Hacker Newsnew | past | comments | ask | show | jobs | submit | CBLT's commentslogin

Skimmed the readme, seems like it's not AEAD? I don't see any reason to use a tool that's not AEAD.

Also, while I get the appeal of just storing it all in a giant JSON, I don't really feel that's the final word in simple storage formats. I'd personally just use SQLite, or some other format I could rsync.


> Skimmed the readme, seems like it's not AEAD?

Are you just looking for keywords? That's not how a quality security review should be done.

> I don't see any reason to use a tool that's not AEAD.

Do you have an actual attack? Non AEAD schemes have been used for decades without any attack.

There might be entirely valid complaints against this. Lack of AEAD is not one...

> I don't really feel that's the final word in simple storage formats.

Literally nobody said it was

> I'd personally just use SQLite, or some other format I could rsync.

You can rsync a JSON file just as you can rsync a SQLite file....


> You can rsync a JSON file just as you can rsync a SQLite file....

`sqlite-rsync` does a deep comparison and only transmits new rows, without deleting other data. `rsync` on a json file just replaces the file.


Text formats have the advantage of better support in version control systems. SOPS does similar thing, it stores encrypted values in yaml/json, and from my experience using this approach with git it is indeed an improvement over, say, Ansible vault, which essentially turns text files into blobs

I use pass[0] which uses a flat directory structure and git. It works great! At $dayjob we have json lockfiles committed to git and merges get pretty gnarly. Not as big of a fan of just dropping it all in json. The toml lockfiles are a bit better in git.

[0] https://www.passwordstore.org/


It is using https://cryptography.io/en/latest/hazmat/primitives/symmetri... so no aead. And also using this library as it strongly encourages to use something else. Because of footguns like this.

Writing C code that performs this fast doubling algorithm for Fibonacci numbers was actually quite fun. Highly recommend it.

In my experience where I didn't modulo the numbers, the compute time was dominated by the last couple of multiplications with Megabyte-sized integers.


The submitted link might be better changed to the actual release notes: https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Note... which start with this information.

The paper is interesting, but it doesn't seem to be supporting your title? I'm just past the part where they showed 100% infection rate in mice.


> In experiment 1, a 4:1 challenge-to-contact ratio resulted in 100% transmission among direct-contact mice, with all mice succumbing to the infection. In experiment 2, a 1:1 ratio yielded 50% transmission, with all challenged mice also succumbing.

What's not supported from the title is that they only tested in mice. But they do keep mentioning "mammalian adaptation" so it might just be that it's expected all mammals to suffer the same fate without certain adaptations.


> resulted in 100% transmission among direct-contact mice, with all mice succumbing to the infection.


I thought so too, but later on in the paper they mention that they performed necropsy on the mice that survived.

> samples from surviving mice on day 12 were also obtained through necropsy to measure viral titers.


Not only that, but just a month earlier, South Korean scientists published another Virology Journal paper revealing that they had engineered a chimeric H5N1 virus using hallmark gain-of-function (GOF) techniques, combining gene segments from three different influenza viruses to increase the virus's heat resistance, alter host targeting, and enhance human cell entry.

"Recombinant viruses were generated using a pHW2000 plasmid-based reverse genetics system."

"Combining the R90K and H110Y mutations (22W_KY) resulted in a synergistic increase in thermal stability and maintained HA activity without measurable reduction even after 4 h at 52 °C."

"22 W HA and 22 W NA genes, along with six internal genomic segments (PB2, PB1, PA, NP, M, NS) from PR8 and a PB2 gene from 01310 containing the I66M, I109V, and I133V (MVV) mutations"

The study also confirmed enhanced antigen uptake and intracellular penetration in human cells:

"The highest level of intracellular entry was observed for BEI_22W_KY, confirming its superior effectiveness in penetrating cells."

Ref: https://virologyj.biomedcentral.com/articles/10.1186/s12985-...


You're right, the law text doesn't specifically call out the Windows operating system or the Linux operating system. The example you gave of Open Source Windows drivers is valid.

The Grandparent's point about that "it double-dings open source developers" is still correct and poignant even with this clarification.


> The Grandparent's point about that "it double-dings open source developers" is still correct and poignant even with this clarification.

I feel like I'm missing what subset of people this is, exactly. We're talking about businesses here that would struggle with these tax rules. Which I guess is, mainly, contractors or startups. How common is it for such businesses to release their software as open-source, vs. as closed-source? I would've (naively) expected most paid OSS developers to be funded by large organizations/businesses that have plenty of money to fund them, not small businesses/contractors that would be severely impacted by this law. Is this actually a large set of people?


There are lots of small OSS businesses that are contractors to the big companies you mention. My go-to example is Igalia, who work on web browser and other core OSS tech, but there lots of others, some mentioned on the FOSSjobs wiki.

https://www.igalia.com/ https://github.com/fossjobs/fossjobs/wiki/resources


Watch other people shop at the grocery store. They buy the vegetables, beans, raw meats, and dairy. They spend more time there than anywhere else on the store.

Watch what other people eat in their day. How many of their calories came from meals created with only the above ingredients? 25%?


A couple of years ago, I was researching modern food science (for unrelated reasons). What really struck me was how focused we are on product longevity. Everything must have low available water in order to survive warehouses, transit, and shelves. Sugar, sodium, oils, and phosphates are all just tools to accomplish this.

Put another way, the bag of chips at the American grocery is _designed from concept to factory_ to be unable to support living beings. Microorganisms would die from dehydration trying to eat the chips. But due to a bug in human psychology, when we eat them we just feel more hungry. There only regulating feeling we get is guilt.


> Put another way, the bag of chips at the American grocery is _designed from concept to factory_ to be unable to support living beings.

This is a weird leap. Yes, there is some degree of modern engineering in packaged food to prevent spoilage but "unable to support living beings" is the wrong conclusion. You're implying the food lacks nutritive value, which is not true.


That is because Americans shop every 2 weeks so things need to last 2 weeks.

In other countries that shops more frequently there is less need for that, and there these products has much fewer additives.


Business continuity. If you don't have access to your backups, there's nothing you can do to work around a vendor issue.


Well written! Would you mind sharing how you came up with the "middle out" numbering system? I can never seem to come up with something this inspired when I'm doing math problems by myself.


The post presents it a bit out of order, but it was mostly from realizing at some point that the way the fractal grows by a factor of 5, base 5 number systems, and the "spiral" mentioned in the post can all fit together. I also thought a lot about how to programmatically draw the fractal and a natural way would be to start from the middle and zoom out.

There's an apocryphal story about Richard Feynman about how he used to keep a dozen or so random problems in the back of his mind and made a little bit of progress on them every time he saw a connection, until finally he'd solve one and everyone would think he magically figured it out instantly. This was a bit similar except I'm not nearly at that level and I've only been able to do that for one problem instead of a dozen.


https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...

Guix bootstraps (in 2023, no clue about now) from a 357-byte program. You audit the bytecode.


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: