yc12340

Land borders are closed:

https://www.consultant.ru/document/cons_doc_LAW_348748/

As a skilled developer ? Shouldn't be that hard - plenty of options to pick from.

Maybe it used to be that way in the past, but not these days.

When I tried to go to Ireland a year ago, entering the country was impossible due to a multi-year long COVID travel ban. Schengen visas were useless — you needed a job offer AND a job permit just to enter the country.

I passed a bunch of interviews, received preliminary offer from one Irish company, but got rejected during security screening (I have never learnt why). Decided against trying again, because Irish job permit queue was 6 months long and growing.

This was a year ago. Right now it is hardly possible to leave Russia at all — leaving by ground is denied by Russian border forces (remnant of COVID restrictions, which has been repurposed to enact impromptu iron curtain). Leaving by air is impossible because most companies stopped flying, airspace is closed and foreign governments are mass-arresting leased aircrafts. As if that weren't enough, Russian government has enacted a total flight ban, effective starting today.

Even if you somehow leave a country and go to Turkey/Serbia/Georgia with piddly $10000, — then what? You'd have to quickly find a job, rent a place to live, and get a residence permit before you are booted out of country. All of that under extremely hostile conditions, such as not having a bank account and being unable to speak the local language.

Glibc, libasound and other key libraries have poor compatibility history, which can be seen from their sonames:

libc.so.6 libasound.so.2 libfreetype.so.6 libX11.so.6

Each glibc/ALSA soname bump can spell death to entire generation of binary software.

In theory, you can link libX11, openssl and other important libraries statically, but many developers don't do it, because of weird concerns about "security", "compatibility" etc.

Compare it to Windows, where libraries like kernel32, user32 and gdi32 remained stable for decades and statically linking to them is unnecessary by design.

Probably not:

https://en.wikipedia.org/wiki/Sovereign_Internet_Law

"Filtering code"? This sounds like trying to plug hole in dam with one's finger. And the the hole is several meters wide.

do prompt engineering

Prompt engineering has always been a useful tool and still is. But a lot of problem, discussed here, can't be solved by any amount of fiddling. When Google does not even search long tail results, and there is nothing relevant in any of their "caches", doing prompt engineering only wastes one's time.

It appears, that there is some sort of fallback (?), that brings results of unfulfilled queries into a cache, but it isn't fast enough to respond to the user in real-time. Maybe Google should openly admit, that their resources aren't infinite, and offer to e-mail a better results once they are ready. Seriously.

The security problem is being able to talk to the same X server as trusted applications

Use Ctrl+Alt+F<number> to switch into another VT and run a different X server. Run zoom in container there.

I found this a lot more convenient than messing with nested X servers and other types of X11 client isolation. Each time you leave an X server and switch to another VT, the clients perceive it like the monitor being turned on/off.

Google will just stop showing statistics on cancelled subscriptions during shareholder meetings.

A poor credit score does not limit your ability to board a plane, to be admitted to a university, or to found a political organization.

Is it possible to do any of those things without money?

This sounds like it would cause LRU caches to lose their LRU properties...

So you are saying, that US government controls such staggering amount of money, that even it's debt (denominated in it's own currency) is several orders of magnitude bigger than total worth of the richest person in the world? And that person is also many orders of magnitude richer than a mean citizen?!

Suddenly, Bitcoin does not sound so centralized in comparison...

Versions of Android starting with Android 11 no longer allow anyone to spy on contents of user storage:

https://developer.android.com/about/versions/11/privacy/stor...

Asking for access to root directory is not allowed. Asking for access to "Downloads" or app-specific external directories is not allowed either.

There is an escape hatch:

https://www.xda-developers.com/google-file-manager-devs-subm...

but it is intended for dedicated file manager apps and requires an application to be manually reviewed by Google. Which hopefully means, that banks and other shady organizations won't qualify.

a keyboard isn't something you should install without some careful consideration because they can be used as keyloggers

To be frank, Android should not allow input methods access to internet/filesystem in the first place. But that would have hindered Google's own keylogger, so...

You can't really get rid of connectivity check, because it is a part of public API. Applications use it to check whether a network has internet access. Android itself uses it to detect captive portals and prompt user to authenticate when network requires authentication/payment via a web page.

On the other hand, having the wisdom of knowing what can be static in the first place? I don't think that it's something teached.

All traffic is static by definition. You are not modifying bytes when they are in transit to user. And you don't have to serve different bytes each microsecond just because users want to be "up-to-date". The network latency is usually around 40ms or so. If your website serves 1000s of requests per second, you should be able to cache each response for 10ms, and no one will ever notice (today this is called "micro-caching").

Of course, most webpages can't be cached as whole — they have multiple "dynamic" parts and have to be put together before serving to user. But you can cache each of those parts! This is even simpler if you do client-side rendering (which is why MangaDex abysmal performance is pathetic).

Then there are ETags — arbitrary strings, that can be used as keys for HTTP caching. By encoding information about each "part" into a substring of ETag you can perform server-side rendering and still cache 100% of your site within static web-server, such as Nginx. The backend can be written in absolute hogwash of language such as Js or Python, but the site will run fast because most requests will hit Nginx instead of slow backend. ETags are very powerful, — there is literally no webpage, that can't be handled by a well-made ETag.

Even pages, that need to be tailored to user's IP can be cached. It is tricky, but possible with Nginx alone.

Instead of "static" you are better off thinking in terms of "content-addressable".

An attacker would merely have to brute force the tip of their attacker repository, a matter which you can do within the hour

So you think, that you can do so in a hour? How much are you willing to bet on that?

For bonus points try to "brute force a tip" for repository, containing actual contents (as opposite to randomly named binary files with gibberish).

The "non-west" countries are forced to regularly buy bespoke amount of US goods as official tribute to their suzerain [1].

Other countries might not have much better packaging policies, but if you want a war on plastic waste, US and Europe are some of best places to start it.

1: https://www.cnbc.com/2021/01/22/china-failed-to-buy-agreed-a...

This sounds like it might help against DNS rebinding attacks, — at the cost of breaking interchangeability between DNS names and IP addresses.

Not sure, if such policy is a good idea, especially if the permission prompt automatically appears upon network activity without explicit developer intention. This will simply condition users to click "OK" without understanding what's going on.

Judging from reviews of hardware keyboard-video-mouse switches, they tend to work MUCH worse than Looking Glass. All modern GPU connectors are digital, so those KVM switches have to include a mini-gpu (usually a costly and buggy one). Also they end up re-implementing a complete HID support, because otherwise switching USB devices between hubs takes forever.

In nutshell, KVMs aren't worth their money because they have to re-implementing a lot of hardware already found in your PC.

Godot's FAQ makes some very good points, especially about GC, poor interop and inefficiencies language runtimes. But it feels like that reasoning focuses too much on the top interpreted languages (Javascript, Python, Lua etc).

Did Godot team considered using a compiled language like D with a bit of custom harness? Wouldn't customizing an existing object-oriented language be easier than designing a completely new one from scratch?

Java programmers are still confused by what happened when there's a data race

IMO, the most important thing is that JVM runtime isn't being confused into executing attacker's code.

Most programmers are unable to precisely predict behaviour of their programs anyway, — they get accustomed to being confused.

...and easy to exploit

It is incredible, how HN community (arguably made from some of the lest dumb people on Internet) can turn blind eye to this major concern while laughing and patting themselves on their backs.

I guess, industrial magnates of 1800s would have shown the same reaction, if someone told them about dangers of burning fossil fuels.

"This is ridiculous!", "But Sun was causing fires for centuries!" and "If it gets bad, we can stop burning more coal!" — those excuses didn't age well, yet most replies to this comment repeat them almost verbatim.

Of course, instantly sending all (or most) of Earth hydrogen into outer space is impossible — at the current technology level. But wasting what little water we have to make it is still a bad idea.

Many places are already short on fresh water — the kind of water, necessary for electrolysis. We can make hydrogen from saltwater too — after purifying it, but that's not commercially viable. No one uses "free" energy from solar panels to make new lakes or refill depleting aquifers.

Most of the Earth's surface is covered by water, but we can't even purify enough to satisfy our biological needs — otherwise Sahara would be a major agricultural and economical attraction. To solve world's water problem would require near-unlimited power, and the hydrogen production is not going to do it. At best, a hydrogen boom would result in another round of colonial robbery: stealing water from people, who can't defend it, to power more air conditioners in USA and Europe.

You mean those musicians, who regularly have their music stolen by music labels? I am curious, how you imagine DMCA enforcement by such people.

They send a DMCA notice to a Hollywood studio... then what? Will production committee pull the movie out of cinema? Will they recall blu-ray disks from shops to destroy them?

DMCA offers no way to negotiate compensation or receive payment — "artists, musicians, and photographers" still have to sue to get paid.

Historically ads were easily blocked

Historically ads were served by the site owner at their own discretion. Prior to that ads were served by TV and radio channels. None of those approaches were easy to block.

Dedicated ad networks on separate domains are relatively recent fad (since ~15 years ago). A lot websites still ship first-party ads, many have never stopped to.

Gorbachev is directly responsible for collapse of USSR, — he ruled it when it collapsed. So he is responsible for both of the disasters.

Shouldn't you be a little skeptical, when he tries to blame one of his disasters for another?

Because the laws of corporate mob don't apply to everyone equally?

There is a huge difference between treatment of different parties, even if the their contracts are same (and I doubt, that Samsung has the same contract with Google as everyone else). For example, do you know, that some Android devices aren't allowed to use a different launcher, other than supplied by Google? Or that Google Play Terms of Service prohibit publishing there alternative app stores? There are many such draconian restrictions in all Google's contracts. They are ignored until it is convenient for Google to enforce them.

Back to your question, — neither Samsung nor Amazon are Google's competitors. Their app stores are garbage. Samsung was trying to jump off Android for years. And Amazon devices don't come with Google's software, so Google has no leverage against them (except YouTube).

You can have third-party Android app stores.

This is only half-true. Google allows users to install third-party stores. Because only handful of geeks do that.

But if your competing app store gains enough adoption and you make deal with device vendors to preinstall it, the negotiations will mysteriously break down and the other party will grow quiet... Reportedly, because their (NDA-covered) contract with Google does not allow them to preinstall software from Google competitors.

See also: Google fined in Russia for prohibiting vendors from installing Yandex applications on devices [1]

But court decision apparently wasn't enough, so Yandex had to lobby the government to force smartphone vendors to preinstall their apps or get booted out of Russian market [2]

1: https://techcrunch.com/2017/04/17/google-reaches-7-8-million...

2: https://www.reuters.com/article/us-russia-technology-softwar...

Why would Xiaomi tell me to download a 26MB update from their store if the one from Google Play, where I downloaded the app it's less than 15MB?

Because, unlike Google, they don't use app bundles and partial updates?

Yes, tracking pixels aren't a thing (anymore).

Gmail no longer loads them. Thunderbird no longer loads them. Most providers, offering online email, have already caught on.

Trust me, people will find ways around it without JS. Reinventing Flash, for a start.

There is no need for that. Why bother, when you can write a mobile app in proper computer language and eliminate the middleman (browser)?