Hacker News new | past | comments | ask | show | jobs | submit | OkayPhysicist's comments login

If you actually begin the steps of suing them in small claims court (which after the dropping of mandatory arbitration clause, is the official dispute mechanism for Minecraft), suddenly support has no problem giving you your account back.

If you bought the game back in the Notch-owned Mojang days, you have a license guaranteeing your right to access all future Minecraft versions. It's a pretty open-and-shut case.


That was never proven. A key reason why that was never proven was because a proven, as in proven beyond a reasonable doubt and convicted, corrupt federal agent had access to everything needed to fabricate the extremely limited evidence they used to insinuate it.

Do you know how rarely LEOs getting convicted of anything? If there wasn't a mountain of evidence that Ulbricht ran the silk road, the entire case might have been rereparable tainted.


Why would they fabricate such evidence?

Different people are embarrassed by different things. A frat student's probably going to overstate their alcohol consumption, a Morman understate.

People with bigger appetites underestimate their food consumption, people with smaller appetites overstate.

Not to mention the degree of over/under statement will vary wildly. "A big meal" might be 300 calories for somebody with an eating disorder, or 3000+ for somebody on the opposite end of the spectrum.


> "A big meal" might be 300 calories for somebody with an eating disorder

I knew a guy that complained that he "ate like a lion" and yet couldn't gain weight.

Turns out, his breakfast was typically a single egg and a slice of toast. Lunch would be half a sandwich and a bag of chips that he wouldn't finish. Dinner of course varied, but basically was like 4-6 oz of meat of some sort and a small side of veggies.

Overall, his daily calorie intake was probably only around 1,000 calories.

I don't know if this qualified as an eating disorder, or what, considering when we hear about someone undereating, it's because they're trying to lose weight. He was trying to GAIN weight and yet was still horrendously undereating.


Sure, but in a representative sample size this is largely irrelevant. The fraternity brothers and the Mormons cancel each other out, and regardless both are dwarfed by the large middle of the population that likely systematically and reliably under-reports their drinking by a few units.

The idea of outliers and systematic biases isn’t new to statistics, relative comparisons are still useful.


>Sure, but in a representative sample size this is largely irrelevant.

There is no way to know whether your sample size is representative. What amount of fraternity brothers and Mormons cancel each other out?

>and regardless both are dwarfed by the large middle of the population that likely systematically and reliably under-reports their drinking by a few units.

And? That does not prevent spurious correlations.


In more than one team I've been on over the years, I was the only person with a deep understanding of Git. What I've found as a result of being the "oh shit git" guy is that

1) all UIs are completely missing at least some of Git CLI's functionality (shoutout to git's most neglected feature, git notes)

2) all UIs have at least a couple git features so tucked away that you'll only find them if you know to look for them (git checkout -- path > temp_file is a common culprit here, but I've seen UIs that hide git ammend)

3) the average time for a UI-exclusive user to need my help for one of those two reasons was about a month.


Homeschooling without a ton of extracurriculars with interaction with children their age makes your kids weird. It completely stunts their ability to socialize.

I did fencing as a kid. It was basically a 50/50 split between homeschooled kids and private school kids. It was immediately obvious which were which, and the friend groups that formed were made almost exclusively of the private school kids and the smattering of public school kids.

If you're restricting your children's social life sufficiently to avoid peer pressure, you're causing irreparable harm.


>The next step is some canny asshole will take advantage of these people by selling them on their superiority or offering community, and radicalize them.

I've heard this claimed many times. But I also went to school with hundreds of other children, and I remember high school enough to know that many end up weird regardless. I don't think it's the homeschooling that does this.

I hear people whine about school shootings and that it's such a big problem that it must absolutely be solved, but on the other end "don't keep your children out of school they might end up weird" strikes me sort of strange. That's really your biggest concern?

>If you're restricting your children's social life sufficiently to avoid peer pressure, you're causing irreparable harm.

I've seen zero evidence that supports this hypothesis.


Exactly, and additionally, it's not just about putting them into extracurriculars. You have to let them go outside and make friends without adult organization because that's what it's going to be like once they grow up and don't have your (or some organization's) help on every step. If you don't let them do this, you're hindering their ability to learn to make friends on their own. Which in turn is where the peer pressure eventually kicks in, because, "hey, all those kids outside..."


An interesting problem I've played around with fair bit is the idea of a maximally expressable non-Turing complete language, trying to make a language that is at least somewhat comfortable to use for many tasks, while still being able to make static assertions about runtime behavior.

The best I've managed is a functional language that allows for map, filter, and reduce, but forbids recursion or any other looping or infinite expansion in usercode.

The pitch is that this kind of language could be useful in contexts where you're executing arbitrary code provided by a potentially malicious third party.


I think you're asking for Starlark (https://starlark-lang.org), a language that strongly resembles Python but isn't Turing-complete, originally designed at Google for use in their build system. There's also Dhall (https://dhall-lang.org), which targets configuration use cases; I'm less familiar with it.

One problem is that, while non-Turing-completeness can be helpful for maintainability, it's not really sufficient for security. Starlark programs can still consume exponential amounts of time and memory, so if you run an adversary's Starlark program without sandboxing it, you're just as vulnerable to denial-of-service attacks as you'd be with a Turing-complete language. The most common solution is sandboxing, wherein you terminate the program if it exceeds time or memory limits; however, once you have that, it's no longer necessary for the language to not be Turing-complete, so you might as well use a popular mainstream language that's easy to sandbox, like JavaScript.

One other intriguing option in the space is CEL (https://cel.dev), also designed at Google. This targets use cases like policy engines where programs are typically small, but need to be evaluated frequently in contexts where performance matters. CEL goes beyond non-Turing-completeness, and makes it possible to statically verify that a program's time and space complexity are within certain bounds. This, combined with the lack of I/O facilities, makes it safe to run an adversary's CEL program outside a sandbox.


Non-Turing-completeness doesn’t buy you that much, because you can still easily multiply runtime such that it wouldn’t terminate within your lifetime. With just map you can effectively build the cross product of a list with itself. Do that in an n-times nested expression (or nested, non-recursive function calls), and for a list of length k the result is a list of length kⁿ. And with reduce you could then concatenate a string with itself those kⁿ times, resulting in a string (and likely runtime and memory usage) of length 2^kⁿ.

If you want to limit the runtime, you need to apply a timeout.


If you're interested in prior art, Ian Currie's NewSpeak was an attempt at a non-Turing complete language for safety critical systems. Most of the search results are for a different language with the same name, but "RSRE currie newspeak" should find relevant links.


Idris is Turing complete [1] and has a very advanced and expressive type system (dependent types) where type checking is still guaranteed to halt.

That's because the language has a notion of `total` functions [2], and only `total` functions can be used for computing type signatures. These `total` functions must terminate in finite time and not crash. AFAIK, they aren't Turing complete, but they're still pretty expressive. `partial`, Turing complete functions are still allowed at runtime (outside of type signatures) [1].

If I understand correctly, running Idris in the type-checking mode (`--check`) should give you what you want.

[1]: https://cs.stackexchange.com/a/23916/159425

[2]: https://idris2.readthedocs.io/en/latest/tutorial/typesfuns.h...


Could be a good idea for a multiplayer ingame scripting language.


The model weights are the result of an automated process, by definition, and thus not protected by copyright.

In my unusually well-informed on copyright but not a lawyer opinion, without any new legislation on the subject, I suspect that the most likely scenario for intellectual property rights surrounding AI is that using other people's works for training probably falls under fair use, since it's extremely transformative (an AI that makes text and a textual work are very different things) and it's extremely difficult to argue that the AI, as it exists today, directly impacts the value of the original work.

The list of what traing data to use is probably protected by copyright if hand-picked, otherwise just whatever web-crawler they wrote to gather it.

The AI models, as in, the inference and training applications are protected by copyright, like any other application.

The architecture of a particular AI model can be protected by patents.

The weights, as the result of an automated process, are probably not protected by copyright.


> The model weights are the result of an automated process, by definition, and thus not protected by copyright.

Object code is the result of an automated process and is covered by the copyright on the source code.

Compilations are covered by copyright separate from that of the individual works, and it is arguable that a training set would be covered by a compilation copyright, and the result of applying an automated training processs to it would remain covered by that copyright.


You missed the third type, "write detailed leetcode regurgitating an obscure algorithm for this problem set up to have a very specific answer".

IMO, most complaints about leetcode are about that type. Nobody should need to "grind" to pass the "can you program at all"-type fizzbuzz problems. They're annoying, and indicative of a remarkable failure in our hiring system, but they're a minor nuisance.

Your second type, in my experience, is not typically referred to as leetcode at all, and is effectively impossible to "grind" for.

Unfortunately, my third type is extremely "grindable", as memorizing all the common algorithmic puzzles is a thing you can just do if you spend enough time on it.


> transport security doesn't make 0-days any less of a concern.

It does make the actual execution of said attacks significantly harder. To actually hit someone's browser, they need to receive your payload. In the naive case, you can stick it on a webserver you control, but how many people are going to randomly visit your website? Most people visit only a handful of domains on a regular visit, and you've got tops a couple days before your exploit is going to be patched.

So you need to get your payload into the responses from those few domains people are actually making requests from. If you can pwn one of them, fantastic. Serve up your 0-day. But those websites are big, and are constantly under attack. That means you're not going to find any low-hanging fruit vulnerability-wise. Your best bet is trying to get one of them to willing serve your payload, maybe in the guise of an ad or something. Tricky, but not impossible.

But before universal https, you have another option: target the delivery chain. If they connect to a network you control? Pwned. If they use a router with bad security defaults that you find a vulnerability in? Pwned. If they use a small municipal ISP that turns out to have skimped on security? Pwned. Hell, you open up a whole attack vector via controlling an intermediate router at the ISP level. That's not to mention targeting DNS servers.

HTTPS dramatically shrinks the attack surface for the mass distribution unwanted payloads down to basically the high-traffic domains and the CA chain. That's a massive reduction.

> The only people who can realistically MITM your connection are network operators and governments.

Literally anyone can be a network operator. It takes minimal hardware. Coffee shop with wifi? Network operator. Dude popping up a wifi hotspot off his phone? Network operator. Sketchy dude in a black hoodie with a raspberry pi bridging the "Starbucks_guest" as "Starbucks Complimentary Wifi"? Network operator. Putting the security of every packet of web traffic onto "network operators" means drastically reducing internet access.

> You have no more security that your food wasn't tampered with during transport but somehow you live with that.

I've yet to hear of a case where some dude in a basement poisoned a CISCO truck without having to even put on pants. Routers get hacked plenty.

HTTPS is an easy, trivial-cost solution that completely eliminates multiple types of threats, several of which are either have major damage to their target or risk mass exposure, or both. Universal HTTPS is like your car beeping at you when you start moving without your seat belt on: kinda annoying when you're doing a small thing in tightly controlled environments, but has an outstanding risk reduction, and can be ignored with a little headache if you really want to.


I especially agree with your point about Cisco trucks (although I think you meant Sysco, an important distinction since we are comparing food supply to networks). The fact is, there are plenty of ways to poison the food supply in our current society. Even ways that might minimize your ability to be discovered. And yet it is rarely tried. But networks are infiltrated all the time. I think partially because networks are accessible from anywhere in the world. No pants (as you said) or passport required.


Yeah, it was just a software patch. Real quick fix.


No, the Bolt had a manufacturing defect which could result in an internal short and cause a battery fire.

All Bolts were available for a recall maintenance where the entire battery was replaced under warranty.


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: