Hacker News new | past | comments | ask | show | jobs | submit | twiss's comments login

Better performance. For a hash table, a cryptographic hash function is overkill (i.e. spends a lot of time to provide security properties that are not needed).


> For a hash table, a cryptographic hash function is overkill (i.e. spends a lot of time to provide security properties that are not needed).

Except, as we quickly find out, attackers can often exploit a non-cryptographic hash to create a denial of service attack.

The problem is that if my hash function is really a performance bottleneck, I'm probably better off using a really shitty hash function that exploits some feature of the data being stored that is "good enough" but super fast. In that case, even a non-crypto hash function won't be fast enough.

Finally, hash tables result in "random-ish" memory access patterns. On a modern processor, random memory access is so horrifically slow that you may get superior performance by changing data structures to something with a much more linear access pattern and dumping the idea of hash tables altogether.


There is a middle ground possible as mentioned in the paper, e.g. SipHash is a non-cryptographic hash function that provides security against DoS against attacks.



Do you think Lua (for example, or any other GC'd language) has valid use cases? If so, it needs an implementation. This blog post shows (part of) one way to do that.


Amsterdam has banned most diesel vehicles [1], so at least this is not universally true (anymore).

[1]: https://www.amsterdam.nl/en/traffic-transport/low-emission-z...


The demo seems to work in Safari 17.3 on Browserstack even without the rule, what version are you using?


Interesting - thanks. I'm on 17.1; time to apply a macOS update, I guess.


Interestingly it also seems to work fine on 16.5. Browserstack doesn't have 17.1, perhaps it was broken temporarily? Unless there's some other difference with the version of Browserstack somehow..


caniuse reports that a regression bug broke it in Safari 17.0 and 17.1: https://caniuse.com/colr


There seems to be a bug in Chromium-based browsers where, if you type e.g. `color: blue` in the textarea, it only highlights the r before the colon, rather than the whole property name. If you copy+paste the text instead, it works properly. (Still, that doesn't detract from this being really cool, of course!)


Yeah, I found if I add

    <div>
    </div>
at the end of the example, some of the letters of "div" would be green and some would be white.[1] Adding a class or something changed which letters were green and which white.

1. https://imgur.com/a/Ib2R9gh


Beyond the punctuation, it's also arguably the wrong number: it's the maximum payload weight, not the weight of the aircraft itself, that's 144,379 kg for the 777 Freighter (according to the linked page), and e.g. 159,570 kg for the 777-300: https://www.flugzeuginfo.net/acdata_php/acdata_7773_en.php.


> a lot of tools are made primarily for Linux. Surprisingly this even includes very popular ones like Git

A bit off-topic but this particular example becomes less surprising if you look up who created git :)


Not only who create git, but why specifically they created git.


How to make people who were there to witness it and migrated projects from subversion before GitHub was a thing feel old. Twas only yesterday dammit


Imagine how old you feel when you remember Subversion being the new thing replacing CVS…


Or moving from RCS to CVS.


But why did they create it?

Linux (UNIX) is an engineering OS. Windows is a slap dash Product chaotically rushed out and now buried under several layers of fad-strata that was meant to help moms store recipes on their kitchen PC. This is directly reflected in the development experience and culture.


This is wrong on so many levels. Linux started out as a hobby project. In contrast, Windows NT started out as a well designed system made by seasoned professionals.


... Linux was a hobby project copying UNIX. And Windows NT's "good design and professional pedigree" must be subtle because Windows is a hot, disorganized mess that's hell to use or develop in.


Well Linux needs Docker containers to make deployment and dependency handling manageable, so I’m not too sure which one is the hotter mess.


For China, you'd expect that to skew the data in the other direction, though. Since China has over 4x the population of the US, the number of metro lines is apparently over 4x higher (since China has more metro lines per capita than the US, according to the chart).


China has 50% more metro length than next 10 countries combined: https://medium.com/@gravitonaiconsulting/china-has-50-more-m...


China has a decreasing population and is just building a ridiculous amount of everything. It is however now running into the opposite problem – entire cities and transit systems are sitting empty. A lot of development over there is happening for development's sake without trying to reasonably match actual demand.


>without trying to reasonably match actual demand

It's reasonably matching short/medium term demand. Actual demand is PRC increasing urbanization from current 65% to 80/90% in next 10/20 years = need infra+housing for 200m-300m people. Utilization rate of HSR increasing every year. Current excess housing sqft is enough for ~100m (persons not household), ~5-10 years of urbanization headroom. This is without accounting for depreciated housing stock, QoL upgrades. For reference 80% urbanized US is short on ~6M homes, that's 2% relative to population. PRC gunning for 80% urbanization = PRC is net short 7-10%. Realistically much higher since a lot of people in rural stuck in very shitty housing stock. Of course there's some misallocation when building so much, but few under (yet to be) occupied developements / ghost cities or 50-60m empty units reasonbly matches demand/what can be absorbed over 5-10 year horizon. Population decrease doesn't factor much until after 2050/60s, by which time need to start factoring deprecated housing stock / end of life for concrete buildings. Other "demand" consideration is demographics aging out blue collar workers, might as well as build now while labour is plentiful and cheap, better to leave future with too much built capita than too little, as many developed economies with insane building costs are finding out.


There is just no way farmers from the villages of China are going to be able to afford the million dollar apartments speculators are buying up anticipating this continued movement from rural to urban areas. Add to that a still inflexible hukou system where even if you buy the apartment, you still can’t put your kids in local schools, it makes me think that the cities are still in for a hard time.

Many buildings are never going to be actually lived in before being torn down. The construction techniques they use to soak up unskilled labor results in concrete buildings that will only last 20-30 years.


Farmers (really the poor/underclass) directed o T3/4+ surplus that aren't worth $$$, where RE price declining. Also see central gov recently spending 300B rmb (imo just start) to transition vacancies into social housing. T1/T2 vacancies for more affluent/educated gen. Hukou likely self correcting problem (they'll keep reforming), lots of education surplus resources =going to free up YoY relative to trend of decline in past births. It's a big challenge - but IMO it's a easier problem to fill housing when you already have it then try to build enough housing when you don't/can't. Broader urban policy - central gov trying to distribute growth, urbanize/move ppl to less developed interior 2 tier cities with higher % vacancies with new industries. Big coastal hubs likely has soft upper bound in population (look at post 2014 population stalling for big T1s), I'd expect them to slowly settle 10% higher where they are by soaking up surplus to leave vacancies at healthy range, higher than 5% in hot western markets, lower than 15-20% in PRC. It's definitely a hard problem, but it's a problem where most of the physical pieces are are there.

>The construction techniques they use to soak up unskilled labor results in concrete buildings that will only last 20-30 years.

Unskilled gets trained by skilled, and do not remain unskilled. Bulk of building stock was built in last 15-20 years by migrant construction lifers already with 10+ years experience (entire demo skews old) with a lot of concrete pouring and steel welding experience. You don't build as much as PRC and have unskilled construction workers, half the world is built by diasphora migrant workers drawn from even less developed countries.

TLDR on China collapse meme narrative of PRC construction, for what it's worth my previous field. The chinese buildings have 30-40 years life spans (no one credible guestimates 20) narrative conflates PRC construction standards in last 20 years, where vast majority of new building stock was accumuluated, and is fine for 50-75+ years (as in the concrete structure is durable), with not affluent at the time PRC choosing to cheapen out on building systems that can be easily retrofit up to modern standards. TLDR is concrete/structure/frame is FINE, "short" lifespan is really about shittier/lower quality mechanical systems, not ecological, expensive to maintain etc, and until recently because PRC so good at building fast, the answer is just to tear down and rebuild. Now PRC richer, can still choose to rebuild or retrofit (both of which they're still good at), new HVAC, facade etc, to meet performance standards now that vastly richer. This got twisted into PRC concrete last 30 years. Quality of towers being put up in CAN are comparable (and frequently worse) as stuff I see in PRC where the entire process of erecting hires has been optimized to death.

There are some legit shit tier construction pre 90s (and much older) builds, i.e. all the gross mid rise you see in left behind township/village level admin divisions, exactly the kind of bad/poverty building stock reaching end of life that urbanization drive is designed to move people out of (stuff that's still all over SKR/TW). But even then, they're not collapsing out of nowhere in any numbers that actually matter, other than in event of natural disasters (i.e. Sichuan earthquake scandal), which is a real consideration, in some geographic areas. But most of building stock, built in last 20 years after - again we're really talking about the frame/structure - are fine for 50/60/70+ years like west. Also important to note vacant towers mostly not abandoned projects, there's still basic maintenance happening because they're on someone's portfolio. They're not sitting derelict for 10+ of years getting killed prematurely by elements -> they're not going to come falling down. Yes some will, but rounding error.

Regardless, IMO broader consideration is RE surplus was 1-2% of GDP for ~15 years where boom was happening. Even if they sit idle/unproductive indefinitely, you're looking at in aggregate ~1 quarter of misallocation at current GDP over ~60 quarters. That's not too bad of inefficiency relative to how much was built, and inefficiency of too much > too little, especially when any solution to urban housing / infra congestion starts with having enough.


All if the 30 story concrete apartment blocks are designed to soak up as much labor from rural areas as possible, so they aren’t the same people building 100 story sky scrapers in Shanghai. They use more concrete, the walls, floors are thicker, and so in, because this occupies a sweet spot where China is able to leverage migrant workers. This style of construction has also been exported to the rest of Asia (eg Singapore) and even the Middle East (Dubai), where you might just substitute Indian for Chinese migrant worker in the latter case (not completely unskilled of course, but we aren’t talking highly skilled either). And it’s not really wrong, if the buildings are used this is a good value, but if you wait even 10 years to fill them, I don’t think it makes financial sense anymore. 20 years is a good guesstimate if the buildings aren’t maintained very well, which will be true if they aren’t used and/or lived in.

Anyways, even if the buildings are torn down before used, this is seen as additional GDP so officials don’t care so much. You record GDP on construction and GDP on destruction, so the building longevity is a feature rather than a problem.


Pouring reinforce concrete is a entry level skill, the same migrant workers can do the work on 30 story res towers and 100 story prestige office towers (latter also has more skilled teams for steel skeleton / complex building systems etc). RoR also has to factor in wage inflation and access to labour, building out with known demand (per projected urbanization trends) in 2010s when wage was 25/50% of now and surplus pool was large. And of course return will depend on lifespan of investment, which is where I contend the 20-30 year meme number, since that's the only context where lol PRC quality bad, these investment are trash/obviously negative analysis makes sense. The entire narrative breaks down if it's understood these buildings are fine for 50+ years and can be easily retrofitted to modern standards. Lots of shitty USSR Khrushchevka from 60s/70s are going 50+ years, and will likely go past 70+. 20-30 years is an aggressive guestimate if (old) buildings are fully abandoned, left derelict to elements in particulalry harsh environs (i.e. Detroit), but they're not - these projects are managed / on someones portfolio, and have ppl going in doing very basic maintainence even if building underutilized/vacant. I think longevity becomes political liability - the worst kind of PRC problem - if building stock has to be demolished in 20-30 years, within life time of most people, that's within CCDI cracking skulls territory. Underperform by 10 years, and have 50/60 years lifespan, and it'll be someone else's problem because original planners are likely dead. Yes local gov builds to hit GDP numbers but try not to build in ways that spectacularly blows back within their life times because the one's that do don't have happy endings.



> China has a decreasing population

Not in the period shown in the chart, which seems to end in 2021.


It seems like the biggest counterargument to this would be the one made in https://www.brendangregg.com/blog/2024-07-22/no-more-blue-fr... (https://news.ycombinator.com/item?id=41033579), i.e. it should be possible to provide a safe API (like eBPF) to provide the access that third-party security apps need, without risking crashes.


I don’t know man?

At some level, we would have to accept that if we’re giving people, many of them hackers, access to kernel level facilities, there is a risk involved. If you want no risk, use a walled off OS. If you want a more flexible or permissive kernel architecture, then accept that the burden of securing it is kind of on you after a point.

Put in layman’s terms, I can put that riving knife on your table saw, but there’s still a risk to using it. It’s just a risky tool.


Ebpf provides exactly that wall.


Sigh.

Guys, eBPF provides more limited access to kernel features. That’s by design. Whatever the platform, the idea with eBPF is to limit kernel access and provide safe access only where ‘necessary’.

The entire issue is that MS limited access to their kernel. If you want the people who use eBPF, windows developers, to have the same access to kernel features as the providers of eBPF facilities, MS themselves, then you’re effectively giving them kernel access.

There is no such thing as safe full featured kernel access.


I personally don't have problems with developers having kernel access. I can't imagine any open source OS fan objecting to this.

I do have problems with MS or any other vendor using kernel access unnecessarily. MS Paint should not run in the kernel. Just because you can doesn't mean you should.

The question is whether MS or any other vendor could provide the feature set their product enjoys without running in the kernel. If Windows offered anything like eBPF but MS security apps chose to run in-kernel instead of through eBPF, then MS should be forced to give competitors the same kernel access. If MS would play fair and restrict their non-OS teams to userspace they wouldn't have to play fair by providing access to kernelspace.

The argument is that it is impossible for MS non-OS teams to play in userspace because MS doesn't provide the APIs to make it possible. It seems that some other OSes might not suffer from this deficiency.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: