zxcmx

Using current technology, we would most likely render the earth uninhabitable due to the carbon emissions required to get it there.

If we had fusion & a space elevator it might be survivable.

We can borrow the reasoning from: https://what-if.xkcd.com/7/

That thought exercise involves moving 455 megatons of human off-planet. Getting rid of all plastic waste would in some ways be harder than that. Because we'd need to move that mass every year.

Current plastic production is about 380 megatons per year.

If you assume people are more or less fungible except for some "Q" (quality measure) sure, you probably wouldn't hire someone without a degree. You would sort your applicants by "Q" and drop everyone below a cutoff. I suppose I would call this the "human resources" view.

On the other hand if you have a team of domain experts who are passionate about subject "S", they don't actually care about "Q". They care whether you have deep interest, expertise and potential in their domain area. They want to know what you can bring to their team. Now, a lot of times a good candidate will be someone with a PhD in "S", but it's not about the qualification. It's about "S".

"No degree" hires usually don't come in the HR front door as a "fungible human resource". They usually get noticed or referred by someone passionate about "S", for a job doing "S".

I don't actually know if this was the OP's situation; there are other ways this can work. Good recruiters will try to hoover up talent by searching for people with relevant work experience (substituting that for a degree) and throw them into the funnel.

The original poster can give the real answer (I have a feeling you know what I'm about to write and want the _story_) but:

For certain technically focused jobs it's easy for other skilled practitioners to tell that you can do it.

A degree is nice but is actually less useful for signalling than concrete, interesting work in the field because the latter is rarer.

I've seen this play out particularly in computer security and low-level software development.

Where lack of qualifications really holds you back is when you're being hired by non-experts. They usually can't evaluate "direct evidence" and must rely on credentials instead. Paradoxically this means you can have an easier time getting hired without a degree at a "top" company than a mid-tier one.

Agree.

Also surprised it hasn't been feudalised somehow. Some company owning all the machines and then uber-ing out the hard work of siting them and restocking them. Gamifying the process of monitoring, "your fleet", the "ching" on your phone when someone buys a bottle of water or candy bar. Special deals for site owners. Branded supplies. An app for customers to talk to the vending machine. Loyalty points. A snack radar. Etc.

I think it's great the market is mostly independent operators.

It's good money for something accessible to almost anyone.

It doesn't require much capital, doesn't seem very regulated and needs no deeply specialised skills to get started. No franchise. No middleman or supplier lock-in. No fixed rental payments.

Easy to pull in friends & family labour if you need to scale, and if you miss restocking it's no biggie. Nobody yelling at you. Flexible hours. Rarely have to talk to people except about new sites.

Actually not that easy to think of things with all those properties.

Maybe you're thinking of the mean? BG shouldn't shift the median much in the situation you described unless the income distribution is really weird.

Except there are closer to 20 working days per month for month for most people, and it's kind of a wash at that point.

What you do get though is freedom from thinking about the cost of rides, which is pretty great.

SDLCs in huge corporates tend to produce slightly crazy outcomes.

There are 3 reasons I know of to implement jailbreak detection. Two "real" ones and one process related.

The first is that you have implemented security controls "on the client" somewhere. In which case you need to take some control away from the user to avoid circumvention.

The second is that you cannot really tell the difference between compromise and jailbreak; that is, you are less confident that actions on the device reflect the true intent of the owner. This is why, for example, banking apps can be touchy about jailbreaks.

The third is what I believe is happening here: You got burned at some point for the other 2 reasons, it's now part of your corporate IOT security standard to add it to every app.

Sadly the cognitive cost of deciding the "perfect" set of security controls for your toothbrush app is higher (and riskier project-wise) than just following the corporate standard. So team implements feature.

The problem is Philips have been burned by all the stunt hacking done on their bulbs and IOT in general. They're damned if they do and damned if they don't.

If they _do_ all the stupid security things they get this.

If they _don't_ do all the stupid security things they get sensational headlines where stunt hackers use drones to infect all the lights in an office building.

Philips had a security assessment on their app for all the obvious reasons. [I am simplifying, it may be part of their standard development process at this point to add these things].

That assessment came back with (among others) the findings:

xyz.124: No app obfuscation: our testers were able to reverse engineer the app and...

xyz.125: No jailbreak detection. During the assessment...

I've seen apps that _really_ don't need these things come back with these findings in reports from supposedly big, reputable security firms. That is partly because the findings are _right there_ in the methodology and pre-written, and it's low effort for the tester to paste them in and pad out their report. There is also the argument that its better to tell the customer they don't have those things and let them decide whether to accept the risk.

If you don't have engineers who can push back on "not applicable" security findings (or you have a team priority to reduce risk at any cost) then this is what happens.

It is also remotely possible that the app "needs" these things because the firmware is unsigned and they are concerned about stunt hackers posting on twitter about the funny or mildly nefarious things they can do with the brushes.

Jailbreak detection is not an exact science so you will inevitably get outcomes like this.

Systemically, threatening letters, while practically free for the government to send - cause a lot of stress for people. Both those who owe tax and those who have to prove they don't.

It's hard to know where to draw the line but you could reasonably argue that chasing low income people for small amounts is net negative societal utility, even when you get them to pay up.

The transactions still have to be valid (accepted by majority) to get consensus.

It's just that some subset of valid transactions are exploiting vulnerabilities in poorly written contracts. In this case, you want to make dead sure that your "good" exploit runs first.

This is not usual.

I think it's hard to judge with movie stars though because they are really not representative of the general population. There are particular selection pressures deciding who gets screen time, and the standards of today are not the standards of 40 years ago.

On reflection, I agree with you.

Making art is at least a largely voluntary activity, even if most songs will never be heard and most books will never be read.

From this point of view the root cause of the problem is that some people have a lot more access to money than others and can compel others to be human props in their dream of founding and leading a dog-walking-app startup.

Would it also be a good thing if we also limited the numbers of authors, poets and musicians in the world to the number "strictly necessary"?

Why or why not?

My take on it is that in the absence of omnipotent global co-ordination / allocation of resources that the "surplus" people are basically doing discovery. They are discovering the actual market size, exploring adjacent markets and all sorts of things about executing dog walking apps and apps in general etc.

I don't know if these are "bullshit jobs" or not, I'm not even sure if dog walking apps are necessary at all, but I'm not sure how we all figure that out without a discovery process.

I did enjoy the article, it made me think.

If they are being censored it is clearly not working because the story is all over the news.

It is possible they are being censored in some places because they look exactly like an influence operation, and COVID-19 misinformation is a huge problem for online platforms right now.

We have people out in the real world right now protesting about Bill Gates' mind control vaccine - activated by 5G - because they have been "memetically compromised" via social media.

I expect it might have gone a little differently if the claims in the paper had been peer reviewed.

Sorry, was perhaps poorly worded. By "first principles" I meant a static analyser working using only an understanding of the language (say, Java) and the application source code, looking over the ast/cfg etc using only built-in language rules.

You get much better (read: maybe useful) results if you happen to have a "rule pack" for the specific framework you're using which provides specific hints on sources + sinks, "gotchas" and how things are wired together. As a somewhat obsolete example, I would not expect a sast working only from "first principles" to be able to do anything useful with a Spring XML configuration file.

On the whole my experience is that these things work very well on certain types of codebases - e.g. naive PHP they can "go to town" because of the huge footgun surface and fairly direct control and data transfer.

Stuff with lots of "magical" framework features and indirection (where even a human reviewer can often have trouble finding the implementation from the interface being invoked) they often silently fail to do anything useful.

Not just languages - Generally if the scanner isn't aware of the specific framework you're using it's unable to find entrypoints or reliably figure out sources / sinks and filters.

Many modern frameworks have one or more of: dynamic configuration, compile time annotations, reflection, IoC etc which make it very hard for a "first principles" scanner to make sense of what can actually happen at runtime.

Reposting comment from dup at: https://news.ycombinator.com/item?id=24501195

You don't have to go back far (author -> paper -> author affiliations -> sponsoring foundation ...) before you literally find Steve Bannon's face staring out of the page at you.

I have no idea whether the arguments in the paper are credible or not (I'm not technically qualified to assess them) but the source seems to have a very clear political agenda. That doesn't invalidate their claims but I can't take them seriously without hearing from a more independent source.

There are some fairly distinct signs of media engineering all over this story. Just little things like the paper downloads with the name "The_Yan_Report.pdf" - what scientist uploads their paper with that name to Zenodo? That sort of thing.

You don't have to go back far (author -> paper -> author affiliations -> sponsoring foundation ...) before you literally find Steve Bannon's face staring out of the page at you.

I have no idea whether the arguments in the paper are credible or not (I'm not technically qualified to assess them) but the source seems to have a very clear political agenda. That doesn't invalidate their claims but I can't take them seriously without hearing from a more independent source.

The smoke problem is at the end of a long web of causes and effects.

It is not possible to put out sufficiently large fires.

We need to act earlier in the causal chain. But where? And who pays?

My mental model is that there's too much wealth sloshing around for "large incomes" to make too much difference.

High income is like delta-v, it's great. But you're still near the ground, and you're competing against people already in high orbit.

The beneficiaries of the housing explosion have equity which they can parlay into more ownership, whether for themselves as investments or their children.

Record low interest rates help prices by letting people lever up (letting them spend their lifetime earnings now) to compete but of course also bids up prices, again to the benefit of existing homeowners.

This is reflected in the fact that (for example) in the U.K over 1/3 of first time buyers did it by getting money from their parents: https://www.gov.uk/government/news/first-time-buyers-relying...

Furthermore, in the UK, Australia and NZ (less familiar with the US or Canada) it seems the government will move heaven and earth to prop up housing.

High immigration rates and supply restriction have not been helping.

I'm not as convinced as GP that the situation can last "forever", but I could see it lasting for another couple of decades. A true housing collapse would probably be a phyrric victory for the young.

Re: contamination from use: If you look into it, you'll find the "contamination" is that with a sensitive enough test, you can tell it's there.

The six figures in damages tend to be self-inflicted. The NZ government spent hundreds of millions on "meth house" remediation that by any rational analysis didn't need to be done.

https://i.stuff.co.nz/national/politics/104287037/rental-met...

Agree that manufacture is a totally different story.

If you think about it, the net result will be a transfer from workers to executives and shareholders.

Al = Aluminium

From what I can tell the actual weird part of covid-19 job losses is that the bullshit economy has continued unhindered - by going remote - and it is actually propping up the rest of the economy.

The white collar folks are just filing their TPS reports from home and it has tended to be the people who make or do concrete things who are impacted the most.

With respect to deaths attributable to renewables I believe people have deep psychological reasons for preferring those deaths over nuclear deaths.

Workplace accidents happen on a human scale; that is, they are within the experience of people and in the small seem controllable and within human agency. Furthermore, although this is a somewhat callous perspective, it seems too obvious not to mention that workplace deaths do not impact the energy consumer. Very few people experience ethical qualms around wood use, despite forestry being a dangerous occupation.

Nuclear accidents, while rare, tend to be larger scale and take away people's agency. They are not in fact even fully comprehensible to most people. For better or worse people do not feel on a personal basis that they are able to control for the risk.

Overall people tend to be happier with higher risks where they feel they have agency (e.g. driving) over smaller risks which are completely out of their control (say, flying).

The chutzpah of "big wind" profiteers! pushing their deadly renewables, part of a shadowy cabal holding back the nuclear future.

https://en.m.wikipedia.org/wiki/Gregory_Jaczko

Seriously though, while he does seem pretty contentious as a regulator he does have a PhD in particle physics and the record of his actions aligns with his stated position(s) in this article.

I agree the article is more human interest than reasoned argument but it is nonetheless good journalism (in my opinion...) because the story is good.

I also agree it is a missed opportunity because I expect with his credentials and experiences it would be really interesting to see him defend a more quantitative argument.

Existence proofs remain popular however, as do establishing upper or lower bounds.

They're a business device.

Historically, if you have a genuine business need for an HSM you're likely to be spending tens of thousands upwards on compliance costs and key management.

The device itself has become such a blip of a line item that it's dropped into the prosumer range.

I think this is partly due to racked HSMs (with a dedicated priesthood to perform the necessary rites) being slowly replaced with KMS and cloud HSMs in many (most?) new applications.

I'm not sure these things (small HSMs) can ever trend down to being true consumer commodities in their current form. The problem is that long-term you WILL lose your data unless you do proper key management, which is not something most people can do for themselves.

Context matters. So 3d sculpting software or CAD do not deeply need automatic updates, although it can greatly reduce support requests (e.g. something in the OS changed, software is now crashing, need to install update).

The state of play in 2020 however is that operating systems and browsers 100% need automatic updates for security issues. The reason we have them is because of all the bad things that happened when we didn't.

There should then be a very small switch hidden somewhere deep in the system where people like you who know what they are doing can turn them off. For the people who are using the software to say, run the electrical grid and a) care more about stability than security and b) pay people to write scathing reports about all the patches they're not installing.

IMHO there is a sticky middle ground with respect to office suites and email clients where the software is widespread enough that bugs are wormable.

Updates as a whole are inter-twingled with the developer's support and release model, how they a/b test and general maturity in terms of managing change. I feel like we're often complaining about different aspects of this when we talk about "updates".