stelfer

It goes deeper than Little's Law. Every decent textbook on introductory queuing theory has the result that on a normalized basis, fast server > multi-server > multi-queue. That analysis admits almost arbitrary levels of depth of analysis and still holds true.

Your observation that computing architectures have chased fast server for decades is apt. There's a truism in computing that those who build systems are doomed to relearn the lessons of the early ages of networks, whether they studied them in school or not. But kudos to whoever went through the exercise again.

To me it sounds like they hacked the editor/code signing tools to insert malicious code on save/commit by devs. Having iron-clad CI toolchains don't help you with that. Need to focus on how to defend the devs.

So how do we guard against this type of attack?

Looks like they compromised the editor. If so, then I imagine checking checksums for each component of the toolchain would work. Though if they compromised the filesystem or runtime then that would complicate things. But still, a hash tree or certificate of the OS and toolchain as part of CI would seem to be a good idea in 2021.

The act of measurement on the second particle destroys the entagled state of the pair. That effect can be measured on the first particle's side (which may be far away... on the other side of the galaxy maybe).

effective, accessible

because they all run as root

, and easy to use

yeah

It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement.

On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were.

[1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a

Take a look at Google Private Join and Compute[1]. But be aware that the problem you frame is an unsolved research problem with an active global community. The topics you are looking for are applications of secure multiparty computation and homomorphic encryption. Also, be ready for something as simple as a column join to take 24 hours per query.

[1] https://github.com/Google/private-join-and-compute

Probably never. Unique in the Crowd: The privacy bounds of human mobility[1].

[1]https://www.nature.com/articles/srep01376

True, but OTOH CA will likely start to change it's forestry management practices as a result of this. The distribution of surface fuel is a joint effect of drought and policy/management.

You're assuming that the reward function is giving you the community you want. In reality the reward function is to maximize engagement, which is a proxy for ad revenue. When there's an asymmetry in engagement dynamics then the whole thing drifts. The mass fallacy here is that FB is trying to build communities.

Real world incremental complexity is very high. To say nothing about the lack of an ecosystem.

I fondly recall interviewing at one of the faang companies years ago, when they ran out of things to ask me, and the guy turned to me and said: "Let's talk about network coding". My response, "Why would anyone want to do that?", probably didn't help land me the job.

We have theorems that say that's impossible, so I guess the answer is no? Or maybe Betteridge's law?

I think "Probabilistic Reasoning in Intelligent Systems" is a better starting point for Pearl. Not much easier but more familiar ground if you're coming from today's ML mindset.

As an aside, once while reading through Wasserman's "All of Statistics", he somehow hypnotized me into seeing the title of Ch.16 as "Casual Inference", so anyone who knows me knows that I can't help making a dad-joke about casual inference when the topic comes up.

It's not clear that it spreads via aerosols, in fact it's more likely that it spreads via droplet and contact. Thus the virtue of the mask is that it keeps the individual's fingers away from their faces. From the perspective of the theory in the article, masks keep people's fingers out of their noses. Of course, there are other ways to do that.

I remember going to the first SciPy conference at Caltech in 2002. IIRC Most of the talk was about needing better package management. What happened since is just amazing.

Mark Newman would like a word with you regarding power laws. So would HN, honestly: [2007] https://news.ycombinator.com/item?id=16414279

It's important to understand that there's a difference between "R&D" as it lives in most people's minds here, and "R&D" as it presents in financial reporting. The former is associated with hiring PhD's and building labs. The latter is everything not covered by cost of sales. Different companies balance the buckets in different ways at different times. And there are many activities that fall under the latter that most would not associate with the former. Companies that make staples report R&D on their financials too. And companies that fund AI also do a lot of R&D that looks the R&D that goes into making staples.

Thanks. I've been meaning for years to learn more about him.

Thanks for that. It made my day.

No offense to all the great people working at Docker over the years-- but after they came to see us right after they raised their series B, it immediately occurred to me that they had hired _all_ of the wrong people. I don't recall having had that visceral of a reaction like that with any other company. I think from the beginning they didn't really have a plan and it really showed IMO.

Wake me up when it's dead and we can start working on what comes next.

The realization that I came to was that by speaking up I was usually asking a question that many people were not asking; by providing a strong opinion it would help to catalyze deliberate action. If you stay silent we'll never get anything really done.

Haha. 10 years ago the carriers were flogging the voip ISPs over putative origination fraud and _robocalls_. Lots of us in the industry proposed solutions(mine)[1]. We also built some interesting and very effective ML systems to detect the originators in real time.

Here we are 10 years later no further down the road. Sad.

[1] https://patents.google.com/patent/US20080240082A1/en

Thank you

Also, write a treatise about how they discovered queueing theory... seems to be part of the pattern.

I'm talking specifically about modeling iid/non-iid sequences of data from events, experiments, etc. Haven't read the paper so, I'm not sure if I'm talking past the authors or OP.

Haven't read the paper, but I will.

But I want to comment that it's worked for us. Sequence to sequence learning can reproduce every kind of iid and non-iid things we've ever looked at.

The real question is how safe/anonymous is it really?

I didn't read the whole thing carefully, but... Leader Election + Terminating Reliable Broadcast is practically equivalent to building the Weakest Failure Detector and is the most feasible way of doing so. So, there are good reasons for doing leader election. This is why almost every serious consensus system ends up doing it whether they know they need to or not.

If you liked that, you might like

Matthew Richey's "The Evolution of Markov Chain Monte Carlo Methods"[1]

[1] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.295....

Most people associate "blockchains" with a protocol by which the "blocks" are inserted. Usually these things revolve around proof-of-work, proof-of-stake, proof-of-space, fairness criteria, etc. I think everyone gets that the Guardtime product is hashtree. From a formal verification perspective, the critical behavior is probably in the protocol, and most likely not the implementation of the datastructure or database.