Stack Exchange
log in

Charles Duffy

 Discussion on question by Steve: Why …

Imported from a comment discussion on langdev.stackexchange.co...
Charles Duffy
Dec 19, 2024 12:12
I'm pretty sure I've seen something fitting the rough description built on XQuery, if you're willing to allow that much deviation from SQL (into general-purpose "query language" space).
 

 Discussion on answer by Joe Strazzere…

Imported from a comment discussion on workplace.stackexchange....
Charles Duffy
Apr 28, 2024 12:55
@blankip, ...note that you've got blinders created by very local norms. I'm writing this from a high-rise condominium in downtown Chicago, and private vehicle ownership for people who live in the city proper (and have single-location-centered or WFH jobs) is more like boat ownership -- a luxury someone might want to undertake as a hobby/lifestyle expense, but certainly not a baseline expectation of any reasonable type.
 

 Discussion on answer by Therac: What'…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Feb 4, 2024 07:34
@Kyralessa, why are you focused on profit in responding to an answer that's talking much more about revenue and net income? (And those are most certainly factors with which executive pay tends to scale -- as a rough proxy for the difficulty of the job, how much there is to loose if it's done poorly, and of course the resources available for hiring).
 

 Discussion on answer by Justin Cave: …

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Jan 27, 2024 00:22
@barbecue, paralytics are generally/historically used in US executions. It tends to give ammo to people trying to make the death penalty illegal when prisoners being executed thrash around in a way that suggests pain; folks in the business of running executions generally don't want that to happen.
 

 Discussion on answer by Dale M: Can a…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Nov 22, 2023 13:46
If first-year econ theory held, rental properties would have 100% occupancy because the landlords holding them would reduce the price until a tenant was found. This does not happen in practice; see f/e sfbos.org/sites/default/files/…
 

 Discussion on answer by ohwilleke: Ca…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Sep 8, 2023 22:42
@RonnieRoyston, ...I'm sure you know all this already, but the point of bond is to make sure someone shows up. Increasing it (to an amount that will motivate and enable a bondsman to put substantial resources into a search should a party later jump bond entirely) in presence of a demonstrated risk of not showing up is a pretty clear cause-and-effect. Remember, there's also the option of revoking a flight risk's bond entirely; the fact that you were offered a newer, higher bond is better than not being offered one at all.
 

 Discussion on question by Criggie: Ba…

Imported from a comment discussion on unix.stackexchange.com/q...
Charles Duffy
Aug 15, 2023 10:50
I'm surprised nobody has yet linked to BashFAQ #50, which is directly on-point; the reasons people can't store arbitrary commands as strings are the same as the reasons quotes that are data (like ones that come from a variable) and quotes that are syntax (typed into your source code) can't substitute for each other, which is the heart of your problem here. You want that distinction to exist; it would be impossible to write secure code handling untrusted data in bash otherwise.
 

 Discussion on answer by Dale M: Is it…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Aug 1, 2023 21:41
@MichaelHall, what would copyright protection over the damage mean in practice? Reports to your insurance company / the police / etc would certainly be fair use; I don't see how it's an absurd or harmful result if copyright does attach, unless someone actually profits off that copyright, and many jurisdictions have other non-copyright-related means to recoup or address profits related to criminal actions.
 

 Discussion on answer by Flater: Is Pa…

Imported from a comment discussion on softwareengineering.stac...
Charles Duffy
Jul 12, 2023 12:19
@JimmyJames, I fully agree. The intent was to convey that sha256 (as the example RonJohn chose) is unsuited-to-purpose, not to imply that it could be made otherwise. (Indeed, while I spoke to now-very-old attack models, I also explicitly indicated that newer attacks exist, and newer-and-different hashes are needed to protect against them)
Charles Duffy
Jul 12, 2023 12:19
(to be clear, I agree that the "password hashing is bad" claim is ridiculous; I should be taken as pushing back only on the claim that standard OS-vendor-provided hashing functions are generally suited-to-purpose).
Charles Duffy
Jul 12, 2023 12:19
@RonJohn, ...and that's only addressing a class of attacks that have been around a long time, ignoring things like the side-channel attacks that Argon2i is built to be resistant against.
Charles Duffy
Jul 12, 2023 12:19
@RonJohn, a hash function doesn't need to be broken at all if the attack model is rainbow tables. Someone doesn't need to reverse a hash if they can afford the storage to build a huge reverse lookup table of historically-cracked passwords to their hashes, and if you just are using sha256 (to pick on your prior example) without appropriate salting/peppering/etc, that reverse lookup can even be relatively cheap.
Charles Duffy
Jul 12, 2023 12:19
@RonJohn, yes, and the standard OS-shipped libraries are pretty much always far behind state-of-the-art, so you get a mismash of folks using what their vendor provides and folks doing it various levels of right.
 

 Discussion on answer by Italian Philo…

Imported from a comment discussion on politics.stackexchange.c...
Charles Duffy
Feb 28, 2023 08:58
@Amon, we'd know if those results would be different only if they actually asked the other question. Right now there's a confounding factor in the poll (what percentage of people recognize the slogan?), and you're arguing that it's minimal on... basically no evidence that I've yet seen. And it's certainly reasonable to expect Black folks to be more practiced at recognizing signs of White supremacists than an average White person is; for a White person, that's not a survival skill.
 

 Discussion on answer by Sam Kitsune: …

Imported from a comment discussion on worldbuilding.stackexcha...
Charles Duffy
Feb 15, 2023 17:50
@JustinThymetheSecond, only if you're treating the movie rather than the novel that preceded it as canon.
 

 Discussion on question by Tomasz: is …

Imported from a comment discussion on unix.stackexchange.com/q...
Charles Duffy
Oct 8, 2022 10:52
granted, my last decade or so has involved needing to focus on APT-style threats; I won't claim that that style of threat model (where the attacker's goal typically involves leveraging what access they have until they can perform a supply chain attack, or exfil data, or impersonate accounting, etc etc; and where an attacker has enough expected value from a successful attack to justify spending money on R&D or vuln-broker expenses, etc) doesn't color my thinking.
Charles Duffy
Oct 8, 2022 10:52
"with enough isolation" -- if you assume your kernel doesn't have local privilege escalation bugs, but that's a foolish thing to assume. Local privilege escalation bugs are a dime a dozen.
 

 Discussion on answer by Kevin: Is a s…

Imported from a comment discussion on security.stackexchange.c...
Charles Duffy
Jul 25, 2022 19:03
@ThisGuyCantEven, ...that is to say, "repeat character ${a} ${n} times, followed by character ${b}" only has as much entropy as ${a}, ${n}, and ${b}. Kerckhoffs's principle, &c.
Charles Duffy
Jul 25, 2022 19:03
...maybe it already has been; that's not a subset of the industry I keep up on, and GPU-based hash checkers means that they can go through guesses very quickly, so keeping the GPU fed with guessed values to hash becomes a significant bottleneck (again, for real-world serious attackers as opposed to student toy projects).
Charles Duffy
Jul 25, 2022 19:03
@ThisGuyCantEven, I was speaking only to Nelson talking about complexity checkers being useless. That said, a lot of work has been put into coming up with better dictionary attacks; nobody does the silly "try every possible 1-character combo, then every possible 2-character combo, etc" approach anymore; instead, they try to intelligently figure out likely passwords to maximize the percentage of hits. If any significant number of people followed the pattern you're doing with fff...f9, then that would be incorporated into hash-cracking tools.
Charles Duffy
Jul 25, 2022 19:03
@Nelson, ...this is not a new technique, and it's been used by real-world attackers for a very long time; if you read The Cuckoo's Egg, you'll see that password files (containing one-way hashes instead of actual passwords) were getting stolen and reversed, and used to break into other systems where the same users reused their passwords, back in the 1980s. If you don't reuse your passwords, don't record them anywhere, and don't use a pattern that's easy to figure out after someone has seen one of your passwords, either you have a very unusually impressive memory or you have very few accounts.
Charles Duffy
Jul 25, 2022 19:03
@Nelson, eh? What you're forgetting is that the hash database can be stolen and cracked at the attacker's leisure. Someone doesn't need to have the piece of paper you wrote your password on to run a piece of software to try to come up with passwords that hash to entries in the database they stole; but how effective that software will be depends on the amount of complexity in that password. And if you use the same password several places, someone who breaks your password from one stolen database can try that same password with your email address everywhere else.
 

 Discussion on question by Daniel Gold…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Feb 26, 2022 19:22
As an aside, using the word "freeware" to refer to code licensed under an OSD-compatible license is liable to get some peoples' backs up. "Freeware" traditionally is a completely separate category from open source, referring to software that is distributed in binary form free of charge, but without granting the user the ability to see or modify the source code.
 

 Discussion on question by Sam: What a…

Imported from a comment discussion on bicycles.stackexchange.c...
Charles Duffy
Nov 29, 2021 13:28
The answer by Nathan is already in line with the point I'm trying to make; any new one I added would be 90% duplicate (and thus unnecessary), except with the addition of some folding bike photos to show a bicycle with 16" wheels matching the geometry of a larger-wheeled one.
Charles Duffy
Nov 29, 2021 13:28
...however, to elaborate briefly: One can build a bike with smaller wheels with the exact same rider positioning as a bike with larger wheels, so the question's premise (that different wheel sizes must force changes in rider positioning) is inherently false. For a company that makes bikes doing exactly this, see bikefriday.com
Charles Duffy
Nov 29, 2021 13:28
Do you realize that bikes with 16" wheels are frequently built with geometries (for handlebars/pedal/seat positioning) matched to bicycles with 26" or 29" wheels? (This is a service that Bike Friday offers for their custom-frame foldable bikes). Wheel size is not destiny.
 

 Discussion on answer by David Siegel:…

Imported from a comment discussion on law.stackexchange.com/qu...
Charles Duffy
Nov 23, 2021 21:35
...I've also had a place where the founder of company-A bought company-A's IP out of bankruptcy, and then used that IP to found company-B. That one was... a bit shady.
Charles Duffy
Nov 23, 2021 21:35
@RenegadeAndy, ...that folded company didn't owe debts? That's astonishing. (It's common for copyrights to be handed to a bank or other creditor, so they can try to resell them and recoup some subset of their investment; once my employer-at-the-time considered buying the IP of a competitor out of bankrupty, and the bank that owed it lent us that company's literal version control server to set up in our office to evaluate the software and decide if we wanted to purchase it -- we didn't; we were a Java-on-Linux shop; their code was Windows-specific C#; would have been more trouble than value).
 

 Lightning strokes - Germany

Charles Duffy
Nov 21, 2021 16:25
nod. If you'll excuse me, I'm going to go about my day; been good chatting, and I hope the project goes well for you.
Charles Duffy
Nov 21, 2021 16:23
(also, "earlier in my career" memory sizes were much smaller than they are today; things do change over time)
Charles Duffy
Nov 21, 2021 16:22
so by all means do go your own route
Charles Duffy
Nov 21, 2021 16:22
part of being a student is having a chance to learn your own lessons :)
Charles Duffy
Nov 21, 2021 16:22
that said
Charles Duffy
Nov 21, 2021 16:21
While I haven't done GIS work specifically, there have been plenty of occasions earlier in my career when I wrote what I thought was reasonably-efficient in-memory code for working with a large dataset, and had its performance improved by moving to an indexed database backend.
Charles Duffy
Nov 21, 2021 16:20
a real database engine is built to work with datasets larger than available memory, and has a lot of optimizations (when correctly configured; as with pretty much any other datastore one can need to explicitly create indices) to be able to do indexed lookups quickly.
Charles Duffy
Nov 21, 2021 16:19
To be clear -- I suggested PostGIS earlier when you were talking about actual borders in large part because there's been a ton of work over the years in efficient indexing
Charles Duffy
Nov 21, 2021 16:18
"overlay a map with points from this dataset" is a pretty common feature for widget sets / graphing toolkits / etc to provide out-of-the-box, so that shouldn't be something you even need to write your own code for.
Charles Duffy
Nov 21, 2021 16:16
also, once you've filtered your dataset you can look at the remaining points and decide if there's an easy way to exclude more of them -- f/e, adding some boxes that specify regions that are definitely in neighboring countries.
Charles Duffy
Nov 21, 2021 16:14
if you choose your projection right
Charles Duffy
Nov 21, 2021 16:13
There's no conversion needed -- lat and lon are X and Y.
Charles Duffy
Nov 21, 2021 16:13
all you need to do is select the map's projection so its X and Y axis are aligned with latitude and longitude properly.
Charles Duffy
Nov 21, 2021 16:12
Well, I'd start with a map. Once you've drawn some actual rectangles on an actual map, you can look up the latitude and longitude of them and plug those into your program.
Charles Duffy
Nov 21, 2021 16:11
a much more tractable number.
Charles Duffy
Nov 21, 2021 16:11
that should be a small number of points
Charles Duffy
Nov 21, 2021 16:11
so the only thing where you need a more precise GIS lookup are strikes that are inside the outer rectangle, but not inside any of the inner rectangles.
Charles Duffy
Nov 21, 2021 16:10
Then, you make a few squares inside Germany, drawn to cover as much space as they can and to contain nothing outside Germany. If something is outside those squares, you don't know what they are. If they're inside the squares, you know with certainty that the datapoint is inside Germany.
Charles Duffy
Nov 21, 2021 16:09
so first, you make one big rectangle that includes everything that is in Germany (and also some areas that are not). If something is outside that square, you discard it. If something is inside that square, you need to investigate further.
Charles Duffy
Nov 21, 2021 16:08
(s/square/rectangle/)
Charles Duffy
Nov 21, 2021 16:08
Is it above the lower bound, below the upper bound, to the right of the left bound, and to the left of the right bound? Then it's in the square. If any of those conditions is false, it's not.
Charles Duffy
Nov 21, 2021 16:07
That's the point of using squares. "Is something in a square?" is trivial.