiracy is laughable.

I think there is an interesting question arising from the Assange case as to who can claim to be a journalist and what protections this provides, but I do not think D-Notices fit anywhere in this. They're not even a law.

Yes. The reason for this is that the Official Secrets Act makes it illegal for anyone to keep or share anything that is "official information" under it except for "official purposes" i.e. for your government job on a government computer. There is no opt out for journalism and it applies regardless of whether you "sign" it or not. IANAL, but my understanding is the sole thing you can do legally if handed or finding classified documents is to take them to a police station and hand them over.

I would guess that the UK Gov knew full well that destroying these documents in the UK would not stop reporting, but doing nothing might set a precedent that they're not keen on.

I would reply to a sibling comment, but I believe this ought to be top level. I believe the author is conflating "D-Notices may be used to ask the press to self-censor" versus "'the man' is censoring Assange". So far as I am aware, nothing in the Assange trial would actually warrant a D-Notice, and if sensitive information were to be presented to the court it would be done in closed session anyway, since they at least theoretically have that option (they'd have to convince the judge of the need for this, if I understand correctly).

I kinda agree and kinda disagree. My context is that I was youngish (late teens) when Facebook first arrived in force, and we'd had MySpace/MSN before that. My other context is that I have had an anxiety disorder for a while and was diagnosed with asperger's (we still say that in Europe) not long before I turned 30.

I think I would always have had an issue, but I can quite directly point to the pressure cooker environment of getting into University. It is "not enough" simply to be good academically (which I was), you also needed to be a well rounded person, so you better use all your spare time doing activities to signal your well-roundedness!

I don't feel I was explicitly trying to do this, but I also, being 17, didn't really say no - I mean how do you say no to a bunch of career advisors telling you "you have a chance to go to the top university!!!" etc.

In such an environment, there's little respite, because there's always some kids telling you what they are doing.

I don't think social media in and of itself is to blame, but what it does, in concert with phones, is remove any and all "downtime" from this messaging. There's an encouraged perfectionism, so young people are bombarded with images of how _great_ everyone else's life is. Not only are kids pushy/perfect in the canteen, but now they're pushy/perfect at 10pm on your mobile too.

I struggled very badly with this at university. By that time I was a guy with panic attacks trying to keep up with a course, and I wanted to do all the normal stuff too like party. Of course since I _couldn't_ always do this it ended up being interpreted by most people as "let's not invite him". Social media wasn't directly responsible for this situation, but it is definitely a negative contributing factor. When you're far from home doom-scrolling facebook and all the stuff you missed that you're being left out of, this is really not helpful.

So what I think is that social media will reinforce people who are naturally self-confident, but it will not help people who have issues. I suspect every experience is slightly different, but the inability to escape constant reminders of your own inadequacy, if interpreted that way, is a problem.

Or if I can sum it up, it is simply the same old social/peer pressure, extended to 24/7.

What helps a lot is a moderating influence, a reminder that it is OK to be just normal.

I am also very, very glad I grew up when I did. All my early teenage years were free of any of this - we had MSN and texting and all the usual teenage angst, but you never had mobile doom-scrolling late at night - at best, you could text until you ran out of credit. I feel sorry for young girls particularly growing up with Instagram.

However, I agree that social media is just one factor. Pushy parenting, or pushy schooling, is also a huge risk, as are all the traditional risks like teenagers being horrible bullies to each other.

Addendum: the net impact of pushing me to go to a top university so hard was that I did not go to a top university, and dropped out of a pretty good university officially at the end of the first year, but unofficially I was "done" 6 months in anyway. Absolutely none of this career advice and "enrichment" activity helped me achieve any kind of potential, it just made me miserable and blow up with the stress of it.

I'm fairly sure they were abusing the standard with this particular technique. Deferred messages are OK if they can be retried later and that's what the MTA will try to do. Permanent deferral I suspect is really supposed to mean "we can't deliver right now and we don't know when but keep retrying".

What this does not do is trigger "undeliverable mail returned to sender" messages, so the end user has no idea their message is stuck in their own MTA's mailqueue until the MTA decides it has tried enough and gives up, and MTAs will usually persist for quite some time.

Spammers won't care what error code you send them or even worry about deferral messages, which is why the temporarily deferred spam trick works (first send is deferred for 1 hour, if you are a genuine MTA and you try again respecting this, it works). But permanent deferral, as I say, is very user hostile. The user thinks they've sent an email, but it isn't in the spam folder of the recipient. The sysadmin then has to go and dig to find out what exactly happened, and remove the mail from the mailqueue.

Luckily so far as I know we are only emailing a single yahoo address.

tl;dr the technique they are using is designed to handle the case where the receiving MTA is offline temporarily. There is a spam defence trick you can use and I don't object too much to that, but they used it to implement their block list rather than outright rejecting, and set the timeout to deferred indefinitely, which is just bad.

I can only contribute my own experience. I have a dedicated server with an IP address in a datacentre, with approx 6 users using my email server for their primary email. DKIM/DMARC/SPF all configured correctly. I also have policies that suspend logins for accounts if they send too much in a certain timeframe, because this is a pretty good indicator of account compromise. The limits would never be hit by humans.

I've had three issues. The first was delivering to outlook.com, but this was temporary and resolved relatively quickly: I simply contacted their support. At the time, they didn't bother to validate DKIM or DMARC according to their headers.

The second was a sender sending to us with a misconfigured SPF policy. I had quite strict rules that spf failure => user's junk folder that I had to relax, but I also had a discussion with the admins at the sending company to explain the issue.

The third was yahoo. For reasons known only to them, they decided that IPs they've never seen before will be blocked by returning an smtp deferral that is permanent, which is bad for legitimate mail servers because the email remains stuck in the mail queue forever. I ended up discussing this with their support also and after some discussion that block too was removed.

That's pretty much it. I receive dmarc reports now from many providers so I've an idea what percentage of our email is quarantined or rejected (none). I've been running email since 2011, for my own main email and a few others. I don't think deliverability is that much of an issue and I was able to resolve all the problems I've had in 10+ years of doing this by emailing support, explaining myself and asking to be unblocked. Usually this simply resulted in "OK but if you do bad things we will block you no guarantee of inbox delivery etc etc etc". That's fine. It seems that there is a large degree of per-account spam filtering as well at the big providers mapping to individual users' preferences.

Of course, if you don't set up SPF/DKIM/DMARC, or you have an IP with poor reputation (you can check the DNSBL) or worse a residential address, you will have trouble. I would generally look for a provider that has a relatively strict acceptable use policy, and in particular doesn't allow VPN endpoints to be run from their infra for your email, to reduce the chances your IP has a terrible reputation with the big providers. Also, join all the sender programmes, set reverse dns, don't let your users do things like send bulk email and that will reduce many of the problems.

> No. They are not Windows executables. They won’t run under Windows at all for multiple reasons. They are PE executables.

Starting with the fact they have a dedicated set of "subsystem" values: https://docs.microsoft.com/en-us/windows/win32/debug/pe-form... - the win32 loader won't load anything that isn't the CUI or the GUI Windows one, although the kernel also knows about the native one. You'll just get the "this is not a Windows application" messagebox.

With NASM, you can also override that linker stub. For example save this to a file:

    org 100h
    
    start:
        mov dx, msg
        mov ah, 9
        int 21h
        mov ah, 4Ch
        int 21h

        msg db 'Are you still running DOS in 2022? Wow! 640K enough for you!',13,10,'$'

nasm -fbin -o stub.com stub.asm

then if you are using Microsoft's tools you can use LINK.EXE <usual args> /STUB:stub.com and voila, if anyone _happens_ to (try to) your code under DOS, they'll get an amusing message.

If you want it to take up minimum space, use this one:

    org 100h
    
    start:
        mov ah,4Ch
        int 21h

which will just exit that program if run under dos.

Apparently the header is hardcoded in mingw, but you could easily binary patch it in the resulting executable.

I think I read somewhere you can also remove the stub completely, but I've never tried it.

Edit: for my last comment, yes, you can definitely drop it: https://stackoverflow.com/a/9659538.

I am actually for keeping the legacy scheme around for a good while, mostly because there's plenty of hardware even now that relies on it.

But UEFI is more sane. Bios systems map the first 512 bytes which are both code and partition table into ram. Into that you need to cram enough code to locate stage 2, which I think tended to be located in the alignment space between the MBR and the next sector. Stage 2 once loaded needed enough logic to find and load your boot partition, and load your config from it, parse the kernel list and finally load one of those kernels. I seem to remember grub hard coding where the stage2 actually was, although I might be wrong about that. Either way it was a kinda fragile mess.

Sure, every boot process needs to get enough logic loaded to do the next thing, but with efi this is all taken care of during efis various internal loading phases, nicely located in code on onboard flash where it probably should be. By the time it comes to look for what you want to load, you are already in long mode and we aren't hiding stuff in places not covered by a partition definition. It is kinda annoying they didn't consider a boot filesystem with large enough file storage for big images (exfat, udfs, other reasonable choice, we have the filesystems) but we can cope with that.

The process for detecting bootable partitions and updating boot entries is a lot, lot saner than BIOS systems tend to be. Sure there are details of the design I don't like, and I kinda agree with your points there too, but substitute those for better choices and you still have a reasonable overall framework.

As I understand it yes. That line had nothing to do with the atlantic slave trade and everything to do with the barbary one.

At the time that song was written, the Royal Navy did not in fact rule the waves at all (we were latecomers to the colonial game relatively speaking). It was a song designed to exhort people to the goal of ruling the waves, and so (amongst other things) protecting the UK from pirate raids.

Royal Navy manpower needs vastly exceeded volunteers, so press gangs (impressment into naval service, essentially conscription) was used. If someone had some sailing experience, for example serving on a merchant vessel, they were liable to be conscripted into the navy.

Conditions on longer voyages were pretty terrible. According to everything I've read, scientific minds figured out scurvy quite some time before the same solution penetrated the skulls of the admiralty. So on long voyages there was potentially a high fatality rate of up to 50%.

My reading of this is that they needed to maintain morale. Barbary Slave raids were a credible threat everyone faced, particularly as if you were likely to be pressed (by virtue of not being useless on a ship) you were also likely to live near the coast (where there are ships). So even if you weren't particularly bothered about ruling the waves for trading or imperial reasons, preventing slave raids would be something to feel good about.

The only thing I would change: I would use Caddy and not thttpd. This way the actual binary doing the serving is memory-safe. It may well require more disk space, but it is a worthwhile tradeoff I think. You can also serve over TLS this way.

> I would suggest they probably reached a last-minute deal with VISA rather than blinking of their own accord.

Yeah. I honestly wonder how that worked out. I suspect Amazon account for a not-insubstantial amount of payments so you have to wonder how that standoff was resolved.

> Barclays and (IIRC) HSBC

Interesting. Yes, most of the international accounts have some kind of minimum something, which is annoying. Euro and USD accounts are then possible. Other currencies they want you to hold a lot more money to get them.

I can see why transferwise have a market.

I don't think Amazon UK ever stopped accepting VISA entirely. They threatened to, and then I think they blinked at the last minute. It was also only specifically VISA Credit, not Debit cards, which continued to work.

I'll be honest, it was a struggle to get a EUR account in the UK before Brexit. I'm not aware of any high street banks that offered it easily, although I have been told it is possible. Most said something along the lines of "you want the international version of our bank" which roughly means either Isle of Man, Channel Islands or Gibraltar established outfit with similar branding. In contrast, I have a EUR account in Switzerland and can easily get a USD or GBP one. Most

Not in my opinion no, and I don't mind people asking me simple questions either. There are quite a few people who simply don't understand basic concepts and cannot actually write code. Higher qualifications are usually weakly positively correlated with competence, but there are plenty of outliers and exceptions.

I do generally agree with the cargo cult sentiment, but not in this case.

The main thing I dislike about the 7+ interviews is that I dislike interviews and there are 7 of them to get through. I once did four in one day, back to back, and I was extremely tired afterwards. So my big fear as a candidate is that either 7 interviews will happen over 1-2 days and I'll be absolutely fried after the first 2, or they'll be so hard to schedule it'll take 6 months just to have them all. I'm also a bit afraid they'll cargo cult some of the interview questions and I get a bit sick of "please recite 1st year CS algorithm" questions (I never ask these personally) but otherwise 7 interviews is fine, if they accept I am a human candidate and I'm not really comfortable in the process anyway.