Hacker Newsnew | past | comments | ask | show | jobs | submit | more jmvoodoo's commentslogin

Tell me you're vulnerable to SQL injection without telling me you're vulnerable to SQL injection.


I actually know someone at radia and asked them this exact question last year. Apparently the blades are also extremely fragile and couldn't withstand the forces of being mounted on an aircraft. The problem with lighter than air is that the wind farms tend to be in places with, well, a lot of wind. Not ideal places for lighter than air vehicles.

Helicopters just aren't efficient enough, would have the same issues with wind (especially when carrying a giant airfoil), and would damage the blade if they came out even a bit out of formation.

You're right it doesn't make intuitive sense, but the people doing this are pretty damn smart and actually did think of these things!


I really don't think they did, the problems that need to be solved to retrofit existing airframes to carry a lightweight 300' load pale in comparison to what's needed to design a whole new jumbo sized airframe. Especially since once they've designed an airframe that's only good for carrying large low density loads to rough fields, then that will be the only thing it's good for.

A large wide body airliner with a big-ass shell and gravel kit retrofitted is still a large widebody airliner. Just one that happens to have a decent amount of headroom.


> The problem with lighter than air is that the wind farms tend to be in places with, well, a lot of wind.

On the other hand, an airship doubles as a crane, so there would be no need to truck it from the airfield and then crane it into place. You can deliver it directly to the rotor hub.

Countering the wind with computer-controlled thrusters would seem to be the way to go. Also, there is a large tower already there that you could use as a stabilising mast.


I am not an accountant or attorney, so you should do all of your own research. However any discussion or information about RSUs that doesn't mention an 83b election is at best incomplete.


You can't make an 83b election for RSUs. RSAs yes. Option grants for sure. RSU taxation is very straightforward compared to those. They count as W-2 income when they fully vest and turn into shares. There isn't anything to elect as 83b because they don't get any special tax treatment after that vesting date.


> However any discussion or information about RSUs that doesn't mention an 83b election is at best incomplete.

You can't 83b RSUs.


A subtle point that confuses many: 83(b) election only applies to property that has been transferred to you but not vested.


You appear to be confusing RSUs with stock options.


Actually it looks like RSAs. I didn't even apparently know that RSUs were different as I've always received RSAs and thought they were the same thing (and in fact they had been called RSUs, but the structure looks like RSAs as defined here)


I don't know anything about MRI machines, but couldn't they be built with high temperature superconductors and use liquid nitrogen? If anything this feels like a cost issue not a pure technology issue...


> If anything this feels like a cost issue not a pure technology issue...

It IS a technology issue. High-TC superconductors are basically ceramics, meaning that they are brittle. And a good simulation of MRI experience is being inside a trash can that other people hit with baseball bats.

We are only now starting to get high-TC superconductors in the form of tape, but it's not yet ready to replace low-TC superconductors.

BTW, it's also the reason we're hearing about so many new fusion startups trying to utilize it. It _should_ provide an order of magnitude cost decreases compared to liquid-helium. But it's still something that only startups are using.


The largest NMR spectrometer you can buy today uses high-temperature superconductors and classical ones, but it still cools everything down with liquid helium. As far as I understand you can push more current through the high temperature superconductors when you cool them down more.

NMR spectrometers work on essentially the same mechanism as MRIs, just in a very different form factor. It might even work for MRIs without helium because they have a much lower field (~3-6T) compared to the ~28T of the highest field NMR spectrometer.

The high-temperature superconductors are still pretty new for this field, it took a while to figure out manufacturing them on a scale and quality that could be used for these large magnets.


> NMR spectrometers work on essentially the same mechanism as MRIs, just in a very different form factor.

That's a real understatement :)

A typical NMR spectrometer needs to hold a test tube, and an MRI machine kinda has to hold a whole human.


The tape is good enough for fusion reactors but not MRIs?


It's good enough for _startups_ working on fusion reactors, they can tolerate a bit of risk. But not for established companies making safety-critical equipment.

And modern MRI machines are not that expensive either, mass production made them surprisingly affordable. A top-of-the-line machine is around $700k, and mid-range devices are $300-$400k (and now I want one in my backyard...).

So the savings on high-TC supeconductors would not be that impressive overall.


Is 700k the manufacturing cost or a retail price? I thought they were close to 2M on the higher res end.


It's a list price. You'll obviously also need to pay for installation, delivery, and service.

There's apparently even a robust second-hand market for them: https://bimedis.com/search/search-items/magnetic-resonance-i...


People don't go inside a running fusion reactor.


I don't know if this is the only reason, but superconuctors have a critical magnetic field that is also related to temperature (higher temp = lower magnetic field). So even if a material is superconducting at liquid nitrogen temperature, that doesn't mean it can produce a strong enough magnetic field for an MRI at that high a temp.


The simpler thing to do seems to regulate helium use in birthday balloons.. not a hard choice between life saving diagnostics and large numerically shaped balloons..


I have 3 foil party balloons still inflated after 2 months and 3 days. I left them by the window as heat from the sun provides kinetic energy to the helium atoms to improve the balloons longevity. These three balloons have provided me with enough joy to keep me inside staring at them all day not outside at risk of injury which ultimately leads to an unnecessary MRI.


When those balloons finally fail, sounds like it’s just a matter of time before you end up in the noisy donut once again.


Everything we know is matter and time. No one is immune.


No kidding, tell me about it. My personal odometer is ticking over right now.


Haha, You got this survivor.


My father turned 80 and they kept his mylar balloon around in the living room for at least 18 months. It's one of the few things that survived the cat.


I love this story. There is something about a helium balloon that is awe inspiring to observe. For helium atoms even the sky is not a limit.


> heat from the sun provides kinetic energy to the helium atoms to improve the balloons longevity

How does that work?


Gas pressure is the atoms/molecules bouncing off something else. If the atoms have more energy, then they impart more energy into whatever they bounce off (inside of the balloon), which essentially means higher pressure i.e. the balloon appears inflated again. Until the sun goes away and the OP's party dies for a time. :)


How does that increase longevity, thought? Seems like it just inflates the balloon more?


idk if not going out for 2 months and 3 days puts you closer or further from the need of an MRI ...


Touché, however i’m joking to illustrate a moot point for no reason at all. I am just pro floaty balloons.


Party balloons are normally filled with what’s known as “balloon gas”. It’s a mix of air and helium that’s not suitable for use in medical equipment.


Balloon gas is 97% helium, so from a helium consumption standpoint it's about the same either way:

https://www.boc.com.au/shop/en/au/balloon-gas


I had to do some digging to find more about this.

> "Balloon Grade" Helium represents a slightly impure Helium. While there is no scientific definition of this quality, it is often accepted that the purity of "Balloon Grade" Helium is around 99%

https://www.quantum-technology.com/recover/balloon-grade-hel...

Sounds high, but not pure enough for MRI applications, and it isn't currently economical to reliquefy without shipping it to a processor.

> Manufacturers have stated that this wasted helium is considered a ‘recycled product’ as it would have been lost to the environment had it not been captured and re-purposed. If the balloon market demand declined, manufacturers would have to re-evaluate other markets and consider the possibilities of re-liquefying it. Re-liquefying is currently considered uneconomical from the locations of where the filling application take place.

https://www.partysafe.eu/balloon-and-gas-helium

Also it's small, but not insignificant, sector of the market:

> "A reasonable estimate is that latex 'party' balloons and their foil equivalent account for between 5% and 7% of the total helium usage."

https://www.theguardian.com/science/shortcuts/2012/dec/11/sh...


Why? I like party baloons. My MRI, not so much.


why don't you fund the life-saving diagnostics enough that they can outbid birthday party planners? i'm not convinced birthday party planners are rich enough anywhere in the world that this is an actual problem


[flagged]


In fact, helium is such a mundane resource the US has been getting rid of its national helium reserves[1].

And before anyone says "god damn conservatives", this has been going on across the aisle and is ongoing as we speak. Getting rid of helium is a truly bipartisan agenda.

All of this to say: The claims of helium's value have been greatly exaggerated.

[1]: https://en.wikipedia.org/wiki/National_Helium_Reserve


We all thought it was a bad idea, shutting down the Helium Reserve.


Who's we?


Us chemists and physicists - helium is a nonrenewable resource, and the sudden supply shock encouraged wasteful behaviour.


But one we have a lot of access to lol

> Fortunately for us, helium also gets into the natural gas that oil and gas drillers extract from the ground for use as fuel [source: University of Pittsburgh]. That gives us a supply that we can use for blowing up balloons, as well as for a wide variety of other industrial processes, ranging from arc welding to MRIs to manufacturing silicon chips for computers. There has to be a certain amount of helium in the natural gas — at least 0.3 percent by volume – to justify all the trouble of separating it from natural gas.

https://science.howstuffworks.com/question12.htm


Those chemists and physicists who don't know most He is just dumped without any care in CH4 production.


That's pretty much the entire point of many publications. You think readers of Financial Times aren't reading FT in the hopes of getting their own material gain? What about Wall St analysts? Consuming something for gain is not copyright infringement, distributing it for gain is.


The people who read the FT usually pay for it. Most of these LLMs are trained on a set of pirated content that they didn't pay for - https://shkspr.mobi/blog/2023/07/fruit-of-the-poisonous-llam...

Most copyrighted works will specifically say that the customer / user is prohibited from storing and reproducing those works.


Yet fair use can trump the owner's prohibitions. Your ISP can cache copyrighted materials, storing and reproducing them for other customers. Your browser stores the copyrighted images in your cache and 'reproduces' them if you browse the same page again.

It's a complicated area, not clear cut at all


I started a company that dealt with a lot of tree like data. It is possible to transform your tree structure into an indented list in O(n) time. This used to be one of our interview questions at the time. There are a number of ways to store your data in various SQL databases that allow you to quickly get and render segments of the tree as well without recursive queries.

Once you understand those concepts, then storing your data correctly as trees has a ton of benefits over indenting like this.


If you don't need those benefits it doesn't really matter.


What people are saying in this comment section is that you're probably going to need it. You might not need it now, but the PM of today is a short-sighted person and the future always gets here.


Sure, but if your current solution is 20 lines of code it's trivial to refactor it later if you need it.

Of course the average dev won't do that, they'll just add a hacky workaround as they always do and end up with a buggy horrible mess but thats irrelevant. They'll do that anyway if they're that type of dev.

And honestly I despise this "managers are short sighted" excuse. We're the developers, we do the work. If I open a repo and see a horrible buggy mess with your name on it I'm judging you, I don't give a crap who your manager was.


I owned a Dodge ram diesel model that had one of these engines. It had urea injection, and I had to maintain the 2nd tank.


> I had to maintain the 2nd tank

"Hold up, I need to get a large soda--the urea tank is getting low."


Tearing down fences without pausing long enough to at least figure out why they are there is how you get gatekeepers to begin with.

Its entirely possible that the fence was put there for an extremely valid reason, or that you must mitigate a separate issue before removing it. This assessment can be completed using a first principles approach, and the fence can be removed afterwards. Removing the fence then learning why it was there can be a painful experience for you and those around you.


The build steps are provided as a GitHub action in the repo. You can audit the build pretty easily, or if you're super paranoid you can build it yourself by following the build steps.


Even if the app is trustworthy, it still adds an attack vector to your system. It could have a bug, or the certificate could be exploited by another program.


Equally true of every ad


This would be a reasonable argument if there weren't many alternative ad blocking methods that don't require MITMing your TLS traffic.


It's in no way worse than running a single browser extension with overly broad privileges. If this method of adblocking gains more traction (quite possible, as Google keeps moving to damage in-browser ad blockers), I expect the implementation to receive a lot more scrutiny.

I think we have to face the reality that web browsers might no longer be considered "user" agents.


> I think we have to face the reality that web browsers might no longer be considered "user" agents.

I think too many techies are, much like yourself, contributing to the problem by refusing to move away from Chrome for "reasons"[1], and then compounding it by refusing to acknowledge that "web browsers" != "Google Chrome".

[1] The "reasons" are of dubious quality. Myself and many others are able to do all normal web-browsing from firefox or firefox forks with no functional or performance degradation.


> I think too many techies are, much like yourself, contributing to the problem by refusing to move away from Chrome [...]

Contrary to your assumptions, I've been quite vocal against the Chrome/Blink monoculture for a while. Unfortunately there is a legit case for it; several generations of "low-end" devices (anything older than 10 years basically), that are still quite capable and in common use, where the difference in performance between Firefox and Chromium becomes quite noticeable, especially as you try to watch video.

I don't think the problem is "techies", we have zero influence outside our own circles - see the historical rates of Linux adoption. The problem is we need the good ol' hammer of antitrust to start swinging again. We also need the regulators to be smart; if we get really unlucky, they will target iOS Safari instead. (This would be good in a healthy ecosystem, but would only serve to further entrench Google's position in the current situation.)

By the way, using a filtering/rewriting proxy has other merits, especially on said older hardware; you can rewrite the entire web page to make it more lightweight and accessible. Check out miniwebproxy[1] and medium-rare[2]. It's also quite simple to write one; you need maybe a hundred lines of Go to start getting results. I've been experimenting with integrating Readability[3][4]; and I think there's more potential to this approach.

[1]: https://humungus.tedunangst.com/r/miniwebproxy

[2]: https://humungus.tedunangst.com/r/medium-rare

[3]: https://github.com/go-shiori/go-readability

[4]: https://github.com/mozilla/readability


> Contrary to your assumptions, I've been quite vocal against the Chrome/Blink monoculture for a while.

I apologise for my incorrect assumptions. What browser are you reading this on, right now?


elinks


> I think we have to face the reality that web browsers might no longer be considered "user" agents.

If by "web browsers" you mean specifically Chrome, yes. Firefox, Brave, and others are all committed to supporting MV2, and will continue to serve my interests as a user for the foreseeable future.


>I think we have to face the reality that web browsers might no longer be considered "user" agents.

Well obviously, if you keep insisting on using a browser made by Google, an ad company.


I think it is a mistake for programs that have SSL traffic to not have an option for a user-defined non-secure proxy (usually this would be for a proxy running on the local computer, rather than a remote proxy). A non-secure proxy would save energy (since then it doesn't need to decrypt and encrypt it twice) as well as allowing use of newer (or older) cipher methods in programs that do not support them.


How do you know that the downloaded binaries are built by the GitHub action? If I must audit the code and build it myself every release, then how is this a usable product?


Not a product. It's literally free, free as in free speech, and free as in you're free not to use it.

Building the code yourself for every update is also a solved problem on every system with a feature complete package manager, including Windows. Trust is not so easily solvable, but if you trust nobody, you can choose to look at ads.


> Not a product. It's literally free, free as in free speech, and free as in you're free not to use it.

Sorry, I change my question to "how is this a usable free?"


Same as everything you use on your computer... If it's not open source it's already game over. If it is, congratulations feel free to inspect all the code yourself and build from source OR trust the project maintainers and use pre built binaries.

Applies to this program no different than your Linux distro.

Of course there could be other tools that can help verify things such as checksums on reproducible builds.

If none of that is "usable" enough for you, feel free to set up your own tooling and automation


> Same as everything you use on your computer

Thank you. That's my point. There is no point in stating that some open source code is somewhat safer because "it can be audited". No. As you said, it's the same as everything I use on my computer. Unless we can establish a consistent safety level for certain type of projects, we can't claim an arbitrary category of software is somehow better.


Where is the bar for software you trust? do you trust your OS, router firmware, VPN client, web browser, etc?


In fact, that's what I'm trying to say. The line we draw at "hey we can at least audit open source" is a fully imaginary one. It's a false comfort we create. It's the Kool-Aid we drink.

I don't have any trust in any of those components you mentioned, but I came to terms with the risks associated with using them as part of my threat model. However, I find the notion that open source is somewhat safer because "we can audit it" exaggerating if not misleading. It's not a valid argument, and it should never be used because there's no way to do it in an either practical or consistent way for the users of the said product.


There's a difference between "you/I can audit it" and "we (collectively) can audit it".

You're not living in a vacuum. The more users (and perhaps more importantly, contributors) an open source product has, the less likely it has intentional backdoors built into it.


What's your process to validate if that said software has been collectively audited sufficiently?


Yes that's fair, however that's how our complex world works. E.g. we rely on journalism (the real kind) to uncover all kind of scummy behavior. Similar in the OSS world.

There is no way to easily verify that unless some trusted bodies do this for us and publish their work specifically for what you're using.

Now you just have been stating a problem and no solution.

I do agree with you though that "hey it's OSS and easy to verify because we have the code" is indeed lying to ourselves and especially tools with privileges like this (MITM your encrypted traffic) should not be taken that lightly and have the proper warnings, disclaimer and attention (to watch for bad behavior)


> You can audit the build pretty easily,

Please define "easily"


Now you're being sued for defamation though.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: