Hacker Newsnew | past | comments | ask | show | jobs | submit | zodzedzi's commentslogin

For anyone else who was also seeing just garbled characters in the title, and since the first few paragraphs of the linked article don't explain what that is:

GF2P8AFFINEQB is one of the AVX-512 CPU instructions that performs an affine transformation (essentially AX+b) on a Galois field - finite number fields used in coding theory and cryptography.

https://en.wikipedia.org/wiki/AVX-512#GFNI


Funny enough when I saw the gobbledygook, I immediately thought to myself this looks like an AVX instruction.


Off-topic question: I've been seeing this "si" URL parameter pop up a lot in shared youtube links lately. Which app exactly pulled the URL for you?


The share button under the YouTube video? :-)


> Bilinguals and monolinguals remembered English competitor words that overlapped phonologically with a spoken English target better than control objects without name overlap. High Spanish proficiency also enhanced memory for Spanish competitors that overlapped across languages. We conclude that linguistic diversity partly accounts for differences in higher cognitive functions...

This conclusion sounds like quite the leap.

Even if the two observations they generated turned out to be 100% ironclad true, generalizing to "speakers of different languages" as a title and "linguistic diversity" from observing just two languages seems like a big jump.


Paper conclusions are always leaps.

They are an embarrassment to science, and journals should ban them or move them to the editorial pages. Doing a bit of research shouldn't be a license to speed BS under cover of fact.


Science journalists should understand that one paper is just a piece of the puzzle.


> ... we had to build our own physics algorithm for very specific problems, and ended up selling the software ...

Like a simulation algorithm? Can you elaborate on what kind of algo and the problem it solved?


I can't go into details for confidentiality reasons but we published a paper last December on one of the simulation models : https://link.springer.com/chapter/10.1007/978-3-031-12019-0_...


> ... heapsort, which is kind of slow, but prevents adversaries from smashing your stack.

How does heapsort protect against a stack attack?


Oh, yeah. I forgot to quote that, because I was going to comment on it. It's an iterative, in-place algorithm, so there are no recursive calls to be made.

The bit I meant to comment on was the "kind of slow" part. It is true that heapsort tends to be slower than a well-implemented quicksort, but you don't use heapsort when you need the absolute best speed. The (IMO) best thing about heapsort is that its best case and worst case are the same order of magnitude, so sorting n things will take a fairly consistent amount of time, no matter what.


Heap sort can sort n elements with O(1) auxiliary data while quick sort (which is what libcxx usually relies on) in its worst-case performance would require storing O(n) stack frames. Since stack sizes are usually small, an adversary making you sort a million elements would likely cause a stack overflow.


Quicksort can be implemented iteratively, with O(1) auxiliary storage, as well: https://alienryderflex.com/quicksort/


The linked implementation uses logarithmic auxiliary storage but allocates extra storage such that the amount allocated is a constant and rejects inputs that are too large (inputs that wouldn't fit into any computer anyway). A similar trick can be used to convert any algorithm to "use constant space." Just allocate enough space to handle inputs of some large size and reject larger inputs.


Did you scroll all the way to the bottom? The "never fail" version that always sorts the smaller partition first, and allocates 300 "pseudo stack frames" will successfully sort any array on a real computer.

Sure, theoretically, it does what you say, but you know what they say, right? In theory, theory and practice are the same. In practice, not so much. And, these are real differences, too: theory idealizes real computers as general Turing machines, when, in fact, they're really only linear bounded automata: https://en.wikipedia.org/wiki/Linear_bounded_automaton

See also the commentary following the code:

> This might be slightly slower than the first one, but it will never fail because it always performs the smaller partition first. Hence, the only way it could run into the limit is if the to-be-sorted array was at least 2MAX_LEVELS elements in size. Since 2300 is greater than 1090, and there are only about 1080 fundamental particles in this universe from which a human-made computer can be built, no larger limit will ever be needed.

> (Note: Someone reminded me that a typically 64-bit index variable can index only 264 items, not 2300. That’s true, but if you’re using a 64-bit computer, you’re probably not going to have an array of more than 264 elements anyway, even if each element was only one byte.)


Unrelated, but this style he draws the timelines in: is it hand-written/hand-drawn, or software-generated?

It certainly has the overall feel and appeal of being done by hand, but I'm not sure.

If it's software, does anyone know which software, what's the name of this style, etc?


Many comments saying Waymo could easily spin up an Uber-replacement app are missing one key point: integrating with Uber allows Waymo to have a slow rollout / soft-launch.

They can start adding support one city at a time. And for the Uber user, the Waymo option only pops up for you if the ride you requested is within the Waymo range and they have cars available.

This way they can also collect tons of data about how users respond to the offers, affinity to driverless cars per region, price elasticity, etc. And then dial the supply up or down as they wish. They can even start covering a city with just two cars if they wanted to, and then build popularity and word of mouth.

On the other hand if they started with their own app, the lack of car coverage in most areas (due to low car supply, pending regulations, etc) would quickly frustrate users who would then switch to another app, so user retention would be a nightmare.

Not to mention side-stepping all the customer-facing operations of running such a business, which Alphabet does not have an affinity for.


I think my confusion is more about Uber’s incentives here. They’re providing a ramp-up platform for Waymo as you described, but as soon as it hits any scale Waymo can easily part ways.


Uber gets to introduce driverless cars finally (an old promise of theirs) without the costs of owning or developing hardware, and use that as leverage over drivers.

I don't think Uber has anything to fear from Waymo:

(1) It will take years for Waymo to ramp up to "independence" scale. How many cars do they have now, and how many would they need? How long will it take them to negotiate new regulations with every city and state? 5 years?

(2) This deal is probably not exclusive. Uber can strike a similar deal with Cruise as well. Uber becomes the Amazon of driving services, a platform gating access, with all the data.

(3) Having a big money company behind them is good. And if Waymo acquires Uber in 3 years, it's not necessarily a bad thing for Uber.


Waymo maybe could have gone with Lyft (or built their own app) if the deal with Uber fell through, which is probably why Uber accepted it. It's not "help Waymo get to market or not," it's "help Waymo get to market or risk somebody else (or Waymo themselves) passing on Waymo's value to customers and taking the market." Especially with the chance that Uber might get to play gatekeeper in the future, it's a hard deal to turn down.


maybe even buy Uber if possible


Is there any value there? Seems like baggage. Waymo doesn’t have a distribution problem.


brand name at the least


> Generally, the models are compressing their understanding of all text, and in doing so, they're learning high order concepts

Are these higher order concepts accessible to us? E.g. can we list those learned concepts?

(Re-reading the paper you linked now...)


My understanding is that the answer is generally: not yet.

(I wish, I suspect we'll be able to learn some interesting things about the universe, about humans, and so on, by seeing what LLMs found to be highly explanatory / high order concepts)


I use DDG as my default search engine, along with NoScript in the browser. Often when I visit a new website, I peruse the (long) list of domains that the site is trying to pull javascripts from.

I keep most of those source sites in UNTRUSTED status (including some of the big names in search/ads/etc). But I've always had DDG in the TRUSTED category because I had only seen its javascript before on the main DDG website.

(Unfortunately NoScript has a limitation that you can't tell it to "only TRUST javascript from example.com when I'm visiting example.com").

But recently I started noticing some websites pulling javascript from DDG (I don't remember which sites).

So now I was wondering if DDG is getting into the tracking business, since they're now having their javascripts load from third party sites.

Obviously this is anecdotal. But does anyone know if they are indeed beginning to track?


> (Unfortunately NoScript has a limitation that you can't tell it to "only TRUST javascript from example.com when I'm visiting example.com").

uMatrix (which I'm using in desktop Firefox) works exactly like this. Plus it allows you to forbid/allow cookies, styles, images, scripts, media, XHR, and iframes separately (for each origin/domain).


uBlock Origin in advanced mode also supports this (although only scripts/frames/images, not the full uMatrix list).


Ok I'll set it up sometime soon and give it a try. Thanks.


It's officially deprecated, but it still works.

https://github.com/gorhill/uMatrix


Any alternative to uMatrix?


Isn’t that non-origin?


The origin/non-origin difference only applies to uBlock Origin, not uMatrix.


Ahh, good to know. Thanks.


uMatrix really is the best dead extension. I still hope someone will revive or recreate it (or add the same interface to uBlock or one that is just as good).


I run uMatrix and have noticed some DDG showing up on other sites as well. The sites in question appeared to be (at least ostensibly) using it as a "can I reach the internet" sort of check. If I blocked requests, it would say something to the effect of "no connection detected." I wish I could remember which sites they were, but I do remember seeing at least one call to improving.duckduckgo.com from a 3rd party.


Ok interesting. I'll try to find those sites I encountered again and check it out with uMatrix.


Isn't umatrix dead/unsupported since like a year or so ago?


Unsupported, yes but so far there is no adequate replacement and it remains the best we have.


> Unfortunately NoScript has a limitation that you can't tell it to "only TRUST javascript from example.com when I'm visiting example.com"

I was under the impression that the custom option allowed this. Am I misunderstanding the point of this option?


I see "Custom" allowing you to choose which elements (frame, fonts, etc.) to allow/block for the domain you're configuring.

But it doesn't offer the ability to say "apply these settings to the domain example.com only when I'm visiting example.com, and not when I'm visiting anotherexample.com which happens to load JS from example.com".


Maybe I'm still misunderstanding, but when configuring the domain in the custom settings, it does allow you to limit the custom rules to only the site you're currently on, via the "Enable these capabilities when top page matches" dropdown. The default is "ANY SITE".


I don't see any of these options in my plugin. I have NoScript 10, and it looks like there is a NoScript 11 out there; is that what you have? Maybe the feature was introduced in 11 and I'm missing that update; checking their changelog now...

Edit: Correction - I do have NoScript 11; but don't see those options.


I think you nailed it - I am indeed on 11. So good news! It looks like NoScript is attentive to user needs.

Edit: seeing your edit - the plot thickens. I'm on 11.4.4 - any difference there?


I had 11.2.11.

And you're right, according to their changelog [1], they added it in 11.3.

>> v 11.3rc1 + Contextual policies (different capabilities for the same origin, depending on the top-level domain) configurable in the CUSTOM panel (thanks NLnet for financial support)

Woohoo!

Thanks for following up and making me look, I now have a better setup!

[1] https://noscript.net/changelog/


Glad I could help! I would hate for someone to miss out on what has so far been my favorite feature of NoScript.


Can you give us a list (or partial list) of sites that are pulling scripts from duckduckgo? We can look at what they're trying to do.


I don't remember the sites; I'll try to find them again, and will share here if I do.

I remember seeing 3 sites within an hour, and deciding to change the DDG setting to TEMP:TRUSTED afterwards.


The nice thing about DDG is that if you're willing to sacrifice some functionality it can still be used without JS at all (which is how I use it)


> So now I was wondering if DDG is getting into the tracking business

Anecdotal of course, but I've been seeing more and more DDG billboards. Those things aren't cheap, and my trust in them has declined the more I see them advertise in the traditional market.


So where does one from here for everyday search? Google is out. Bing has many of the same problems as Google. Startpage blocks my VPN. Brave has always felt just a little "off" to me, but maybe they're worth a try. Any others I've missed that are worth looking into?


I found Kagi[0] from somewhere on HN -- they make pretty strong privacy claims, and are in a closed Beta stage right now (you can give them your email, and they'll send you a signup link within a week or two). They're planning to charge a fixed rate for their search engine once they're out of beta later this year.

So far, it seems to be working really well for me! Results are pretty excellent, and they support the DDG bang queries (like `!g`) if you ever need it

[0] https://kagi.com/


How do we know these privacy claims are true? What if Kagi was Chinese or Russian, would you still trust it and why? And how do we know Kagi doesn't end up the same way as DDG?


(Kagi dev here)

Kagi is privately owned US corporation.

> And how do we know Kagi doesn't end up the same way as DDG?

Being a paid service means Kagi's incentives are very different. Instead of selling your data or profiting from feeding into ad-tech food chain, we are interested in selling you a subscription. This changes everything as the number one thing in Kagi's universe becomes what the users want, different to DDG, Google and other ad-supported search engines.

> How do we know these privacy claims are true?

Sadly I can not think of a way to verify them (let me know if you have one). But most plainly, we have no incentive or reason to do otherwise. Note that the only private information Kagi asks of the user is an email address, need to create an account, and those concerned can use whatever email they want.


Thanks for the explanation.

> But most plainly, we have no incentive or reason to do otherwise.

One reason is: to improve your services. Other reasons could appear over time.

> Sadly I can not think of a way to verify them (let me know if you have one).

The privacy claims could be verified by recurring external audits.


> The privacy claims could be verified by recurring external audits.

Not in reality. Nothing prevents a bad player from misusing user data once an audit is done. External audit would only be a good cover.


One way for Kagi to have more incentives for privacy of their users would be moving to EU where there laws much more stricter.


I trust Yandex more than I trust Google, because Yandex doesn't give a shit about me. I'd certainly use an English-language Chinese search engine.


I second this. I use this full time now. A helpful HN user told me about hyperweb for iOS which I use to make Kagi my fulltime search engine on iOS. I have been VERY happy


> they'll send you a signup link within a week or two

Is it though? I think I've been on the wait list for a few months now.


$10 per month (last heard), if they plan to start charing.


I'm biased so here's an independent take on your options: https://seirdy.one/2021/03/10/search-engines-with-own-indexe...


Set up searx and aggregate results from the ones you want (e.g. startpage you can route through a different proxy or vpn). Lets you clean out the crap and rewrite redirect urls to the original ones, etc.


Yandex is pretty good for image searches.


If they stick with billboards for advertising, I personally don't mind it. The issue to me is with tracking-based advertising(/anything).


I actually noticed that the quality of the search dropped (from pretty much parity with google sans-cookies), then noticed the new billboards and radio ads afterwards. I've seen tv commercials since.


Suck Suck Blow has many redeeming features. One that's GOLD imho;

duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/

Running a hidden service is just so jolly gentlemanly. And it works in the total absence of JavaScript and no matter what utter lies I tell it about my randomised-per-request UA, and cookie black holes. The obvious dark side is that it's closely connected to Amazon.


We don't use third-party scripts on our site and I don't know of any sites using our scripts either.


ublock doesn't correctly show beacons and pings

beacons and pings fired upon activating a link, happen after the document change, so ublock associates them with the new document, even though they are initiated by the old document


Which spigot algorithm is the 3-line version using exactly? (I did some untangling of the code in limited time, but it's still pretty cryptic.)


The original pi/spigot work was done by Rabinowitz & Wagon [1]. See also the very readable works by Jeremy Gibbons [2] [3].

[1] https://en.wikipedia.org/wiki/Spigot_algorithm

[2] https://www.cs.ox.ac.uk/people/jeremy.gibbons/publications/s...

[3] https://seminar-materials.iijlab.net/iijlab-seminar/iijlab-s...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: