HN user

thadt

1,704 karma
Posts22
Comments216
View on HN
words.filippo.io 3mo ago

A cryptography engineer's perspective on quantum computing timelines

thadt
551pts248
words.filippo.io 9mo ago

A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises

thadt
11pts0
blog.cloudflare.com 9mo ago

Cloudflare just got faster and more secure, powered by Rust

thadt
3pts0
lcamtuf.substack.com 9mo ago

How has mathematics gotten so abstract?

thadt
139pts207
dadrian.io 10mo ago

Revocation Ain't No Thang

thadt
2pts0
words.filippo.io 1y ago

Encrypting files with passkeys and age

thadt
136pts71
quic.video 1y ago

Your Job Now: Be the Outlier

thadt
1pts0
transactional.blog 1y ago

Enough with All the Raft

thadt
2pts0
arxiv.org 1y ago

MultiPaxos Made Complete

thadt
2pts0
aws.amazon.com 1y ago

Verify the Safety of the Rust Standard Library

thadt
1pts0
astro.build 1y ago

Goodbye Studio, Hello DB

thadt
1pts0
keymaterial.net 1y ago

PQC for Non-Cryptographers

thadt
1pts0
medium.com 2y ago

Flutter 3.22

thadt
3pts0
www.citationneeded.news 2y ago

AI isn't useless. But is it worth it?

thadt
17pts1
words.filippo.io 2y ago

Post-Quantum Cryptography for the Go Ecosystem

thadt
4pts0
techcrunch.com 2y ago

HPE says it was hacked by Russian group behind Microsoft email breach

thadt
3pts0
hachyderm.io 2y ago

Labscam

thadt
4pts0
blogs.bodleian.ox.ac.uk 2y ago

Traditions – Oxford grads spend 500 years swearing animosity to Henry Symeonis

thadt
7pts0
engineering.fb.com 2y ago

Verifying Code Authenticity on the Web

thadt
3pts0
twitter.com 3y ago

ShowTime: Amplifying Arbitrary CPU Timing Side Channels

thadt
1pts0
soatok.blog 3y ago

Cryptographic Agility and Superior Alternatives

thadt
2pts0
www.imperialviolet.org 3y ago

WebAuthn: Passkeys

thadt
4pts0
Mistral OCR 4 29 days ago

Yes, we've been using Transkribus for this extensively. My wife is a historian who spends quite a bit of time sorting through old letters and diaries, and it has been a considerable quality of life improvement.

Even if you are able to read someone's scratches, having a model to do the bulk lifting saves your eyes a lot of squinting. One thing that makes Transkribus useful for research vs a chat interface is that it can line up its interpretation alongside the original image so you can examine its work directly.

Whereas if we're talking about lossy compression (as is the person to whom you replied) we certainly can compress arbitrary data - almost as much as we want.

The hard question, then, is how much the decompressed output looks like the original.

I do not want a "connection" with a business.

That's because we don't make connections with businesses - we make connections with people. That one nice hair dresser. The pharmacist that goes out of her way to make sure my mom's medicines are right. A cashier that's just pleasant to talk with.

Years ago I did most of my grocery shopping at Target. I cared almost nothing about Target the chain. Or Target the super store. I did care about Betty the checker and wanted to know how her grandkids were doing this week.

Right - and if I ever go to raise VC then that's a guy I'll want to talk to. Even if they themselves don't invest, their recommendation would be valuable.

Life's too short to screw people over - reputation is one of the few things that last after we're gone.

Agreed. I scanned a short book with my phone, and a dedicated scanner would have been nice to have.

But with page flattening and separation and automated capture, it went much faster than I would have thought. If I were going to do a lot more, I'd want something like a scan tent [1]. It's not as ergonomic as a dedicated solution, but in 2026 a phone and some light can get you a lot of the way there, pretty fast.

[1] https://www.transkribus.org/scantent

They're doing transcription, not translation - so, turning someones pages of scrawled script into typewritten text. They have around 20 people nationwide that are able to do this. Most of them are older volunteers who aren't all that interested in computer assistance, but about a third of them have started leveraging the newer AI tools and it has accelerated their throughput significantly.

Having a 'best guess' at the lettering is really handy - in some cases the writing is really rather difficult to make out at all. Even being able to run something as simple as frequency analysis on stroke patterns would be a massive benefit.

At this point they're becoming throughput bound on the scanning process. Diaries are digitized since the archive is in one place and their transcription experts are spread out over the country.

AI had been a super useful for processing historical data. Interviewed a volunteer last month from the diary archive in Germany, and they're using supervised AI for diary transcription. Going from (old) personalized hand script to text is a lot of work, even for experienced transcribers. Being able to automate the first pass of that has been a huge boon to their processing pipeline.

In general I agree and suspect that memory safety is a tool that will continue to pay dividends for some time.

But there are tradeoffs and more ways to write correct and 'safe' code than doing it in a "memory safe" language. If frontier models indeed are a step function in finding vulnerabilities, then they're also a step function in writing safer code. We've been able to write safety critical C code with comprehensive testing for a long time (with SQLite presenting a well known critique of the tradeoffs).

The rub has been that writing full coverage tests, fuzzing, auditing, etc. has been costly. If those costs have changed, then it's an interesting topic to try to undertand how.

So the intersting question: are we long term safer with "simpler" closer to hardware memory unsafe(ish) environments like Zig, or is the memory safe but more abstract feature set of languages like Rust still the winning direction?

If a hypothetical build step is "look over this program and carfully examine the bounds of safety using your deep knowledge of the OS, hardware, language and all the tools that come along with it", then a less abstract environment might be at an overall advantage. In a moment, I'll close this comment and go back to writing Rust. But if I had the time (or tooling) to build something in C and test it as thoroughly as say, SQLite [1], then I might think harder about the tradeoffs.

[1] https://sqlite.org/whyc.html

Clarification - in the past when I've written high performance data tools in JS, it was almost entirely to support the use case of needing it to run in a browser. Otherwise, there are indeed more suitable environments available.

To your question, I was about to point out Firefox[1], but realized you clarified 'mainstream'[2]...

[1] https://briangrinstead.com/blog/firefox-webcomponents

[2] https://gs.statcounter.com/browser-market-share

Getting a broad overview of "world history" is useful for having basic context for large events, but, IMHO, history gets so much more interesting and educational when you're deep into individual people's lives and stories. I'm probably a bit biased, but tend to agree with the suggestions that you pick a time and place and dive deep into an individual or event that catches your fancy.

What does a "digital education" look like, specifically?

Having spent several years teaching kids to code everything from games to lightbulbs on Chromebooks, I can confirm that there are certainly difficulties - but they're tradeoffs. I could spend my time coming up with a way to work through the platform restrictions, or I could spend my time maintaining a motley crew of devices and configurations. Having done it both ways, they both have different pain points.

Well, it depends on the granularity of the time scale right? When you're measuring milliseconds, then the cable length probably isn't a thing factoring into your latency calculation.

When we're measuring time on the scale of nanoseconds then, yes, cable length is definitely something we care about and will reliably show up in measurements. In some situations, we not only care about the cable length, but also its temperature.

When I see juries in American courts, for example when I've served on one, it seemed like a group of people who take their job quite seriously. You are correct in that what a jury gets is a very curated set of information. The intention being to keep the jury focused on the details of a very specific situation with evidence that is processed in such a way as to be as "reliable" as possible.

It is by no means an accurate or incorruptible system. When we design and prove out a better, more robust alternative, I'll be eager to learn about it.

Well, it's fascinating right? Can we cleanly separate out military, politics and sociology? A whole lot of military capability comes down to not just technology and tactics, but the entire culture and makeup of the people. When we think of famous examples such as the Spartans at Thermopylae, the whole Spartan culture is important to understanding the how and why.

Context is really important. As you correctly note, many of the people the Romans were conquering could be even more ruthless as well (by 2025 standards). My point was more that historians wear a lot of different hats, depending on what they're doing. When you're wearing your 'investigator hat' learning how and why things worked, your thoughts might be different than when you're wearing your 'builder hat' and thinking about the society you might want to live in today (and tomorrow). It isn't a contradiction to weigh the tradeoffs that various people in history have made when designing their culture (and politics, and military capabilities).

Weird right? My wife studied Nazi Germany, and doesn't really like the Nazis either.

History is messy - we can and should learn from those that came before, both the good and bad. One can both admire the things the Romans accomplished while simultaneously despising the way they went about accomplishing them. It isn't a contradiction.