1. 13

    Warrant canaries seem to be useless:

    • they’re built on a legally questionable premise

    • there’s no way to monitor them in bulk because no standard format exists

    • providers update them with meaningless frequency and discontinue them without any acknowledgement

    and the worst point: all those things train us to ignore them. If you accept the premise we’d be treating Talos as compromised, right now. That’s what a warrant canary expiring means. It doesn’t mean “ask (the federal agent) on Twitter if they’re going to sign a new canary”, it means “you now must assume this entity has been compromised because they took the time to build a system to tell you that and look they’re now using it”.

    Sadly it seems warrant canaries are a fail open system.

    1. 6

      They’re still somewhat useful. When riseup “forgot” to update theirs, everyone knew it was the FBI and bailed ship.

      1.  

        Why isn’t everyone assuming the same thing is happening here?

        1.  

          Occam’s Razor, I suppose (without having any knowledge on the matter).

          1. 5

            When Riseup’s canary expired HN was saying the same things:

            https://news.ycombinator.com/item?id=13007234

            The top comments from a techno wonk audience that would be likely to understand canaries were dismissive of the situation, even when Riseup posted suggestive tweets and stalled when asked about the canary.

            If Occam’s Razor points you to thinking that the expiry of a canary is anything other than signal, the channel is nothing but noise.

            1.  

              Yeah. If someone goes through the effort of having a canary and it expires there’s no reason not to believe something happened without evidence.

        2.  

          Agree. What good alternatives are there for riseup?

        3.  

          Yes, it’s only my best guess about the company that says they aren’t. I can’t prove they’re not until they update it, which they haven’t so far.

          1.  

            A machine-readable format would be pretty easy to create since there’s hardly any bikeshedding fodder (a true/false flag and a signature). I guess the real limiting factors are the other ones, and the first one is the biggest.

            1.  

              You also have to include a not-created-before proof (not just a timestamp). This is canonically done by mentioning a newspaper headline, although you could also use lottery numbers and sports scores. Or hey, most recent Bitcoin hash, why not.

              1.  

                https://opentimestamps.org is good for this I believe.

          1. 10

            I’m not a speedrunner or even a gamer, but you’d never know it from looking at my YouTube history. I love (and subscribe to) speedrunning and glitch channels pretty extensively…because they expose the game for what it is, and I like thinking about how the program itself was built, or what was missed to allow it to break in whatever way it did.

            (Son of a Glitch come back, please.)

            1.  

              I love this attitude. It reminds me of the CharOp boards back during D&D 3.5. Given some conditions, how is it possible to break the game? There’s a thrill in it.

                1.  

                  I love TvTropes, and it’s surprisingly deep for a wiki “just” about pop culture.

            1. 7

              Interesting to see that the goals of the “IndieWeb” are essentially the same as for Urbit: https://lobste.rs/s/c5gp8j/understanding_urbit

              1. 5

                Only some of the goals; and the how is entirely different.

                1.  

                  Indeed. It’s a very “cathedral vs bazaar” situation.

              1. 19

                Hi! I contribute a bit to Guix, and we’re discussing turning some of the things you mentioned into bug reports to help future users :-) Join us at #guix on Freenode if you have IRC!

                Also, what I do for contributing back to Guix is the following, it’s really quite simple!

                git clone https://git.savannah.gnu.org/git/guix.git
                cd guix
                guix environment guix # enter an environment suitable for building guix
                ./bootstrap && ./configure --localstatedir=/var
                make -j$(nproc)
                # make changes (add packages, etc)
                make -j$(nproc)
                ./pre-inst-env guix build mynewpackage # invoking guix as "./pre-inst-env guix" means you're using the guix you just built
                
                1. 5

                  I was planning on joining the IRC, but the fact that I have to register with NickServ is a major incontinence inconvenience. I usually don’t join these kinds of channels, so I don’t remember what my username of password is, ergo I have to create a new one, that requires Email as far as I recall – which isn’t working.

                  I will see what I can report back, since I would like to see these bugs fixed.

                  1.  

                    I was planning on joining the IRC, but the fact that I have to register with NickServ is a major incontinence.

                    I think you mean “inconvenience”. :-)

                    1.  

                      Nah, both words work in this context…

                      1.  

                        That’s what happens when you rely too much on your spell checker.

                  1. 5

                    From the “Your Last Computer” page:

                    Imagine that you can login from anywhere with one simple, memorable name and password. And when you do, an entire OS appears for you. Inside is your whole digital life. Every conversation you’ve ever had, all your biometric data — every step and heartbeat. Your personal mesh of devices: your doors, your car, your irrigation. All of your communities, every message you’ve shared with friends and family. Every connection you’ve made and every archival piece of data, in one place. Secure and private, forever.

                    Wow, no. Hell to the no.

                    (Am I understanding correctly that this vast quantity of sensitive information would be stored in a public blockchain, protected only by non-quantum-safe encryption?)

                    ETA: Also, from https://urbit.org/understanding-urbit/urbit-id/ it looks like they support only 4 billion Urbit IDs, which is already fewer than the number of people on the planet.

                    1. 19

                      To me it’s clear that the last 3 billion to sign up are considered non-people by the design of the system. They don’t deserve to participate as equals - they must act as servants or sharecroppers to the 4 billion “planet” addresses for access to Urbit.

                      Urbit seeks to stratify it’s users into classes. This document by founder Curtis Yarvin describes the system as “digital feudalism.” https://github.com/cgyarvin/urbit/blob/6ac688960687aa9c89d4da6fff49a3125c10aca1/Spec/urbit/3-intro.txt

                      The founder Curtis Yarvin wrote a “philosophy” blog for a while that describes his viewpoint as “neo-monarchism”.

                      I looked for a summary of this context and found this Verge article from 2017: https://www.theverge.com/2017/2/21/14671978/alt-right-mencius-moldbug-urbit-curtis-yarvin-tlon

                      1. 6

                        Currently the feudal lords of the internet are Zuck, Dorsey, etc. Urbit’s aim is to move users’ data from centralized servers at Facebook/Twitter datacenters into somewhere you personally control. The network governance is modeled after a republic, so it’s actually an improvement from what we have currently. And Yarvin is no longer part of the project, any of his philosophy has been stripped from Urbit (if it was ever there to begin with).

                        1. 7

                          I would assume, though, that Yarvin must be a Galaxy owner, giving him explicit power over what gets built and who gets added to the Urbit network.

                          The whole situation with Galaxies in general is problematic: it seems like they’re designed to lock in power over the network to 256 people, and there is no sanctioned way to transfer that power if the ruler does not want to give up their key. This is what people mean by “baking in” his philosophy into the design of Urbit.

                          1. 2

                            Galaxies can change hands like any other cryptographic asset. It just hasn’t been tried yet (afaik). Galaxies have power like ISPs have power, that doesn’t stop you from switching ISPs or running stuff on your own computer.

                            1. 6

                              Yes, and most people dislike their ISP.

                              More importantly, though, it’s not like there’s any hard reason you can’t have more ISPs. The internet is built to accommodate any number of them, it’s only the fact that it’s expensive that’s preventing competition.

                              Same with social networks today: there’s not much reason you can’t operate your own, and many people do, through Mastodon and the like. It’s only market forces that keep people on the small number of dominant networks.

                              Meanwhile in Urbit, it’s specifically designed such that a limited group of 256 people have dominion over everyone in the system. This group of people cannot be removed or competed against within the bounds of the system unless you convince them to sell their assets.

                              For a system that’s aiming to replace all computing, that’s a scary prospect.

                              And that’s only assuming that only one person will own each galaxy: we could easily see power consolidation via existing galaxy owners buying other galaxies.

                              Much as this page is getting high and mighty about the MEGACORP, I don’t see it as a preferable alternative.

                              1. 1

                                Very fair.

                                Except: are there 256 ISPs? I mean, nominally is one thing. Practically?

                                (I don’t know the answer to this question.)

                                1. 2

                                  In any one location, likely no. Across the entire world, though, I wouldn’t be surprised if the number greatly exceeds 256, especially if you count cell phone service providers.

                                  Urbit, in contrast, is intended to be a global system, and has a hard limit of 256 leaders for all people on their system.

                          2.  

                            And Yarvin is no longer part of the project, any of his philosophy has been stripped from Urbit (if it was ever there to begin with).

                            The fundamental idea of Urbit (buried under the slick marketing, and the weird esoteric programming language) is digital scarcity - replicating the scarcity of physical land on this planet in cyberspace.[1] Once the system is up and running, those that control the land can extract rents, or exclude those under them from occupying land they control, or entering strategic partnerships with other land owners… this is where Yarvin/Moldbug’s ideals of “digital feudalism” are expressed.

                            “Normal” ideals of cyberspace assume that scarcity has no place there - stuff like information and software can be replicated endlessly at very little marginal cost. Urbit explicitely rejects this.

                            Now, I don’t have a problem with this concept intellectually. People have different ideals and projects for the future of digital governance. But hackers interested in contributing to Urbit should understand the trade-offs they would be making, as opposed to contributing to a more “mainstream” project.

                            [1] this is anologous to Bitcoin being considered “digital gold”.

                            1.  

                              So you must also be against ICANN and their limited TLD designations? And against Twitter/Facebook for limiting users (shadow banning)?

                              1.  

                                Where in my comment did I say anything that made you assume I hold the opinions you ascribe to me?

                                1.  

                                  These are also artificially scarce resources

                                  1.  

                                    ICANN is insufficiently regulated and holds an artificial monopoly. There’s no technical limitation to prevent everyone on earth having their own TLD Edit apparently there is a hard-coded character limit to the TLD. That said, I welcome competition in this space and would like to see ICANN lose its monopoly.

                                    Facebook and Twitter identities are not artificially limited de facto - the services are awash in bots.

                                    And in any case, I stated the following:

                                    […] I don’t have a problem with this concept intellectually. People have different ideals and projects for the future of digital governance.

                                    I just wish that people pushing Urbit would be honest about the project’s ultimate goals.

                          3. 6

                            The most entertaining read about Curtis Yarvin is Neoreaction a Basilisk, by Elizabeth Sandifer. I found a good review of it, though I read it over a year ago.

                            1. 1

                              I backed this on Kickstarter, but I don’t think I’ve actually read it… thanks for the reminder!

                            2.  

                              After seeing everyone start to gush over this for the past couple days I was legitimate wondering if this was the same project as the one I remember being described as ‘digital feudalism’.

                              This is a plain attempt for a few people to solidify their power over the next iteration of web technologies so I think it is absolutely legitimate to call out their philosophy (which, again some people in this thread are saying isn’t relevant). This is a power structure we can still opt-out of, and I’m inclined to do so.

                            3. 4

                              You are misunderstanding. Urbit does not store data on a blockchain. It uses a file system like Unix.

                              1. 4

                                So when they say « you can login from anywhere with one simple, memorable name and password », where is the « one place » that data is streaming down from?

                                1. 1

                                  An Urbit server running wherever you have it running

                                  1. 3

                                    Wait, this implies that if your server is destroyed, you lose data. That’s incorrect, right? Everything in your server (node) is also stored across other nodes, and your node helps store other people’s data, right? Did I get this wrong?

                                    1. 1

                                      Afaik there is no replication currently, but you could certainly create an Urbit app that does the replication across certain machines. It would be a lot easier to make in Urbit than Linux because the network stack is tightly integrated with the rest of the programming environment.

                                    2. 3

                                      That seems like an extremely important thing to have mentioned in the first page or two, floating at least somewhere in all the Glorious Future marketing talk. -.-

                                2. 2

                                  Regarding the 4B IDs, an ID is analogous to a phone number. There are about 4B active mobile phone numbers, and mobile phones seem to work ok, so it’ll probably work out https://www.statista.com/statistics/274774/forecast-of-mobile-phone-users-worldwide/

                                  1. 4

                                    From the way they talk about all this, it seems like they want it to last for an incredibly long time, they make it sound like they want it to last literally thousands+ years.

                                    Sounds like the 4B limit isn’t really up to the task of lasting thousands of years and becoming an extremely widespread standard for computing.

                                    1. 2

                                      Let’s start with this decade first… increasing the 4B limit will be a good problem to have.

                                1. 6

                                  Much larger list I made with screenshots and links:

                                  http://charlesleifer.com/blog/monospace-font-favorites/

                                  Hope you find it interesting.

                                  1.  

                                    This is really good, thank you for sharing!

                                    1.  

                                      Thanks, it’s very informative and useful.

                                      What font is used for the code examples at the top of the article?

                                    1. 1

                                      For any Lobsters that maintain an ACM membership, how do you feel about this code of ethics?

                                      1. 3

                                        I think the ‘public good’ stuff is a pretty sharp turn away from the culture we have now. Unclear whether affected industries (ex: free-to-play videogames) have many ACM members on staff.

                                        Calling for ‘active’ preservation of diversity is controversial (I support it personally but the arguments over that are certainly ongoing in public). It stops short of recommending any particular active method, which IMO was particularly wise of the authors.

                                        Other than that it’s pretty standard professional body stuff - same as any other professional body code of ethics I’ve read (that is, accountancy and law in Australia).

                                        1. 1

                                          It stops short of recommending any particular active method, which IMO was particularly wise of the authors.

                                          Good eyes. I think it’s safe to recommend random, blinded selection from a pool where only their work or writings are seen. It sounds too unbiased if anything. I mean, the real bias would be in the inputs, if anything person-specific came off in the writing/projects, and so on. Yet, it’s knocked out a lot of issues while sounding pretty non-discriminatory (i.e. random). That could be default for folks that are worried about perception. It can be phrased as a possibility instead of strong recommendation.

                                          My method remains looking for X number of talented people in each group, making that the pool, and looking at random samples of entire pool in a blinded way. That way you’re biasing the supply side equally across groups. This is the social justice aspect that will be controversial. From there, each person earns their place based on performance. They know some tricks might have loaded supply side a bit to combat discrimination. However, each person that got in is because they earned it.

                                          Although I haven’t run it for proof, I strongly believe that a method creating that perception of earned placement… one that’s actually true… would make a world of difference vs things like traditional A.A. or non-white/non-male-only focus in “diversity” initiatives. This isn’t just for my group: lots of non-[majority] oppose methods that are or look like hand-outs favoring knowing they earned it. Probably intrinsic to human nature.

                                          Combating the injustice problem in a fair way that doesn’t create resentment is a high-priority issue for me. My experience in the South motivates me to avoid re-igniting tensions where possible. My solution focuses on fairness since that perception or need seems to have higher effect on whether reaction to a method gets acceptance or extreme push-back. I encourage people to have at this one to see if it works or is a flop. All I ask is credit for my contribution. If a flop, I’ll own up to that, try to figure out why it flopped, and come up with something more effective. My responsibility since I pushed it.

                                          1. 3

                                            I think it’s safe to recommend random, blinded selection from a pool where only their work or writings are seen.

                                            Isn’t judging people solely on their merit the exact thing that got GitHub into trouble a while ago?

                                            1. 2

                                              “Meritocracy” is often used to hide discriminatory practices. At the least, unconscious bias towards outgroups penalizes them. The word itself will instantly cause an argument with folks that focus on that sort of thing.

                                              My method fixes the supply-side bias to increase minority hires. Then, it blinds the pool during evaluation to counter some or all of that bias. Finally, the process looks at candidates performance in various ways to assess who gets in. The combination is more meritocratic in practice than many places but less than ideal form since I’m trading some merit for inclusive hiring.

                                              In practice, companies can get by without the best of the best. The ones that say they go for best candidates usually aren’t really hiring the best. One, last benefit is that the best jump ship way faster than the good workers that will come through my hiring process.

                                              1. 2

                                                The Scala community still has meltdowns about that time some shitty person was accepted through a blind submission process at a conference. (The process was pushed by the exact kind of people who were afterwards unhappy about the results.)

                                                So I’m not sure about the wisdom of that approach.

                                                1. 1

                                                  A close reading should reveal the difference between blind submissions and blind selection. A talk that was never going to be accepted (due to the speaker) shouldn’t have made it to the selection pool.

                                                  1. 1

                                                    That a bad person can get through a hiring process doesn’t mean we toss the whole process. We can toss that person out instead for whatever made them shitty. Fire them.

                                                    1.  

                                                      That would have been a possibility. Instead there are now semi-official boycotts of conferences whose organizers decided to invite the conference organizer who accepted that submission half a decade ago.

                                                      1.  

                                                        Wow. That sounds kind of childish. I appreciate the heads-up about that stuff.

                                                2. 2

                                                  The argument against meritocracy as described in the article you linked to seems to be, “a community which aims to be meritocratic is not one if it is comprised primarily of privileged white males, which means it can never be a real meritocracy.” Curious logic, at best.

                                                  1. 3

                                                    Meritocracy was intended to be a pejorative term:

                                                    https://en.wikipedia.org/wiki/The_Rise_of_the_Meritocracy

                                                    1. 2

                                                      More generously, “if you think you have a discrimination-free meritocracy, but there’s a difference between the demographics on the two sides of the hiring/promotion process, it’s more likely that there is bias than that you’ve randomly got an odd sample”.

                                                  2. 3

                                                    I think it’s safe to recommend random, blinded selection from a pool

                                                    For hiring, I think blinding as much as possible is a no-brainer.

                                                    Amazing how much pushback I got from ‘progressive’ workplaces over blinding our pre-interview code test submissions.

                                                    That said: hiring is a crapshoot; the only large study I’m aware of in the space comes from google, which found no correlation between interview score and job performance one year in. According to that evidence, they’d be better off drawing candidates names from a hat and hiring them (would be cheaper and just as accurate).

                                                    ``

                                                    My method remains looking for X number of talented people in each group, making that the pool, and looking at random samples of entire pool in a blinded way

                                                    That’s exactly what the best ‘progressive’ conferences are doing for their speaker pools. It involves a lot of very active outreach to fill the pool for some groups but the results have been pretty great.

                                                    ``

                                                    From there, each person earns their place based on performance

                                                    This part is harder (and IMO intractable) to do fairly. Performance needs to be evaluated by a human, and (necessarily) includes things like “works well with others”.

                                                3. 1

                                                  1.1. The first one instantly knocks out many working for surveillance-oriented and for-profit, owner/shareholder-focused companies. Maybe since some have a large benefit to the public. Folks looking for jobs tend to be able to go for one that aims for more good. Those that don’t might not be able to agree with this.

                                                  1.2. The second one I’m already practicing. You have to be willing to turn down six or more digits to do this. On abstract side, the problem with Do No Harm is one sometimes has to do harm to create the opportunity to do good. They actually acknowledge that in their Do No Harm section. Maybe I could agree to it in a conditional way.

                                                  1.3. Be honest and trustworthy. Again, I can mostly do this. The second I go do business with mass or enterprise markets I’ll not be able to do this. That’s because marketing requires at least selective omission of truths to highlight one’s own products and/or protect their trade secrets. Sometimes outright deception is called for if the environment is predatory in a way that makes the honest disappear. I can be as honest as I can in any given situation, though. The Code doesn’t allow for that here.

                                                  1.4. I help and call everyone out equally or close as I can. I’m already boosting folks that need it. I should be way ahead on this like 1.2. Accessibility tech is only thing I’d be behind on, probably updating my knowledge before a product release. Only problem here is if they force a specific belief system or type of practice here. Long-time readers know there’s going to be an ACM meta on that.

                                                  1.5. Respect I.P. laws. I’m a strong opponent of current I.P. laws calling for reforms. The U.S. system also allows people to get patents without doing anything to earn them before suing real inventors for massive money in often-rigged cases. DMCA abuse is rampant. Although I’d deal fairly, I think I can’t argue I’d respect, according to some courtroom somewhere, all DMCA notices or patent claims. I’d be a target of claims at some point. I’d say fuck them and ACM before I’d stay a member. Introspectively, I feel good knowing we got as far as I.P. laws before I strongly said “Fuck that!”

                                                  1.6 and 1.7: Privacy and confidentiality. The name is nickpsecurity. So, of course. :)

                                                  I’ll just stop there since this is a long comment with plenty for people to consider. I think the nature of capitalism or at least demand-side of employment contracts also makes some stuff in Section 2 questionable. Might not be able or willing to do some of it. Maybe another write-up another day. Also, why look at it if at least one requirement, maybe two, already disqualified me from being “ethical” enough for the ACM? ;)

                                                  I love ACM/IEEE as a researcher. They have great content. I strongly encourage people to get a membership to at least one to see cutting-edge research. Most stuff is cross-posted to both. I just might have to cross my fingers behind my back if I click “I Agree” checkbox on a thing or two. All I’m saying… Oh shit, there I go failing Section 1.3 again… I wonder how many pentesters could make it haha.

                                                  1. 3

                                                    1.3. Be honest and trustworthy

                                                    It’s certainly very difficult to ethically do business in a corrupt environment, or with corrupt entities.

                                                    Respect I.P. laws

                                                    In context, I’m virtually certain this means ‘obey’ rather than ‘like’. ‘Obey civil as well as criminal law’ is present in virtually every professional bodies code of ethics.

                                                    1. 1

                                                      Re I.P. laws. Yeah, that’s what I thought. For the same reasons, I might be found in non-compliance at some point by some party. All I can safely say.

                                                1. 6

                                                  Among the items being explored by systemd-homed are JSON-based user records

                                                  oh god no

                                                  1. 5

                                                    I’m looking forward to the discussions of whether systemd represents a use of JSON for good, or evil.

                                                    1. 7

                                                      Evil, obviously. Fortunately (?), they’re not going to use json.org’s parser; they’ll implement their own, with a bunch of brand-new never-before-seen security vulnerabilities.

                                                      1. 1

                                                        For good.

                                                      2. 4

                                                        You like the GECOS field?

                                                        1. 9

                                                          Surely we can agree there is design space worth exploring between “the first thing the Unix devs originally hacked together in ’69” and “arbitrarily-structured unschema-ed generic serialization format with poor human readability and writability which is difficult to manipulate with plain-text tools and has few affordances for streaming reads”.

                                                          1. 3

                                                            How often are you editing /etc/passwd and friends “raw”? I just checked my VPS, there’s 35 lines, of which one is my user (that was added when I set up this instance). The rest have been added programmatically by apt and friends.

                                                            When I actually did have to add stuff (on *BSD) I used vipw to prevent me from messing up a field.

                                                            I suspect most files for user directories etc are generated programmatically (via puppet etc) anyway. Why does the file have to be easy to handle in a text editor?

                                                            1. 3

                                                              Well, if it doesn’t need to be human editable, why use JSON? It’s purest madness.

                                                              1. 2

                                                                Because, in contrast to a binary format, you can fix it with vi in case it is really necessary.

                                                                JSON is not my favorite text-based data format, but switching to something that is more structured that is still human readable, but also machine-modifiable sounds like a great idea. If it really needs to be JSON, I can live with it.

                                                                Anyway, this borders on bike shedding, we are discussing JSON vs. TOML vs. GECOS, rather than the main ideas proposed in the presentation: decoupling user information from /etc, making home directories portable, better per-user home directory encryption, etc.

                                                                1. 1

                                                                  It’s purest madness.

                                                                  I don’t agree, but I’m open for suggestions for other formats.

                                                                  The entire idea is so much more than just “JSON for config” - there’s all sorts of stuff to make using a Linux computer better for (mostly) laptop users.

                                                                  1. 2

                                                                    Yeah, I push back against JSON, not the systemd stuff in the large – it doesn’t cause me much heartache, because I only have one Linux computer in my life, and I hate hate hate hate traditional SysV or BSD init garbage.

                                                          2. 6

                                                            I don’t see the problem? JSON is reasonably okay and widely implemented, which makes it a good choice for something that may be manipulated by multiple parties.

                                                            1. 5

                                                              Until jq becomes part of coreutils, newline-separated records have much better shell support. I haven’t looked into the kind of manipulation that will be done to these user records, though.

                                                              1. 1

                                                                I’d assume/hope that’s mostly privileged to the system itself and maybe moderated through the daemon.

                                                                On coreutils, I have not enough insight and you are probably right, but on the other hand find the coreutils path becoming antique.

                                                              2. 4

                                                                It doesn’t support comments. TOML or one of the JSON variants would be more appropriate.

                                                                1. 4

                                                                  There’s a json fork called “hjson” (https://hjson.org/), which adds comment feature for json (among other small things), and it can be used for configuration files, but I doubt that it would be used by the systemd team.

                                                                  Also I think TOML is pretty nice; trivial use makes it similar to .ini files, which systemd already uses, but at the same time it supports more complicated config structure.

                                                                  1. 2

                                                                    TBH I think that all systemd service files should be moved to the TOML as it is more standardised and IMHO cleaner than their custom format.

                                                                2. 2

                                                                  I think it’s a bit surprising that they would some existing format; I assumed that the systemd devs would invent their own format.

                                                                3. 4

                                                                  heck, what’s going on with young programmers today? Is there anything wrong with plain text files?

                                                                  1. 10

                                                                    we like data structures without having to write our own ad-hoc parser

                                                                    1. 3

                                                                      Well, does “plain text” include UTF-8?

                                                                      1. 4

                                                                        Yes, it does. But you do not need json to encode utf8 strings.

                                                                        1. 2

                                                                          The JSON spec states that the payload should be in UTF-8.

                                                                          Edit I see what you mean now. Thanks for clarifying and thanks to @tentacloids for pointing it out for me even clearer.

                                                                          1. 3

                                                                            I think this is a misunderstanding: @coco is saying you can use utf8 without involving JSON, not that JSON works with other encodings.

                                                                        2. 1

                                                                          With punycode, yes, yes it does

                                                                          1. 2

                                                                            Why the heck would you want to use punycode for this? Most ascii-centric algorithms, like Linux path parsing, work fine on valid UTF-8. And the underlying storage system is 8-bit clean. As long as you define the encoding, it shouldn’t be a problem.

                                                                            1. 1

                                                                              Yeah, I really like my delicious shrimp sandwich[1] to be rendered as “xn–rksmrgs-5wao1o”.

                                                                              And that adds a dependency to a punycode parser to your simple plain text format.

                                                                              [1] Räksmörgås

                                                                              1. 1

                                                                                It potentially adds a dependency to a punycode parser to your regular pipeline; it can be ignored in cases where you’re not looking for UTF-8 characters in the body of text.

                                                                                1. 1

                                                                                  In the context of a file describing a home directory you certainly do need to accommodate Unicode - unless you want to forever restrict usernames and directories to only ASCII.

                                                                                  I’m not saying JSON is the ideal format, just that alternatives cannot be restricted to ASCII.

                                                                      1. 4

                                                                        My biggest gripe with PASETO is that it uses JSON, which do not guarantee order of keys, which mean that you cannot safely decode and recode token to get the same data.

                                                                        1. 6

                                                                          Out of curiosity, when would you need that? If you receive a PASETO, you either:

                                                                          1. want to validate it and want to get the data out of it;
                                                                          2. pass it along to another service that wants to do point 1.

                                                                          Is there anything I’m missing?


                                                                          What alternative would you suggest? ASN.1/DER, XML, YAML, TOML?

                                                                          1. 1

                                                                            ASN.1 for fields that are “defined” and free form binary for the rest.

                                                                            1. 1

                                                                              ASN.1 is infamously hard to parse. I don’t think anything new and even remotely security oriented uses it, for good reason.

                                                                              I mean, if we’re going old and RFC specified, why not XDR? 😉

                                                                              1. 2

                                                                                Although that’s true, I’ll note that Galois did high-assurance implementations for encoders and decoders of some subset of ASN.1 for industrial use. They’re probably still improving on it.

                                                                                1. 2

                                                                                  ASN.1’s complex and evolving language features, as well as its complex and evolving encoding schemes, together

                                                                                  • hinder adoption
                                                                                  • increase the complexity of tools & compilers,
                                                                                  • and necessitate large and complex encoder/decoder implementations.

                                                                                  None of which bode well for the task of creating robust & secure implementations.

                                                                                  — via Challenges and Possibilities for Safe and Secure ASN.1 Encoders and Decoders

                                                                                  Thank you for the pointer @nickpsecurity! You’re always a fount of knowledge.

                                                                                  Galois do fantastic work. I would love if we all moved to high-assurance and high-performance ASN.1 encoders/decoder made by them.

                                                                                  Until that day.

                                                                                  (I note PASETO is for less skilled people than who work at Galois. And my confirmation bias does notice they targeted a subset of ASN.1 too.)

                                                                                  1. 1

                                                                                    I found a recent submission that I’m saving for when weekend is over and more formal methods people are reading. Good job on digging up the prior work. I’ll message you when I submit other one so you don’t miss it.

                                                                                    Far as “Until that day,” I did say you were right about your warning and that the exception to the rule rigorously implemented a subset. They’re definitely smarter than most of us on verification. If anything, they’re not the upper-bound on usable security given they do more heavyweight methods than what I advocate. I’m fine with proving what I can followed by stuff like Code-Pointer Integrity, Data-Flow Integrity, or even Open/HardenedBSD-style mitigations for the rest. Mix it up for maximum effort-to-reward ratio. :)

                                                                                    1. 2

                                                                                      I’m hoping, next week, to get time & budget to apply TLA+ to our app’s core state machine!

                                                                                      HYPED

                                                                                      1. 1

                                                                                        That’s sounds cool. Is it safe to assume you bought hwayne’s book so you’re doing TLA+ Lobsters Style? ;)

                                                                                        1. 2

                                                                                          Very safe to assume. Much love to @hwayne.

                                                                                2. 1

                                                                                  TBH I have an idea to take ASN.1 and write new RFC with all cruft removed in form of “ASN.2” that would be more or less compatible but at the same time more modern than pure ASN.1.

                                                                                  1. 2

                                                                                    “Lasciate ogne speranza, voi ch’intrate.”

                                                                            2. 4

                                                                              But the tokens are meant to be single-use/short-lived?

                                                                              1. 2

                                                                                It is not even that, what is more important for me is that Decode(Encode(X, Key), Key) == X for any valid X as for me it sometimes can be usable. Not always it is needed, but my friend had use case where it was required (I cannot recall what was the reason).

                                                                                Another thing is that it makes that Encode(X, Key) will always return the same string independently of the implementation. And that can be also useful from time to time.

                                                                                1. 1

                                                                                  Then I believe that PASETO and JWT aren’t technologies for you (or rather, your use case).

                                                                                  1. 3

                                                                                    Alternatively, we can add an explicit key-sorting to the encode step and make that part of the standard. That’d address this corner-case headache (and force everyone to use ordered keys).

                                                                                    1. 1

                                                                                      This makes implementation harder. Personally I would vote to make payload free-form string. If user want to use JSON, then they are responsible for anything, if user want to have canonical representation of data - they are free to go. IMHO that would make whole thing even simpler as it would not care about the payload format at all - it is just binary.

                                                                                      1.  

                                                                                        Then how do you support JWT-compatible claims without JSON?

                                                                                        The target audience of PASETO is “people who would otherwise be using JWT”.

                                                                                        1.  

                                                                                          With PASETO JSON. My idea is to split the RFC into 2 separate parts:

                                                                                          • Describing just signature/encryption format that is data agnostic.
                                                                                          • Describe internal data format that will be signed using above signature format.

                                                                                          So one could use “plain” PASETO for whatever data they want, and if someone would like to replace the JWT then they could use PASETO-JSON which will be almost identical to the current RFC.

                                                                                    2. 1

                                                                                      PASETO would be perfect with simple modification - do not enforce format of the payload at all. Make it only format for signing/encrypting payload and sending it over the wire. The format of the payload would be left up to the user of the library. In that way if someone would like to use JSON, then they would be responsible for key ordering (if needed) and if someone would need that then they could use any format they want.

                                                                                2. 3

                                                                                  Replacing JSON Web Tokens with something that doesn’t use JSON has a weird UX story for developers. If you don’t want JSON, might I recommend Macaroons?

                                                                                  1. 2

                                                                                    We can eat macaroons while rewriting it to use s-expressions.

                                                                                  2. 2

                                                                                    If v3 defined a key ordering and de/coders “must” produce/only-consume well-ordered stuff, would that be good enough? Or should they just switch to CBOR or something?

                                                                                    To me, this is like the make illegal states unrepresentable of data processing: just use a format they literally cannot screw up (in this case, ordering-wise) so you don’t have to even handle it (let it crash, don’t catch a falling knife, &c). Seems like a smart move.

                                                                                    1. 1

                                                                                      My biggest gripe is that their website doesn’t load *any* text with javascript disabled.

                                                                                    1. 2

                                                                                      …is this being referred to as “off topic” because people are being political or just because the tag is wrong? Tags can change, right? An article about a system widely used for software hosting is just as topical as most posts in this community.

                                                                                      1. 4

                                                                                        It’s borderline.

                                                                                        Reasons for marking it as off-topic: it’s a second hand source with clickbait titling, it’s internal business practices at one company, it really isn’t specific to “computing”.

                                                                                        Reasons for it being regarded as on-topic: it’s “consumer info” regarding a service many here might be familiar with, the debate regarding tech worker activism is interesting to many.

                                                                                        Edited I initially flagged it off-topic but removed my flag.

                                                                                        1. 3

                                                                                          And it’s an article on the register, which has many speculative/charged words to say about the actual change, which is documented in this merge request: https://gitlab.com/gitlab-com/www-gitlab-com/commit/b5a35716deb4f63299a23a40510475f5503c11c4

                                                                                          1. 1

                                                                                            Exactly. Submissions from El Reg (as well as venues like TechCrunch) start with an initial negative on-topic score from me :)

                                                                                        2. 1

                                                                                          Almost certainly the former. This is an article about a business practice by a software company - I think definitely within lobsters’ purview - and I think it’s being downvoted by people who expect the discussion about it to be contentious. Which it probably would be, because the thread about this article on hn is 900+ comments long last I checked and made me personally mad. :)

                                                                                          1. 2

                                                                                            I’m in the camp that thinks we need to have very serious talks about ethics in software engineering, but that’s not really what lobste.rs wants to be about and in this case is even just going to be a discussion about Gitlab in particular. So I’m downvoting it for exactly the reason you said. Hellthread comments are welcome on the HN thread.

                                                                                            1. -1

                                                                                              “ethics can certainly be important but i don’t want to see it discussed here because it may disturb me” is both an expression of extreme privilege and a very short-sighted stance.

                                                                                              1. 3

                                                                                                Every time I convince myself that inviting more political discussion on Lobste.rs is a good idea - “it will be fine! Everyone will be civil and there’ll be a frank exchange of views, and we’ll move forward as a group!” - a comment such as yours reminds me there will always be people who twist other’s words and argue in bad faith.

                                                                                                Edit added words

                                                                                                1. 1

                                                                                                  (…) I think it’s being downvoted by people who expect the discussion about it to be contentious. (…)

                                                                                                  I’m in the camp that thinks we need to have very serious talks about ethics in software engineering, but that’s not really what lobste.rs wants to be about and in this case is even just going to be a discussion about Gitlab in particular. So I’m downvoting it for exactly the reason you said.

                                                                                                  1. 2

                                                                                                    Here’s the quote from @gthm again, with my emphasis this time

                                                                                                    I’m in the camp that thinks we need to have very serious talks about ethics in software engineering, but that’s not really what lobste.rs wants to be about […]

                                                                                                    This is what you took from that sentence

                                                                                                    “ethics can certainly be important but i don’t want to see it discussed here because it may disturb me”

                                                                                                    It’s clear from @gthm’s words that they’d like to discuss these questions, but they are currently considered off-topic on Lobste.rs. So instead of passive-aggressively attacking them, you should raise this issue with the community, like here:

                                                                                                    https://lobste.rs/s/s1gzie/adding_politics_related_tag

                                                                                                2. 3

                                                                                                  As @gerikson has already said, what I meant to say was that I think ethics are worthy of discussion, but as I interpret the mood on this site they’re off topic. I’m sorry I didn’t say that precisely enough.

                                                                                          1. 1

                                                                                            zge, your post made me sad. You too, rlonstein.

                                                                                            Twelve people participated in a conversation about 4os in June/July 2012.

                                                                                            (Does anybody know how to post links to old usenet discussions without using Google?)

                                                                                            1. 2

                                                                                              AFAIK the only Usenet repository is hosted by Google.

                                                                                            1. 7

                                                                                              If you draw a straight line from San Francisco to Amsterdam you will cross Iceland. Simple Analytics has most customers from the US and Europe, so it makes sense to pick this geographical location.

                                                                                              Sure the shortest path between two points is a straight line, but that’s not how the cables are laid - the connection through Iceland has to go through Newfoundland and Greenland first - would’ve been better off hosting in Ireland or the UK if they only wanted a more direct connection path.

                                                                                              1. 4

                                                                                                The UK at least is part of the 5 Eyes network the author is concerned about.

                                                                                                FWIW I believe the Silk Road servers were located on Iceland, and the US government got to them anyway.

                                                                                                1. 3

                                                                                                  Additionally, one leak mentioned even more countries in the many eyes collaboration with only a few holdouts. There were 3 IIRC: Switzerland, Iceland, and one I can’t remember. I figure U.S. could more easily pressure Iceland than Switzerland. Hence, Switzerland with no Five Eyes citizens having control of the organization or access to its key assets.

                                                                                                  1.  

                                                                                                    There’s Project Eschalon which is the “5 Eyes,” but also “9 Eyes” and “14 Eyes” …

                                                                                                    The countries belonging to the “5 Eyes Alliance” include:

                                                                                                    • USA
                                                                                                    • Canada
                                                                                                    • UK
                                                                                                    • Australia
                                                                                                    • New Zealand

                                                                                                    The “9 Eyes Alliance” adds:

                                                                                                    • France
                                                                                                    • Norway
                                                                                                    • The Netherlands
                                                                                                    • Denmark

                                                                                                    And the “14 Eyes Alliance” adds:

                                                                                                    • Germany
                                                                                                    • Italy
                                                                                                    • Spain
                                                                                                    • Belgium
                                                                                                    • Sweden
                                                                                                    1.  

                                                                                                      Yeah, that’s what I’m talking about. I couldn’t remember the numbers. It’s on Wikipedia here.

                                                                                              1. 1

                                                                                                aren’t the “python is easy” and “everybody can learn to program in $days!11” cargo-cults the real problem here?

                                                                                                it’s like if a software engineer is doing chemistry or builds a brigde, it has to go wrong, imho, as no one can know enough of both topics to be good enough in them. sure, maybe a quick prototype can be done, but for other things a little cooperation between different scientific disciplines would do wonders. alas, i have the feeling that computer science is kind of looked down upon as “easy” by others :/

                                                                                                1. 3

                                                                                                  aren’t the “python is easy” and “everybody can learn to program in $days!11” cargo-cults the real problem here?

                                                                                                  Honest question: how many grad students do you know?

                                                                                                  The problem isn’t “python is easy”! You need to know some programming to get research done. Universities expect grad students to learn it on their own time. “Learning to program better” conflicts with “actually doing the research your livelihood depends on”. Languages are designed for programmers who know how to program, not grad students desperately trying to figure out how to do their analysis on their own. Universities aren’t going to invest in any infrastructure to help them.

                                                                                                  There are many different systemic problems that make this happen, and you can’t just blame it on “python” or “cargo-cults” and call it a day.

                                                                                                  1. 2

                                                                                                    this wasn’t a rant against other disciplines. it was a rant against no existing cooperation between sciences:

                                                                                                    The problem isn’t “python is easy”! You need to know some programming to get research done. Universities expect grad students to learn it on their own time.

                                                                                                    the right thing to do would be writing down the algorithm and have someone else implement it. as you have written:

                                                                                                    Languages are designed for programmers who know how to program,


                                                                                                    There are many different systemic problems that make this happen, and you can’t just blame it on “python” or “cargo-cults” and call it a day.

                                                                                                    imho it is a cargo cult to make people believe that they can do their own (professional) programming without sufficient training, python is just the one language which is used most for this, because it is perceived as easy to write programs in. contrary to this it has many behaviors which are unintuitive, like the mutability of lists or dicts (just as an example).

                                                                                                    1. 3

                                                                                                      the right thing to do would be writing down the algorithm and have someone else implement it.

                                                                                                      And who would that be? Most grad students make around 20k a year. Universities treat them like fodder. Do you really think university administration is going to hire a 100k+ software engineer just to make a few grad student’s lives better?

                                                                                                      imho it is a cargo cult to make people believe that they can do their own (professional) programming without sufficient training, python is just the one language which is used most for this, because it is perceived as easy to write programs in.

                                                                                                      You don’t understand how research works. Many fields are dependent on programming: if you aren’t able to program, you cannot do research. Before Python, people used C, R, Stata, Excel spreadsheets. It’s not cargo cult, it’s literally “start programming or get fired. What, give you training? We don’t even give you health insurance.”

                                                                                                      It’s a deeply sick system to its core. Blaming researchers for “cargo culting” shows profound ignorance of the field.

                                                                                                      contrary to this it has many behaviors which are unintuitive, like the mutability of lists or dicts (just as an example).

                                                                                                      Which has nothing to do with this bug.

                                                                                                      1. 1

                                                                                                        i think we mean the same thing. i know everything, everywhere, is fsckd. i don’t rant against researchers, i rant against the whole “python is easy” thing because it makes the problem worse: if it is so easy, one can expect it from everyone. which only leads to frustration and bad software.

                                                                                                        Universities treat them like fodder.

                                                                                                        which is shitty.

                                                                                                        Do you really think university administration is going to hire a 100k+ software engineer just to make a few grad student’s lives better?

                                                                                                        no but most universities have computer science, too, so.. maybe some interdisciplinary exchange would help (i know this won’t happen).

                                                                                                  2. 2

                                                                                                    Part of being a researcher is learning the tools of the job. Plenty of grad students pump out crappy software that’s just enough for their thesis’ to pass. If a tool is used more widely, the principles of open source (which scientific publishing relies on) should be sufficient to root out errors. All bugs are shallow, right?

                                                                                                  1. 16

                                                                                                    Am I misunderstanding, or is this quote:

                                                                                                    unless you’re a doctor, or a neuroscience researcher, or a bigot (but I repeat myself).

                                                                                                    saying doctors and neuroscience researchers are bigots? Not commenting on the topic, but just double checking my reading comprehension.

                                                                                                    1. 7

                                                                                                      Trans people want to be able to determine their gender themselves, which contradicts the medical view that it is biologically given. Of course trans people hate doctors, and doctors are confused with how to deal with trans people.

                                                                                                      I consider the medical knowledge quite accurate in describing the things as they are, and i consider the view of transgender people as accurate in describing how they feel.

                                                                                                      1. 13

                                                                                                        I think this is a little bit too simplistic. The problem is really that trans people (in my experience) tend to be afraid that doctors will deny necessary medical treatment (hormone therapy, mostly) and the letters that many governments require to “prove” that someone is “really trans”, and that doctors tend to be dismissive of women and trans people regarding totally unrelated medical problems - especially pain. (Off the to of my head: The Atlantic reported on this.)

                                                                                                        I consider the medical knowledge quite accurate in describing the things as they are, and i consider the view of transgender people as accurate in describing how they feel.

                                                                                                        Whoof. I’d appreciate a clarification on this because I really want to engage with this in a useful way, but it sure does read as “Trans people think they’re X but doctors (and I) know they’re really Y.”

                                                                                                        1. 6

                                                                                                          [Update: I agree that dealing with the medical system is a PITA]

                                                                                                          What else is body dysphoria if not the discrepancy of what you observe yourself to be and what you feel you are?

                                                                                                          I intentionally mirrored the phrasing of both parts to show that they are equally valid, even if they are incompatible to some extent. Science is the tool, our well-being the means.

                                                                                                          1. 1

                                                                                                            Ah, that makes sense, I see. A deft prosaic move I entirely missed. Clearly I need some coffee :)

                                                                                                          2. 2

                                                                                                            Alternatively, why is it suddenly wrong for health care professionals to really evaluate people carefully before prescribing drugs? I really feel like we overprescribe things like anti-depressants and ADHD medication and that should really concern people.

                                                                                                            What is so wrong with simply offering the option of therapy to help someone be okay with their biological gender? They can also offer the option to transition, but both should be equal options. I realize some may equivocate that with “pray the gay away” type therapy for those not wishing to be homosexuals, but what if it’s not?

                                                                                                            Gender dysphoria is treated in radically different ways to other types of dysphoria. We don’t suggest people with Body Integrity Disorder amputate their arms and limbs as the first means of treatment. We don’t accept people with anorexia as being healthy in their view of the world/themselves. Both of these types of dysphoria deals with the metaphysical dissonance from one’s self reflective empirical view of the world to an outside classification based view of the world. Yet for gender dysphoria, why is it okay to offer treatment that helps an individual conform to the outwards portrayal of a given empirical classification?

                                                                                                            1. 11

                                                                                                              Actually, people suffering from ADHD are notoriously under prescribed due to this myth. I went 25 years without medication due to the ADHD medication panic. Do you know how many opportunities passed me by in those 25 years? These “careful evaluations” are mass hysteria nanny state garbage. Doctors and patients do not need an arbitrary set of hurdles set by an uninformed public for with diagnosing and treating individuals. Imagine if you needed to go through physical therapy before getting a cast for your broken arm. The doctor says, all modern research shows that it would actually be better for you to get the cast before physical therapy but some lawmaker decided that was illegal, so you’ll have to go to therapy. Good luck getting someone with ADHD to follow treatment instructions without medication.

                                                                                                              1. 4

                                                                                                                Anorexia and “gender dysphoria” are nothing alike.

                                                                                                                Try living close to two people who have or have had these conditions and you’d appreciate that.

                                                                                                                Both people have received treatment according to modern medical and scientific consensus, and luckily not from the op-ed pages of Quillette.

                                                                                                                1. 3

                                                                                                                  I mean, that’s anecdotal. I have actually had close friends in both of those camps and I think there are similarities, but my experience is also anecdotal (and by definition empirical).

                                                                                                                  Here’s an opinion from a woman who thinks there’s similarities who has anorexia:

                                                                                                                  https://thefederalist.com/2016/06/27/why-is-transgender-an-identity-but-anorexia-a-disorder/

                                                                                                                  I think her views are worth reading, but that’s not hard data. What this post is about is data science. To get hard data, you have to make classifications, and look at what you pull back, and see if there is a close enough R value to have a correlation, and even then you might not have causation. That’s a whole different level of introspection.

                                                                                                                  The trouble is it’s getting increasingly difficult to even do the research. If we can only identify someone by their self-identifcation of gender and not their biological sex because that’s bigoted, we don’t even get accurate data to show, “For thing x, there is no difference between a trans woman and a cis woman” or “For thing y, there is a huge difference between a trans woman and a cis woman.”

                                                                                                                  When people get so angry and just keep throwing up anecdotes and restrictions instead of larger data sets and controls, and research, we’re not going to be able to get real meaningful data. And as scientists and engineers, we should value that hard data, no matter what uncomfortable truths it might reveal.

                                                                                                                  1. 5

                                                                                                                    You’re comparing the current body of suggested treatment against anecdotal evidence, don’t you wonder if that’s not at least a little indicative of the frailty of your argument? For the record, anorexia kills when they embody their desired presentation, being trans does not. Anorexia inherently is incapable of being resolved through allowing them to present themselves the way they desire, because doing so kills them. You can’t meaningfully compare that to someone who can live a happy life after treatment. Furthermore, therapy isn’t going to do diddly for a lot of these issues in the same way that you probably would have a great deal of trouble convincing yourself tomorrow that you’re the opposite gender you are. If it’s surprisingly easy for you, congratulations you may be genderfluid, and that’s cool, but most people aren’t. Most people go through progressive rounds of trying things, seeing if that level of treatment works for them. They try HRT, which works for many. Then they try non-surgical cosmetic modifications. etc, etc.

                                                                                                                    1. 5

                                                                                                                      The Federalist has its own agenda when it comes to transgender issues: https://thefederalist.com/?s=transgender

                                                                                                                      The mystical doctrines of transgenderism exemplify modern self-worship, in which the human replaces the divine dictates of revealed religion as the source of meaning. source

                                                                                                                      It’s not a publication that’s a friend of science.

                                                                                                                      The trouble is it’s getting increasingly difficult to even do the research.

                                                                                                                      Citation most definitely needed. How can a (relatively) broader acceptance in Western society of LGBTQ+ people and issues cause less research to be performed?

                                                                                                            2. 4

                                                                                                              I stumbled over the same sentence, and had to re-read it a few times. I thought it was unnecessary and detracted from the piece, tbh

                                                                                                              1. 8

                                                                                                                A lot of trans people experience a lot of ignorance and discrimination from medical personnel, especially doctors. In my experience this tends to stem from doctors thinking that they know more about people’s own gender and self-image than those people, and using their position as gatekeepers of things like legal gender changes and hormones to force trans people to conform to their often narrow definitions of transgender.

                                                                                                                Obviously not all doctors are bigots, but they do have a… reputation.

                                                                                                                1. 10

                                                                                                                  not all doctors are bigots, but they do have a… reputation.

                                                                                                                  Of all people, I would think that trans women would be the least likely to engage in this kind of callous generalization. Why do you do that?

                                                                                                                  1. 9

                                                                                                                    Safety. The less I interact with new doctors, the less likely I am to have bad things happen to me regarding my prescriptions, etc. Same thing with therapists, and not just for trans people; lots of people, though mostly women, have the experience of having to search for a doctor or therapist who will take them seriously. It’s actually a pretty well documented phenomenon, and there have been several studies showing that marginalized people (women, trans people, people of color, and of course people at the intersections of those identities) are taken less seriously by medicine.

                                                                                                                    1. -1

                                                                                                                      Oh no, it makes sense. The biological model of gender is supported by massive amount of physical evidence which the doctors were educated in and see in their patients everyday. The new ideas of gender identity originated in far-left colleges with basically no hard evidence backing them: just psychological studies (“soft science”) of what trans people believe about themselves and tell them. There’s some neurological studies showing mixed results. Even they suggest their brain works differently while the rest of them is the biological gender.

                                                                                                                      So, it makes sense that most doctors trained on and seeing confirmation of the biological model of gender would reject trans identity claims in favor of biological model. That’s the scientific thing to do until there’s more evidence of the new claims than the old claims. Unlike at some universities, the P.C. folks can’t just shout down and eject the doctors. Not yet anyway.

                                                                                                                      1. 24

                                                                                                                        The new ideas of gender identity originated in far-left colleges

                                                                                                                        New compared to what? I mean, this stuff was considered radical and new in the 1920s (it’s literally what the Nazis used for their book-burnings).

                                                                                                                        As to mechanism - it is definitely not solved and I’m not even aware of any good evidence-based theories.

                                                                                                                        It is, however very well-established:

                                                                                                                        • That gender dysphoria (the distressing belief that your body is Wrong) is real
                                                                                                                        • Strongly correlated with suicide (41% of sufferers attempt it vs 1.6% of general pop - yeah, the study is from a gender studies school, but who else is going to look into it?)

                                                                                                                        It’s less strongly established (but there’s good evidence for):

                                                                                                                        • Suicide risk is markedly reduced among those who can ‘pass’
                                                                                                                        • Surgery makes it much, much easier to pass
                                                                                                                        • Obtaining surgery (or any other treatment) requires you to fit a set of diagnostic criteria. Evaluating these criteria takes 3+ years in many jurisdictions, with no guarantee of success.

                                                                                                                        Many - many - people with a plausible belief that treatment would help them get denied because they don’t meet the precise diagnostic criteria. Getting that news after 3 years of fighting for it is a pretty serious blow.

                                                                                                                        As a result, they are pretty angry, on the whole, at doctors who do not bend over backwards to fit them into the diagnostic criteria, because they believe (correctly, IMO) that the criteria are both too narrow and require excessive investigation (one year being seen as more reasonable than three).

                                                                                                                        1. 8

                                                                                                                          I want to add that queer activism is probably compensating/self-dealing behavior for people with gender dysphoria, and is probably not representative of transgender people in general.

                                                                                                                          Anecdotal: Asperger/Autism, depersonalisation and self-harm also seem quite common for trans people.

                                                                                                                          1. 9

                                                                                                                            Can I ask what you mean by “queer activism?” I mean… yeah, people who have gender dysphoria often want to alleviate that dysphoria, and in our current society that requires being an activist, at least in the small (advocating for yourself with your doctor, not going to stores/working at companies with transmisic policies, etc.)

                                                                                                                            1. 5

                                                                                                                              Some people are really obsessed with queer and identity politics, so much that their entire existence revolves around being trans, non-binary or ally. I call them activists.

                                                                                                                              And then there are people that just used to have a different gender at birth and are now living a life as the gender they wished for.

                                                                                                                              There is a clear line - the second category does not like to be called ‘trans’, they are ‘girls’ or ‘boys’. The non-activist queer person is the one who is just neither a ‘girl’ girl nor a ‘boy’ boy. They defeat the gender binary without defining themselves as queer.

                                                                                                                              1. 8

                                                                                                                                I see what you mean, but I think it’s a little more complicated than that, for a lot of people.

                                                                                                                                I’m a woman, definitively so, and I actually pass as cis most of the time, but I do like people to know that I’m trans sometimes, especially people like nickpsecurity, because it upends their idea of what a trans person is. I also have experiences that some women, mostly cis women but also trans women who were able to block their first puberty and start hormones at the socially appropriate time, don’t have, and identifying as “trans” is a nice way to get into groups with people who share and can understand my experiences.

                                                                                                                                In any case, I’m realizing that this whole thread is pretty far off topic. Thanks for humouring me and clarifying your posts!

                                                                                                                                1. 5

                                                                                                                                  I’ve been reading everything in what little time I had. I’m mostly holding off on replying to this thread until I have some sleep or not at all until I contemplate the highly-insightful replies I got. I should mention…

                                                                                                                                  “but I do like people to know that I’m trans sometimes, especially people like nickpsecurity, because it upends their idea of what a trans person is”

                                                                                                                                  …that I figured you were a trans woman after a few comments. @cadey, too. There’s a difference between how you all speak and write versus most of the thousands of biological women I’ve known. I’m not saying it’s in any way highly accurate. My intuition has almost exclusively been exposed to trans women who are tech geeks on Lobsters: the only place I run into trans people on the regular (that I know of). There’s definitely a difference that some part of my mind saw which captivated me further to read each of your posts. That’s on top of the fact that you were smart, thoughtful people whose comments demanded my attention regardless of source.

                                                                                                                                  That said, the quote is still correct in that I’m learning about you all. How I learn takes exposure and real conversations with people to get through all the biases and cultural BS. The South, maybe the world in general, is too hateful on trans people for me to do that. They react with instant withdrawing or combat likely assuming I’m like the worse folks they encounter. I do appreciate the replies from trans folks on Lobsters who have very much broadened my understanding of things. Also, quite a few have set a hell of an example for how to do this vs others I’ve met. @Irene especially comes to mind as she was one half of what set that in motion in my head.

                                                                                                                                  All I’ll say for now. Too sleepy from work to do much more than this off top of my sleepy head comment. Hope yall have a good night. :)

                                                                                                                                  1. 5

                                                                                                                                    How I learn takes exposure and real conversations with people to get through all the biases and cultural BS. The South, maybe the world in general, is too hateful on trans people for me to do that. They react with instant withdrawing or combat likely assuming I’m like the worse folks they encounter. I do appreciate the replies from trans folks on Lobsters who have very much broadened my understanding of things. Also, quite a few have set a hell of an example for how to do this vs others I’ve met. @Irene especially comes to mind as she was one half of what set that in motion in my head.

                                                                                                                                    Thank you for at least trying to learn and be open minded. As a fellow Southerner (I’m a Tarheel!), I definitely agree that there are some real cultural differences. Being trans pushed me towards overcoming a lot of those, but all we can ever do is be willing to learn.

                                                                                                                                    I’m sorry I judged you too quickly, and I hope we can learn more from each other in the future. I’m also always happy to talk privately about this stuff; especially keeping in mind your comments about cancel culture, it can be easier to learn without an audience.

                                                                                                                            2. 6

                                                                                                                              I see parallels between modern queer activism and Zionism - in that I can understand what motivates it (their lives are plausibly threatened), and I can’t blame its participants for the conclusions they’ve come to (I’ve not had to find out how far I’d go to protect myself), but I’m still deeply upset by what they are doing.

                                                                                                                              1. 16

                                                                                                                                I’m still deeply upset by what they are doing.

                                                                                                                                Like @NoraCodes said: What is the issue here? My queer activism is centered in things like:

                                                                                                                                • I should be able to see my partner in the hospital
                                                                                                                                • Everyone should have access to HIV prevention
                                                                                                                                • People should be called by the names and pronouns they like
                                                                                                                                • You should be able to get hormones, hair treatment, and surgery if it helps you live a fulfilling life
                                                                                                                                • I’d like folks to stop yelling “faggot” at me on the street, and I want to buy groceries without people threatening to kill me for being gay.
                                                                                                                                • It’d be cool if kids didn’t grow up feeling like they were fundamentally unlovable and worthless because they were queer
                                                                                                                                • Let’s… not murder people for their sexuality or gender, ok?
                                                                                                                                • You should be able to use the restroom without being assaulted because you didn’t seem masc or femme enough to be there

                                                                                                                                I hope these aren’t too upsetting for you.

                                                                                                                                1. 2

                                                                                                                                  Sorry, that was hastily written and needlessly inflammatory.

                                                                                                                                  I’m referring specifically to cancel culture, especially the outrage-porn-driven variety, and especially especially where it results in online vigilantism.

                                                                                                                                  One poorly-thought-out tweet gets screenshotted and cross-posted to a bunch of other networks. Within a week, the author is either publicly begging for forgiveness, or unemployed. They can’t use notifications on their phone anymore due to the volume of spam.

                                                                                                                                  Even in the case where this person genuinely held an offensive view, I don’t think that’s a good outcome.

                                                                                                                                  The people who are doing this hold a justified belief that lives are at risk, and hold that any amount of collateral damage is acceptable defending themselves.

                                                                                                                                  1. 3

                                                                                                                                    A particularly egregious example of this is getting speakers no-platformed from university campuses.

                                                                                                                                    Universities are perhaps the only place where I really couldn’t support any form of no-platforming.

                                                                                                                                    They are - literally - a place set aside for sorting bad ideas from good ones.

                                                                                                                                    1. 2

                                                                                                                                      Understood; “cancel culture” is a totally different topic and truly completely irrelevant here. Nobody is being cancelled and nobody has threatened to do that. It is not unique to nor synonymous with queer people, activism, or even progressives.

                                                                                                                                      1. 2

                                                                                                                                        I’d argue it’s a subtype of ‘activism’ (though agree it’s not limited to progressives or queer peeps).

                                                                                                                                        Fair point that it’s a method largely orthogonal to the cause. However, it’s harder to argue that it’s not a popular method in queer activism (popular in part, IMO, because the stakes are high enough that the collateral damage is judged acceptable).

                                                                                                                                        1. 2

                                                                                                                                          Understood; “cancel culture” is a totally different topic and truly completely irrelevant here.

                                                                                                                                          I’ll note there was an entire meta dedicated to me after one of my run-ins with P.C. culture here. One person, with some upvotes, wanted my entire user tree banned. Seeing mob-like behavior, I stopped inviting folks to avoid reputational or other collateral damage for them. The metas always have people voting in large numbers in that direction or similar paths. We mostly downvote or filter, though, since our moderation strategy does it better than what much of that crowd wants.

                                                                                                                                          So, de-platforming is not irrelevant when there’s people actively trying to make it happen. It’s always worth remembering they’re here like they are in many places, esp colleges. I don’t worry about it since I know our admin and mods. I just keep an eye on it while representing the dissenting side who are not present or too worried to speak in as civil way as I can.

                                                                                                                                    2. 11

                                                                                                                                      Why? Like, truly, what about me taking estradiol and changing my name is such a huge problem for you?

                                                                                                                                      1. 2

                                                                                                                                        At least by my book, that’s living, not activism (see also my response to /u/aphyr).

                                                                                                                                        1. 4

                                                                                                                                          I say this gently, but this is the most cis+heterosexual thing I have read all day.

                                                                                                                                          1. 1

                                                                                                                                            Fair point to the ‘living is activism’ crowd.

                                                                                                                                      2. 4

                                                                                                                                        What do you mean by the term “Zionism”? The original quasi-nationalist ideals of Theodor Herzl, or the modern semi-articulated ideology of the modern Israeli right?

                                                                                                                                        1. 3

                                                                                                                                          Specifically, I mean the combination of two ideas popular around the founding time of Israel (and key to the US fundraising which enabled their defense immediately post-foundation):

                                                                                                                                          • That a homeland was the only way to safeguard their lives, and
                                                                                                                                          • That any action is morally defensible when protecting your own life.
                                                                                                                                          1. 1

                                                                                                                                            Are there trans activists advocating (implied) violence in this way?

                                                                                                                                            1. 1

                                                                                                                                              I know several. Thankfully, none of them are any good at violence (presumably the main reason they stick to advocating it).

                                                                                                                                              1. 1

                                                                                                                                                Wow. That’s not part of the LGBTQ+ rhetoric here in Sweden at all.

                                                                                                                                    3. 1

                                                                                                                                      “New compared to what?”

                                                                                                                                      That is unclear looking back on it. I’m not talking about existence of trans people, gender dysphoria (well established), etc. Even Ben Shapiro of all people often cites gender dysphoria (“mental illness” in his words) and suicide risk in his arguments against accepting trans identity. They’re just facts that can be used to argue for or against many things.

                                                                                                                                      Let me try again. I’m talking about the new-ish rule that sex and gender are different. It appears that somewhere from half to a majority of the U.S. believe that your sex is your gender. This was prevalent belief for most of human history. Noting the biological differences was entire reason the gender words/pronouns were invented. These meanings got into lots of systems and institutions people later built.

                                                                                                                                      Then, the newer thing came along starting in universities that I can tell. Their studies and internal debates led them to redefine gender, male, female, etc to mean entirely different things. Those views started spreading to a lot of other places. Then those with those views wanted everyone, esp general public outside these universities and groups, to similarly redefine the existing words to match the newer meaning. Then, many are surprised and/or outraged that those people continued using the words for the popular beliefs they were actually designed for. They’ll have to convince those people the new meanings are true with evidence that outweighs all their experiences supporting that the biological definition is true. If that can happen, it requires different approach than whatever they did to preach to the choir.

                                                                                                                                      The other thing I noticed was an inconsistency. Certain words or symbols, esp that were associated with hate, are forever banned from being reused in new situations. The people that advocated that explained to me that the words had a lot of baggage, established meaning, widespread belief, history, etc that came with them. We can’t separate that from the word anymore. So, we have to come up with new words. Then, some of those same people were telling me that we’re redefining gender to mean something entirely different than what hundreds of millions of men and women think it means and how they’ve used it for over a thousand years. Seems inconsistent, even hopeless. So, I advocated new labels, pronouns, or just modifiers to indicate the difference to increase chance of adoption.

                                                                                                                                      “ because they don’t meet the precise diagnostic criteria”

                                                                                                                                      I haven’t researched much about the surgeries or their rules. I leave others to decide that stuff since I don’t have an informed opinion on it.

                                                                                                                                      1. 23

                                                                                                                                        Then, the newer thing came along starting in universities that I can tell. Their studies and internal debates led them to redefine gender, male, female, etc to mean entirely different things.

                                                                                                                                        This series of posts is a good example of why having classes on gender and sexuality can be helpful. Sex and gender have a complex history, and studying a bit of that history can give you an appreciation for your current cultural perspective. For instance, Navajo has at least four (perhaps five) genders, and pre-colonial gender systems throughout the Americas included cultural scripts & roles for people falling outside what you and I might describe as the male/female binary. Some associate healer or shamanic roles with third-gender persons. Some have specific ceremonies for gender transition. Pre-colonial Hawaiians revered gender-non-conforming people as sacred educators. India has a well-known role called “hijra”, for male or intersex people who dress in feminine clothing, as well as “sādhin”, who wear men’s clothing and short hair.

                                                                                                                                        Indeed, modern queer roles in the US (e.g. “a gay man”, “a transgender woman”, “a non-binary person”), just like normative roles (e.g. “a straight woman”) need to be understood not only as the product of innate identity, but also as a consequence of our culture, which inherited a rigid gender and sexual binary in part from Victorian England. Modern queer roles in the US are controlled by and also subvert that gender system. They’re a product of individual and collective experimentation, friendships, families, bars, media, and yes, liberal (and conservative!) universities, operating in the context of a mainly-heterosexual, mainly binary-gender culture. This is also nothing new: there’s thousands of years of precedent outside the gender and sexual system you’re thinking of as universal and eternal.

                                                                                                                                        There’s a lot of history I’m eliding here, and this comment is already too long–but hopefully this inspires you to read and learn a bit more!

                                                                                                                                        TL;DR: sexuality has never been simple.

                                                                                                                                        1. 2

                                                                                                                                          Preach 🙏

                                                                                                                                        2. 11

                                                                                                                                          Let me try again. I’m talking about the new-ish rule that sex and gender are different.

                                                                                                                                          Again, this is “new-ish” in the sense that it’s a product of anthropologists around the 1920s finding that gender in some societies (that were either newly contacted at that time, or being newly re-studied) didn’t work exactly the same as it did in European society. They wanted to keep sex as an etic category (seen from the outside) while using gender as the emic category (as seen from inside the society). So it’s new if your sense of novelty has a 100 year lag; though I suppose the distinction didn’t make it out of anthropology departments and into the rest of the university until maybe the 60s?

                                                                                                                                          1. 3

                                                                                                                                            Imagine if non-programmers talked about 100 year old discoveries in computer science as “new-ish”.

                                                                                                                                          2. 8

                                                                                                                                            This was prevalent belief for most of human history

                                                                                                                                            It appears that somewhere from half to a majority of the U.S. believe that your sex is your gender

                                                                                                                                            Historically, it’s more-or-less always been true that there’s a minority ‘queer fringe’, who live with varying degrees of acceptance alongside a society which doesn’t really understand them. There’s ~always been a majority belief that your sex is also your social role.

                                                                                                                                            The major conflict in the west (unfolding in public for at least 60+ years) is over access (by that minority) to mainstream society - in particular, access to jobs, housing and healthcare. EG Being openly gay used to get you fired and/or evicted, and the government deliberately suppressed info on AIDS treatment because it was a ‘gay person’ disease.

                                                                                                                                            The mainstream has accepted some of the larger segments of the queer community. However, the smaller populations (inc trans people) weren’t able to really fight effectively and didn’t win many rights/recognition at that time.

                                                                                                                                            Then, the newer thing came along starting in universities that I can tell

                                                                                                                                            That’s where it started getting pushed out into public life. I think it’s pretty unlikely that nobody had come up with this idea before - it’s immediately obvious to (for instance) a gay man that they do not fit the gender role assigned to their sex, because chasing women is so closely tied to that role.

                                                                                                                                            I think it’s more charitably viewed as ‘people on the sidelines got enough access to make themselves heard’.

                                                                                                                                            The other thing I noticed was an inconsistency. Certain words or symbols, esp that were associated with hate, are forever banned from being reused in new situations

                                                                                                                                            Agree it’s yuck and weird. That said, if you’re going to get hung up on ‘their side are inconsistent’, there hasn’t been a movement in history to meet your criteria.

                                                                                                                                            1. 8

                                                                                                                                              This is purely anecdotal, as it’s just my experience on the matter, but what ultimately convinced me to accept the redefinition of gender with respect to sex wasn’t evidence, it was decency. Fundamentally, there’s no particular reason I should take a position on how other people should identify - this goes beyond gender, but that’s a particularly prominent example of the general point. The most effect it has on me is in choosing pronouns, and in my experience most people will be fine with a genuine apology if you make a mistake - even if you make the mistake repeatedly over time, as long as you’re also clearly trying and being respectful.

                                                                                                                                              Obviously, a person’s sex is of practical importance in a lot of situations; medical treatment, shopping habits (does this person need access to tampons/menstrual pads?), etc., but most of those situations don’t involve me and I can’t think of a single one that can’t sensibly accommodate a decoupling of gender and sex.

                                                                                                                                              So ultimately, for me, it didn’t come down to an evidence-based, rational decision along the lines of “Well, I’ve been convinced this is how the world actually works”. Instead it came down to recognizing that “how the world actually works” is an absurd concept in a fundamentally subjective topic, so what I really ought to do is just accept that people work differently from one another. My only vehicle for understanding others has always been to trust their self-description, so what’s the harm in applying that here? I’ve got no special perspective that gives me authority over who is or is not appropriately described with certain words, so the decent thing to do is to back off and let people be who they are. And I’ve also got no reason to believe that such a perspective is even conceivably possible.

                                                                                                                                              1. 2

                                                                                                                                                Coming back to this later, I think I didn’t word it as well as I could’ve - it’s really easy to read this as saying that anyone who disagrees with me is not being decent (and I got a -1 troll vote that I hope was because of that instead of some other mistake I haven’t noticed).

                                                                                                                                                I used the word “decency” because it’s the best reflection of how I think about my own ethics, and that’s tangential as hell so I’m not going to waste more words talking about it here. The point I wanted to make was that my take on the subject turns out to be orthogonal to evidence-based reasoning - not that I think you have to agree with me to be a good person. You can have a different ethical code that doesn’t lead you to the same conclusions, and that code could be entirely sane.

                                                                                                                                          3. 10

                                                                                                                                            I want three things from a doctor: the same exact medical care as anyone else, an estradiol scrip, and a letter to change my gender on my passport. All of these things are pretty reasonable.

                                                                                                                                            We shouldn’t have gender on passports, because if it’s referring to biological sex it’s not useful for identifying people and if it’s not then it’s… still not really useful for identifying people. I mean, there’s a photo on there, right? Failing that, people shouldn’t demand to see other peoples’ identification before calling them what they ask to be called. I go by Nora in a lot of places, but my ID says “Leonora”. Nobody shits themselves over that, but for some reason when I had an ID that said “M” everybody was all in a tizzy.

                                                                                                                                            In any case, it seems pretty reasonable to get such letters so long as they’re needed for people to be respectful.

                                                                                                                                            Estradiol should be informed consent, and usually is these days. WPATH and other professional organizations recommend this, and doctors who don’t do it are not really doing a good job. It’s not even expensive; you take a blood test a couple times to make sure your kidney’s aren’t fucked up and then cheap pills that millions of cis women are on anyway. No real personal or social downsides to that one.

                                                                                                                                            Regular medical care should be provided to me regardless of my transgender status, but isn’t always (see: trans broken arm syndrome), in much the same way it’s not always provided to women in general, or fat people.

                                                                                                                                            The biological model of gender is supported by massive amount of physical evidence which the doctors were educated in and see in their patients everyday. The new ideas of gender identity originated in far-left colleges with basically no hard evidence backing them: just psychological studies (“soft science”) of what trans people believe about themselves and tell them.

                                                                                                                                            I’m curious what you mean here. What is the “biological model of gender”? Do you mean the idea that gender and sex are the same thing? Sure, that’s fine, but we still need a word for “the internal understanding of one’s body and the way it relates to society’s gender roles”. Let’s call it foo. I’m transfoo. Foo isn’t the same as sex. Etc.

                                                                                                                                            To put it another way: what evidence would convince you that gender is “really” different from sex? It’s an inherently mental, personal, subjective thing, because it (to a much greater degree than sex) is socially constructed. (Meaning, it’s basically just an agreement between a bunch of people about how people should act. You’re saying it should be based on your junk, I’m saying it shouldn’t, and that’s the only point on which we disagree on this topic.)

                                                                                                                                            1. 4

                                                                                                                                              You’re saying it should be based on your junk,

                                                                                                                                              Yes a lot of these people are acting like if they as a man woke up one morning in a woman’s body that they would just magically be okay with it, and wouldn’t even be upset. IIRC not being bothered by what gender you present means you’re gender fluid, and congrats to you people for being gender fluid, most people aren’t.

                                                                                                                                              1. 3

                                                                                                                                                This is actually an extremely good point. I mean, come on, have these people never watched anime? :P

                                                                                                                                            2. 2

                                                                                                                                              Exactly. If data scientists want to add a ‘self identified as’ field, they can get a new interesting subset. But they still want the rational physical world for measurements. Could you include people on hormone replacement therapy as a sub-group and look for differences? Absolutely. But it depends on your study and research.

                                                                                                                                              I wish it weren’t hateful to simply say, “Transgenderism is an ideology,” because it is. Some trans people are fine with being distinct: Like M2F who identifies as a man transitioning or transitioned to a women. But some want to be the other sex, anonymously without any biological distinction. They have to BE the other, in all ways legally and metaphysically. This is mostly fine and no one has a problem with it… except when it comes to unfairness where biological differences are present: like sports. It also applies to medication that might have different dosages based on male/female biological factors.

                                                                                                                                              It can get heated because it is an ideology and challenge to that is a challenge to orthodoxy. I don’t know what the solution is, but transgenderism is very similar to Catholic transubstantiation; a believe about the metaphysical nature of reality. We’ve never been in this boat in terms of equality and it will be interesting to see where people push this in the coming years.

                                                                                                                                              1. 16

                                                                                                                                                transgenderism is very similar to Catholic transubstantiation; a believe about the metaphysical nature of reality.

                                                                                                                                                Oh you are on SUCH a good track here. I’d like to take this point a little further. Gender itself is a metaphysical belief. So is sex.

                                                                                                                                                Both sex and gender, as equivalence classes that allow you to categorize all people as one of, say, two types, are broken. They’re fuzzy categories at best, and once you start getting rigorous, you start seeing lots of exceptions. That’s not to say they’re not broadly useful concepts, and they do work for lots of people, but when we’re designing systems that work with sex and gender (for instance, in medicine, or sports!), we should think carefully about what those categories really mean, how they’ll be used, and how they’re going to work for people who don’t fit the boxes neatly.

                                                                                                                                                For instance, say you’re trying to code people as male or female based on the “rational physical world” of measurements. Do you take chromosomes? Sure. 46XY is male, 46XX is female. I guess we could call 45X female and 45Y male too. What are 47XXX, 47XYY, and 47XXY? 49XXXXY? Y generally induces testicular development, so maybe any copy of Y codes as male. But if you’ve got androgen insensitivity syndrome, some “standard male” 46XY people will have breasts and labia. And some of those 46XX folks with CAH might look outwardly like men. Which soccer team to do you force these people to play on? Who gets prompted for testicular screenings and pap smears?

                                                                                                                                                We haven’t even gotten into chimerism yet. You know some people have multiple genotypes, right?

                                                                                                                                                Okay. Let’s back off to genitals. We can measure those, right? If you have testes, you’re male. Unless you’ve had a hysterectomy, or orchiectomy, but you’d know if that happened to you. Well, unless it happened at birth. Turns out that in some cases a doctor guesses, based on some complicated rules and their best judgement, what kind of genitals would be best for you, a newborn infant. Maybe you’re genetically XY, but your penis was small at birth, so they surgically constructed a vagina, removed the testes, slapped an F on the birth certificate, and told your parents you should be raised female. Maybe you never knew about that until getting a gene test in middle age, and then you realized, holy shit, I’ve been male/intersex/trans/etc this whole time. Maybe you’ve got ambiguous genitalia. Maybe you’ve got a vagina, but no uterus, and internal testes instead.

                                                                                                                                                These things aren’t THAT rare. Roughly one in two hundred people don’t have a “standard” male/female body plan. Chances are you personally know someone like this! About one in a thousand people receive “normalizing” surgery. If you’re a primary care physician, you’ve likely got a couple patients who might need you to have a more nuanced understanding of what sex is. Maybe you need to ask your male patients if they’re considering pregnancy.

                                                                                                                                                Fine. Let’s decide based on someone’s body’s secondary sex characteristics. Adam’s apples? Facial hair? Voice? Musculature? Height? Breasts? Pelvic geometry? These are all over the place. Slender, wispy people covered in hair. Barrel-chested, high-voiced musclebears with no Adam’s apples. People who fall smack dab in the middle of your female and male coordinates on whatever measurement system you choose. Some of these characteristics are reshapable with surgery, hormones, and practice. Some change with age. But these secondary characteristics are also how we usually code people as male or female. For example, when was the last time you checked to see if everyone walking into the men’s bathroom had a penis?

                                                                                                                                                And this is just sex! Physical, biological stuff that’s measurable with rulers, blood tests, and CT scans. Gender’s even more spectacular.

                                                                                                                                                1. 3

                                                                                                                                                  Possibly the best write-up of this particular flaw in the idea of “biological sex is binary” I’ve seen in a while. That’s going in my bookmarks for sure. Thanks :)

                                                                                                                                                  1. 2

                                                                                                                                                    For instance, say you’re trying to code people as male or female based on the “rational physical world” of measurements. Do you take chromosomes? Sure. 46XY is male, 46XX is female. I guess we could call 45X female and 45Y male too. What are 47XXX, 47XYY, and 47XXY? 49XXXXY?

                                                                                                                                                    99.9% of all humans have normal chromosome Karyotype. What you describe are outlies of less than 1% .. You make it sound like all these variations are common when they’re really not. And on top of all of that, almost all people with abnormal karyotypes are sterile. Very few of them can reproduce.

                                                                                                                                                    1. 10

                                                                                                                                                      It’s more like 99%, actually. There are almost a hundred million people out there with some kind of intersex condition - probably more intersex people in the world than desktop Linux and Mac OS X users combined :P

                                                                                                                                                      1. 11

                                                                                                                                                        99.9% of all humans have normal chromosome Karyotype. What you describe are outlies of less than 1%

                                                                                                                                                        Sure! XXY is ~1:1000 births. If we were doing research on something with broad interest, like a soda flavor, we might decide that the error we introduce by categorizing those people as male, or female, or removing them from the sample altogether, isn’t significant enough to affect our results, and go on with our lives. It’d be problematic if we needed everyone in a sample of tens of thousands of people to fit exactly one category. Unfortunately, that’s how a lot of our society is built.

                                                                                                                                                        XXY doesn’t shorten life expectancy much. That means in the US you’ve got ~327,000 people with XXY. A suburban high school with a population of 2000 students has a good chance of having at least one XXY person in their prospective student pool, and will need to decide whether those people are allowed admission (for an all-boys school), and what sports teams (if sex-segregated) they play on. A typical Wal-mart will see a handful a day, and expect them to choose the right bathroom. A suburb of 50,000 could (with sufficient motivation) field an all-XXY football team. A decent-sized airport like Miami International will see ~120 passengers every day whose sex indicated on their ID doesn’t match their karyotype. A major metro area could run a Kleinfelter Kickball league.

                                                                                                                                                        Let’s imagine you’re like me: a cis man who hasn’t been karyotyped. Maybe you took a 23andme test, and that came back XY, because they don’t report trisomies. There’s a nontrivial chance that you, who grew up believing you were male, who has always been treated like a man, might not be a “biological male”–at least by a strictly genotypic definition. Of course that’s ridiculous. You know you’re a man, and everyone else does too. You don’t get dirty looks for using the men’s room at work. You can hand over your ID at the bar or airport without fear. Nobody called the school board outraged that you were allowed to play on the men’s basketball team. You never had to worry about these things, and you still don’t. That’d be silly. Nobody’s going to find out unless you tell them, and even then, I’m sure they’d understand. Well, most people would. Except for people who believe that “male” means “XY”, and then, well. That’s a different story.

                                                                                                                                                        That story might involve your marriage being challenged in court–but a neighboring state used anatomy, rather than genetics, to determine sex, so you were able to remarry there and bypass the issue. You may have been asked to use the women’s room at work–only they don’t want you there either, so you wind up having to ask for a special bathroom. The only single-occupancy stall is on another floor, so you take the elevator every time you have to pee, and hope nobody’s using it. You might be stripped of your sports trophies, and banned from competition. You might wind up with a new ID that says F on it. You have to sigh and explain every time you show it, and hope that when you’re pulled over it doesn’t lead to arrest. You haven’t gotten the bank updated yet, and you’re dreading the bureaucratic nightmare that’s sure to follow. Every few weeks, you blunder into a conversation on the internet where someone insists that you aren’t a real man.

                                                                                                                                                        Think about how that might feel.

                                                                                                                                                        Now read your posts again.

                                                                                                                                                        1. 1

                                                                                                                                                          Klinefelter syndrome. XXY is a chromosome disorder in males. People with XXY chromosomes are classified as male, they present and physically are male, and .. they cannot reproduce. There has never been a recorded case of someone with Klinefelter reproducing.

                                                                                                                                                          1. 4

                                                                                                                                                            Okay. I recognize that it’s difficult to go from never having thought critically about sex or gender in your life to Oh Shit All These Things Are Happening??? If it helps, this is a journey we all have to go through. While you’re on it, consider:

                                                                                                                                                            XXY is a chromosome disorder in males. People with XXY chromosomes are classified as male,

                                                                                                                                                            You’ve recognized here that “male” and chromosomes are two different things, and that “male” is a category we, as humans, apply to people. It’s also true that people with XXY are usually classified as male, but that’s not always the case. Some people with XXY look completely masculine. Other people with XXY look physically female, with large breasts, soft skin, no beard, etc. Genotype is not always phenotype, which should be the first clue that “biologically male” is an ill-defined concept.

                                                                                                                                                            they present and physically are male

                                                                                                                                                            Presentation is a complex phenomenon involving body characteristics, movement, speech, dress, grooming, pronouns, location, cultural roles, etc. These things usually go together in patterns we think of as “male” or “female”, but they don’t have to. Most people with XXY present as men, but not all do! As it turns out, I have a friend with XX+XY (though she’s not sure if that’s via trisomy, a more exotic aneuploidy, mosaicism, etc) who presents in basically all respects as a woman. She’s hella cool. It’d be weird to declare her male.

                                                                                                                                                            Being “physically male” is a fuzzy concept for all the reasons I outlined above.

                                                                                                                                                            and .. they cannot reproduce. There has never been a recorded case of someone with Klinefelter reproducing.

                                                                                                                                                            I don’t think this is relevant, and I’m not sure why you’re bringing it up, but, uh… you know this isn’t true, right? People with Klinefelter do reproduce, both unassisted and with the help of technology. Low fertility is a common consequence of XXY, but it doesn’t render every person sterile.

                                                                                                                                            3. 3

                                                                                                                                              That is not the full sentence, though. Since you mention reading comprehension, I would suggest interpretating any alarming sentence fragments not in isolation, but in the context of the full sentence (and the rest of the piece). The full sentence is this:

                                                                                                                                              There’s no test that you give someone to determine they’re “actually” trans, unless you’re a doctor, or a neuroscience researcher, or a bigot (but I repeat myself).

                                                                                                                                              Seeing the full sentence this reads like a syllogism: (people who administer) transness tests are bigoted, doctors & neuroscientists administer transness tests, therefore doctors and neuroscientists are bigots. Still an overgeneralisation, but a far cry from ‘doctors and neuroscientists are bigots’ on its own. So, ya, my guess is that probably you misunderstood the author’s intent?

                                                                                                                                              1. 2

                                                                                                                                                Ohhh, the irony… It would be funny if it wasn’t so pathetically pervasive.

                                                                                                                                                1. 2

                                                                                                                                                  It probably refers to how the medical discipline is policing trans bodies and not even trying to renounce its role as gender gatekeepers.

                                                                                                                                                1. 2

                                                                                                                                                  I hope this doesn’t lead to a mini-flood of “here’s how I optimize wc in my favorite language” posts…

                                                                                                                                                  1. 29

                                                                                                                                                    sound of many wc.rs files closing

                                                                                                                                                    1. 2

                                                                                                                                                      But seriously @BurntSushi’s DFA library would probably make a really nice, simple implementation :)

                                                                                                                                                      1. 3

                                                                                                                                                        For reference, I think you’re referring to https://docs.rs/regex-automata

                                                                                                                                                        You can see the regex I wrote for word segmentation: https://github.com/BurntSushi/bstr/blob/master/scripts/regex/word.sh

                                                                                                                                                        A shell script generates the DFA via ucd-generate: https://github.com/BurntSushi/bstr/blob/083d609e16fe9c850b2e08708c0d2ecb191d44d1/scripts/generate-unicode-data#L47-L56

                                                                                                                                                        It then gets embedded into the binary and is usable as-is with no decoding step: https://github.com/BurntSushi/bstr/blob/master/src/unicode/fsm/word_break_fwd.rs

                                                                                                                                                        There’s almost certainly some optimizations one can perform on typical text that will speed things up dramatically compared to just naively running the DFA as-is. But that isn’t really a problem I’ve deeply investigated to be honest.

                                                                                                                                                  1. 38

                                                                                                                                                    As a trans woman who recently discovered that my photos are being used without my consent to train facial recognition to identify trans women, I heartily suggest that cis and straight engineers read this and then consider whether tracking data points like gender are actually necessary.

                                                                                                                                                    1. 5

                                                                                                                                                      Firstly, that sucks. I think questioning what data points are really necessary is a good idea and may help this and other problems. The people who worked on this are absolute monsters and whoever built this deserves whatever ruin they have coming. I am not a lawyer and this does not constitute legal advice, nor do you necessarily have the interest or ability to fight it. I’m not recommending you spend months or years in court fighting this out. All being said this may be a violation of personality rights, they may have broken the law.

                                                                                                                                                      California, Kentucky, Utah, and Wisconsin; hold both Statute and Common law on the subject. Each of these states had this article linked on wikipedia. https://web.archive.org/web/20161015041919/http://www.vjolt.net/vol6/issue1/v6i1a03-Carpenter.html

                                                                                                                                                      Wisconsin had an additional citation on wikipedia for this. http://rightofpublicity.com/statutes/wisconsin

                                                                                                                                                      Personality rights probably don’t just apply to celebrities, and in some states they appear to specifically apply to non-celebrities.I’m mostly soothing my anger with a power fantasy of justice, but maybe someone will absolutely wreck their trash idea with an “all your money” lawsuit. I’m not a lawyer, and this was for entertainment, a fleeting joy of imagining their trash idea getting absolutely wrecked.

                                                                                                                                                      Sorry you went through that, and I’m sorry the best I can offer is a story.

                                                                                                                                                      1. 10

                                                                                                                                                        I appreciate the links! I’ve looked into a few legal avenues that all seemed extremely dubious and expensive, but perhaps I should look again.

                                                                                                                                                        I think questioning what data points are really necessary is a good idea and may help this and other problems.

                                                                                                                                                        I’ve had a number of good conversations about this, on Lobsters and elsewhere, and my understanding is basically that recording gender is useful mainly for advertising. Sometimes one has to record sex when working with healthcare data, which is a slightly different matter, but I’m basically of the opinion that if a piece of software asks for gender information without a very obvious reason (dating app, etc), it shouldn’t be trusted regardless of what you think about your own gender.

                                                                                                                                                        1. 7

                                                                                                                                                          As a trans person who spent nearly five years working on advertising privacy at Google, I can confirm that advertising is essentially the only factor in favor of having gender fields, not just for Google but for every tech company.

                                                                                                                                                          1. 1

                                                                                                                                                            “and my understanding is basically that recording gender is useful mainly for advertising”

                                                                                                                                                            “but I’m basically of the opinion that if a piece of software asks for gender information without a very obvious reason (dating app, etc), it shouldn’t be trusted regardless of what you think about your own gender.”

                                                                                                                                                            The first quote is why what you want will not happen. Very much the opposite. The second quote is true for reasons similar to the first: the uses originate from human greed and primitive emotions. Any data going into something like that will get abused or just wasted eventually.

                                                                                                                                                            1. 10

                                                                                                                                                              Yes, unfortunately. I’m aware of this, but as my North Carolinian grandma used to say, “That don’t make it right.”

                                                                                                                                                            2. 1

                                                                                                                                                              Interestingly, as a guy that has had girlfriends that have introduced me to a lot of interesting products that aren’t generally considered “guy products” (skincare crap seems to work as well for me as for most humans), I just find it funny that I think some ad networks now have me pegged as a woman.

                                                                                                                                                              Just thought you may find that amusing, that said cerave is worth getting misidentified. One of these days I’m sure I’ll buy some of those rando products they keep trying to pawn off on me. >.<

                                                                                                                                                              1. 1

                                                                                                                                                                Heh, yeah. As somone who tends to block ads whenever possible, I have no idea how they have me down, except as someone who watches a lot of technical talks on YouTube.

                                                                                                                                                                There are always stories about ad networks being too clever for their own good (see: the story of Target identifying someone as pregnant before anyone, including her, knew about it), but they can also be pretty stupid.

                                                                                                                                                                1. 2

                                                                                                                                                                  I block ads a ton too, but if i throw the youtube app on my tv on to watch things I get…. interesting ads. While I’m flattered to get ads for “guy soap, ugh, seriously something that doesn’t need to be gendered is soap even if it smells like unicorn farts”, I also get ads for maybelien (sp?) lipstick.

                                                                                                                                                                  I’d buy the lipstick before the guy soap though, those ads piss me off and make me happy youtube-dl exists. But every time I browse the web without an ad blocker I have to laugh a bit internally at how stupid ML/AI/BIG DATA is. Hell give me ads for stuff like diswasher tablets, thats useful crap I didn’t know existed and I needed.

                                                                                                                                                                  And if I were in your shoes I’d be worried about all this data collection as well, we saw in Germany how stuff like this can get used for rather horrid end results later on by the likes of say IBM. Hell I bet someone could use the fact that I buy moisturizer etc… as a way to keep me in line for being an errant nail not of the traditional macho man ilk.

                                                                                                                                                                  1. 0

                                                                                                                                                                    Absolutely. Look at the current Supreme Court docket; if things come out wrong, you could be fired for not using that man soap!

                                                                                                                                                          2. 8

                                                                                                                                                            As a person working on a system that involves face recognition: well then don’t complain when it doesn’t work. I hear so much talking about “discriminatory” algorithms, when you just need the data to be there, but the groups calling the algorithms “discriminatory” just don’t give it.

                                                                                                                                                            1. 25

                                                                                                                                                              I think perhaps you misunderstand - I specifically object to people developing software that identifies faces as “trans” or “not trans”, not the inclusion of trans people in facial recognition datasets in general, and especially the lack of any way to remove my data from that dataset.

                                                                                                                                                              Edit: Furthermore, this demonstrates a lack of understanding of the power of monopoly. For instance, I could not possibly care less if some jackass writes millimeter wave scanner software that consistently identifies me as a threat because my body doesn’t conform to their ideas of what a body should look like (because I’m either a man with odd chest protrusions or a woman with an oddly shaped crotch.) It starts to matter a hell of a lot when that software decides whether or not I get patted down whenever I fly.

                                                                                                                                                              If your software is going to be used in a situation where people have no choice but to interact with it, and there are consequences for it failing to classify them right, it is your responsibility to make it work right, for everyone, or make it right to them. You don’t get to shift that off onto them.

                                                                                                                                                              1. 9

                                                                                                                                                                About the lack of ability to remove your face from a dataset: yes, that is not acceptable. But in your first comment you said:

                                                                                                                                                                consider whether tracking data points like gender are actually necessary.

                                                                                                                                                                But being able to tell the gender from a photo is surprisingly useful. And queer people don’t like being miscalled about their gender. So it is insanely useful to check if a person is queer to make sure not to miscall them, knowing how important their gender is to them.

                                                                                                                                                                1. 13

                                                                                                                                                                  So it is insanely useful to check if a person is queer to make sure not to miscall them, knowing how important their gender is to them.

                                                                                                                                                                  Maybe just don’t assume gender at all based on someone’s face? This article is about how the act of doing so perpetuates administrative violence. You can’t detect it based on any visible features for some people. If you make any decision about what pronouns to use based on your software, you are going to cause some people distress. You are assigning probability distributions about how safe it might be to assume, but doing so at all is harmful.

                                                                                                                                                                  In some ways I see this as a caste system being dissolved.

                                                                                                                                                                  1. 1

                                                                                                                                                                    In my specific case gender isn’t assumed from a photo, we already know what user says. Here the gender is used for more as a checkup, and filtering queer people would remove a lot of false negatives.

                                                                                                                                                                    1. 9

                                                                                                                                                                      I know English isn’t your first language but the words you’re using sound utterly horrifying. The application you are working on also sounds like it can be used for some very nefarious purposes. It’s probably just a misunderstanding on my part, but if I, as a white straight male, feel chilled by the work you’re describing, imagine what someone not in that position would feel.

                                                                                                                                                                      “This machine can see if I’m queer”. It’s positively Orwellian.

                                                                                                                                                                      1. 10

                                                                                                                                                                        Yeah, my wording could’ve been better. The point is, we need to check the persons gender as part of a security process, and we have the users photo(uploaded with full consent for processing), which can serve as an adittional factor. Knowing that it is difficult to identify queer people’s gender, it is beneficial to filter them out of that check.

                                                                                                                                                                        1. 6

                                                                                                                                                                          Oh this makes total sense! I’m sorry I misunderstood, and thank you for clarifying.

                                                                                                                                                                          I do still think that the idea of this software existing is pretty scary, but I’m glad you’re at least using it for good :)

                                                                                                                                                                          1. 2

                                                                                                                                                                            Thanks for clarifying!

                                                                                                                                                                    2. 10

                                                                                                                                                                      being able to tell the gender from a photo is surprisingly useful

                                                                                                                                                                      I am very interested to hear about your use case, actually. Other than advertising, I really can’t think of any.

                                                                                                                                                                      queer people don’t like being miscalled about their gender

                                                                                                                                                                      Nobody does, really. Call a big dude “miss” in a bar a few times and see how that goes for you.

                                                                                                                                                                      1. 6

                                                                                                                                                                        I am very interested to hear about your use case, actually. Other than advertising, I really can’t think of any.

                                                                                                                                                                        I’m affraid I cannot tell, confidential work stuff. But it definetly isn’t advertising. It would allow us to avoid a lot of manual work asociated with gender misidentification.

                                                                                                                                                                        Nobody does, really. Call a big dude “miss” in a bar a few times and see how that goes for you.

                                                                                                                                                                        Yes, getting miscalled several times is anoying. But while most binary gender people which are suceptable to miscalling, will correct you after the first time and don’t really care about it, trans people often get angry right after the first miscall. I understand that they probably have to deal with this problem more often and that is why they are so annoyed.

                                                                                                                                                                        1. 10

                                                                                                                                                                          Super fair. I guess I just don’t see why it’s necessary to identify people’s gender at all, most of the time, and if you do need to identify what to call them, why not just have a dropdown/box on a form/question in your interview:

                                                                                                                                                                          “How would you like to be addressed? {Ms., Mr., Mx.}?”

                                                                                                                                                                          I just… I hope you recognize that there are so many absolutely terrifying uses of “gender nonconfirming recognition” technology that I feel pretty uncomfortable about it unless there’s a really good reason for it. Imagine a Uganda empowered by automated facial recognition that tags gender nonconforming people (trans people, effeminate gay men, butch women, etc) in photos and submits their names for arrest in accordance with their new death penalty for being gay.

                                                                                                                                                                          1. 7

                                                                                                                                                                            But while most binary gender people which are suceptable to miscalling, will correct you after the first time and don’t really care about it, trans people often get angry right after the first miscall.

                                                                                                                                                                            I don’t think that’s universal. In my (admittedly somewhat limited) experience, transgender people are generally understanding regarding how cis people slip up or don’t know what words to use or use the wrong gender, as long as we try our best and don’t intentionally misgender people.

                                                                                                                                                                            Maybe the transgender people I’ve been around are different from the kind you’ve been around though.

                                                                                                                                                                            1. 9

                                                                                                                                                                              I’m affraid I cannot tell, confidential work stuff. But it definetly isn’t advertising. It would allow us to avoid a lot of manual work asociated with gender misidentification.

                                                                                                                                                                              That really doesn’t inspire a legitimate use case, if it’s confidential.

                                                                                                                                                                              1. 4

                                                                                                                                                                                It is confidential for “trade secret” reasons, not for some secrecy against the public. Images there are uploaded with fully explicit consent for them to be processed and used in training.

                                                                                                                                                                            2. 1

                                                                                                                                                                              queer people don’t like being miscalled about their gender

                                                                                                                                                                              Nobody does, really. Call a big dude “miss” in a bar a few times and see how that goes for you.

                                                                                                                                                                              The previous commenter recognises that it’s important to use inclusive and correct gender/form of address for everyone. So why are you still giving them shit for it?

                                                                                                                                                                              1. 14

                                                                                                                                                                                The idea that queer people are somehow uniquely sensitive about being misgendered is not supported by my experience - and, in fact, is pretty harmful. I tend to go out of my way to be extremely respectful to people, even people who are clearly misgendering me on purpose, so I don’t get labeled as an “angry trans person”/“it’s MA’AM” type of stereotype.

                                                                                                                                                                                In addition, they were using it to support the idea that identifying people as transgender was necessary to not misgender them, which is… odd to say the least. Just include trans women in your female data set. (Or stop using machines to sort people into socially constructed gender categories, but it’s clear that’s not an option, for some undisclosed reason.)

                                                                                                                                                                                1. 2

                                                                                                                                                                                  So why are you still giving them shit for it?

                                                                                                                                                                                  You’re reframing it. The original commenter is actually giving them and everyone else doing that kind of work shit for doing it. Then, the accused responded with justifications for the work. ignaloidas eventually argues that making sure our AI’s properly classify and speak toward trans people is consistent with the rule that humans do. There’s also people doing things such as inclusive hiring that brings in trans people that start with identifying that they’re trans in the first place.

                                                                                                                                                                                  NoraCodes effectively is arguing that humans should recognize trans identity but AI visions systems shouldn’t for ethical reason. It’s her line of argument. ignaloidas is just reacting to it.

                                                                                                                                                                                  1. 11

                                                                                                                                                                                    NoraCodes effectively is arguing that humans should recognize trans identity but AI visions systems shouldn’t for ethical reason.

                                                                                                                                                                                    In much the same way that we shouldn’t build computer vision systems to sort people into other socially constructed categories, yeah. If someone constructs a CV system that sorts people into “white” or “not white” (or “black” or “not black”), that’s going to be hard to make work, because as humans, our understanding of who is white and not white is muddled. No matter how closely you make it mirror one person’s understanding, it’ll never mirror everyone’s, and you need such a large data set you probably can’t even do that.

                                                                                                                                                                                    I guarantee that you’ve met trans people you had no idea were trans. Almost everyone has. Do those people get encoded as cisgender while others don’t? Probably. In that case, what’s the point? If not - if you interview every person in your dataset, for instance - you’re making something that can identify certain characteristics common in trans people better than any one person. If it’s a black-box system like a neural net, you’ll likely never know what it’s telling you it thinks is “trans”, so it’s both scary and not very useful for legit purposes.

                                                                                                                                                                                    The use case ignaloidas is talking about is actually pretty interesting - identity verification, but if the person looks trans don’t harass them about their gender - but it makes me think that maybe we just shouldn’t use gender to identify people.

                                                                                                                                                                          2. 3

                                                                                                                                                                            It sounds like you really should read the article. Your suggestion is explicitly argued against. (Not saying that that’s “right”, but you might present your argument a bit differently given the context?)

                                                                                                                                                                            1. 1

                                                                                                                                                                              The article assumes that even with more data the algorythms will be used in a discriminatory way and I find this such assumption highly misleading and appealing to victimising of queer people.

                                                                                                                                                                        1. 1

                                                                                                                                                                          Suggest folding into https://lobste.rs/s/zirgzc/sudo_flaw_lets_linux_users_run_commands_as

                                                                                                                                                                          (the linked article isn’t responding at this time)

                                                                                                                                                                          1. 1

                                                                                                                                                                            Thank you @gerikson, I’ve merged story xbq2tv in to zirgzc.

                                                                                                                                                                          1. 10

                                                                                                                                                                            Probably because wasm adds incremental benefit that’s only really worth it in special and relatively-unique circumstances, e.g. web-based 3d game engines. Otherwise the incremental benefit doesn’t really outweigh the costs.

                                                                                                                                                                            Web developers are happy with javascript, backend developers are happy with their existing runtimes.

                                                                                                                                                                            1. 3

                                                                                                                                                                              I was thinking about another potentially good fit for WASM, which is not front or back end. Web-based “native”-like apps. Web-based native apps are often RAM-hungry and unresponsive if too heavy on JavaScript. WASM can be a pretty good solution here. Having snappy desktop apps without sacrificing dev productivity nor performance.

                                                                                                                                                                              1. 5

                                                                                                                                                                                If it’s a desktop app, why wouldn’t you just use native code with an existing desktop app platform to directly address those performance issues? What advantage does wasm give you in that case?

                                                                                                                                                                                1. 5

                                                                                                                                                                                  I can see it becoming a decent JVM competitor.

                                                                                                                                                                                  1. 5

                                                                                                                                                                                    What advantage does wasm give you in that case?

                                                                                                                                                                                    It would be a web app, biggest advantage is instant update to latest version for everyone.

                                                                                                                                                                                  2. 4

                                                                                                                                                                                    Presumably cross-platform utility. Like Electron, but faster.

                                                                                                                                                                                    1. 4

                                                                                                                                                                                      The problem with Electron is mostly not the speed of JavaScript, though. It’s mostly the RAM usage of bundling in most of a web browser as runtime for every app. Just switching to WASM doesn’t do anything to solve that part; you also need a lighter cross-platform GUI framework.

                                                                                                                                                                                      1. 3

                                                                                                                                                                                        Thanks for the clarification - I’m not intimately familiar with how Electron works “under the hood”.

                                                                                                                                                                                        1. 1

                                                                                                                                                                                          Would the inefficiency of Atom with larger files (not big in terms of storage space but big enough to make Atom crawl)—not as big of an issue with VS Code, in my experience—be at all helped by using WASM? That seems like it should be a case for needing a faster language, but I’m not sure.

                                                                                                                                                                                      2. 1

                                                                                                                                                                                        From a corporate IT perspective:

                                                                                                                                                                                        With a web app you have a better upgrade story. You don’t have a bunch of different versions floating around in the world that you have to support. When you upgrade the site, everyone gets that site. Similarly, when you need to rollback, you just rollback. Nobody needs to know or care.

                                                                                                                                                                                        edit Well, should have kept reading. Marius said what I said, but more concisely.

                                                                                                                                                                                  1. 20
                                                                                                                                                                                    Updating software

                                                                                                                                                                                    Linux 2000: I’m afraid to update my whole system, because software incompatibilities between packages will most likely break my system, and I’ll be forced to spend time fixing it.

                                                                                                                                                                                    Apple 2019: I’m afraid to update my whole system, because system incompatibilities will render lots of software incompatible, and software will stop working. I’ll be forced to spend time fixing it, but often I won’t be able to do it, because everything is closed source and I wouldn’t be able to do anything even if I wanted to.

                                                                                                                                                                                    edit: I’ve upgraded to macOS Catalina, and suddenly VMware Fusion hangs in some cases. Normally it works OK, but when a daemon which is started by launchctl will try to run the vmrun command, and the VM which it tries to run sits on an external HDD, the vmrun process hangs… so now I have to sit and fix my CI worker setup instead of doing actual development.

                                                                                                                                                                                    1. 5

                                                                                                                                                                                      Linux 2000: I’m afraid to update my whole system, because software incompatibilities between packages will most likely break my system, and I’ll be forced to spend time fixing it.

                                                                                                                                                                                      For Slackware, sure, and I was using Slackware in 2000, but what was the story for Debian?

                                                                                                                                                                                      1. 10

                                                                                                                                                                                        Potato was out and APT was handling dependencies automatically and very reliably.

                                                                                                                                                                                        1. 6

                                                                                                                                                                                          There was a time when it was kinda risky to run testing and not stable. (And people usually like to run testing because it’s more up to date than stable). Years later (2010+ from my knowledge) this changed and you could run testing with only 1-2 easily fixed breakages per year.

                                                                                                                                                                                          1. 1

                                                                                                                                                                                            That matches my experience as well. I’ve used Testing for years now, and the only thing I recall breaking after an upgrade is the NVIDIA drivers.

                                                                                                                                                                                            Unstable, on the other hand, is true to its name, and always seemed to break at the most inconvenient times.

                                                                                                                                                                                          2. 3

                                                                                                                                                                                            Having used Linux at the time (and before), I remember the problem being even more basic. Most distributions had package managers that could install/update/remove individual packages, but not automatic updates with full dependency resolving. Instead, they relied on some installer to do some rpm magic or wacky vendor-specific solutions such as up2date. Debian was early in fixing these issues with APT in 1998. But the competition was trailing quite a bit, in 2000 yum did not exist (only its predecessor as the Yellowdog Updater), urpmi was just new (January 2000), and in Red Hat land.

                                                                                                                                                                                            1. 4

                                                                                                                                                                                              Heh, wasn’t Yellowdog a distribution targetting Apple hardware?

                                                                                                                                                                                            2. 2

                                                                                                                                                                                              Well, better; but not as smooth as Debian today.

                                                                                                                                                                                              1. 2

                                                                                                                                                                                                I don’t know, because in 2002 I could make Slackware installed successfully and couldn’t replicate this feat with Debian. :-p

                                                                                                                                                                                                Of course, the situation has improved slightly since then.

                                                                                                                                                                                            1. 7

                                                                                                                                                                                              Maybe it’s coincidence by virtue of who I associate with, but I have the feeling that Facebook is far less popular among younger generations (Gen-Z and later) than “older” ones (Millennials and upwards). Sadly it’s mostly not for the valid reasons illustrated here, as seen by the popularity of Instagram and Snapchat, but rather that the model a “universal, personal pinboard” isn’t that attractive. What are you going to do after all, if you’re parents are perhaps more active on the site than you are (certainly is so in my case).

                                                                                                                                                                                              1. 5

                                                                                                                                                                                                As an almost 26 year old, Instagram is where most of my Internet socialization happens (as well as iMessage). An Instagram username is usually what you are given before or with a phone number, a lot of group chats happen there as well as general hanging out. Additionally, a lot of organizations and people post events and new work there.

                                                                                                                                                                                                Quitting Facebook now is easy, unless you’re way older. Quitting Instagram and Snapchat as a young adult is more difficult.

                                                                                                                                                                                                1. 4

                                                                                                                                                                                                  I’ve had this feeling for a long time - my child was allowed to get a FB account at 13 and didn’t bother. It’s the reason for FB (the company) to keep buying sites that appeal to the core young demographic (16-25) that’s most attractive to advertisers. The older ones are allowed to wither… but the interpersonal connections are still monitored by FB.com.

                                                                                                                                                                                                  The title should be updated to say “don’t use any social network owned or dependent on Facebook”…

                                                                                                                                                                                                  1. 4

                                                                                                                                                                                                    What I saw in my experiences are that… when your parents join whatever social network you use, it’s time to evacuate.

                                                                                                                                                                                                    1. 3

                                                                                                                                                                                                      Don’t a lot of these points apply to Instagram as well?