yes, but there are levels to the amount of mismatch
National averages are a terrible tool. Isolated per-country indexes are insufficient. No statistic is perfect, but the European authorities could - and should - try harder.
Forgot to point that I am the author of this data story.
Because the comment you replied to is wishful thinking and not facts. Highly qualified people are still falling over each other trying to secure US visas, whereas the international press loves to print headlines like “scientists are leaving America in droves”, naming a grand total of three specific scientists who left.
The world doesn’t operate the way we want it to, and US salaries are head and shoulders above what you can get anywhere else in the world. That’s what people really care about, and not the news cycle surrounding the current administration.
> Highly qualified people are still falling over each other trying to secure US visas, whereas the international press loves to print headlines like “scientists are leaving America in droves”, naming a grand total of three specific scientists who left.
Not from my group of colleagues. The only person who actually did end up going for a green card is actually the most politically unaware and least competent.
> US salaries are head and shoulders above what you can get anywhere else in the world.
This may be the case but the cost of health care, child care and homeownership are so much higher now than they used to be that for a lot of people it doesn't make any economic sense anymore.
I see a lot of people going for a few years, working their assess off, then leaving before they even have to start thinking about a mortgage.
Immigrant scientists may be leaving America, because federal funding for some sciences areas have been rather abruptly cut. But, scientists are a small portion of high-skilled migrants.
It’s nothing short of amazing that a huge codebase like Signal’s is apparently not only secure in a practical sense, but secure even in a strict formal sense. The people who wrote the Signal code must be engineers of the highest caliber.
Well the NSA is probably decent at building software. But none of this really matters if the OS isnt secure and the OS is much more complex and less verifiable. Also, why does the government use their own versions of Signal that are more secure, makes you wonder.
Would it? As I remember the journalist's number was added to an existing contact by some smart feature in iOS, not sure how a whitelist would help there.
Well the NSA is probably decent at building software.
Ultimately I'm sure they are but my secondhand understanding from friends is that it's difficult for the US gov't to attract and retain software engineering talent.
It's not just total compensation. Working on classified stuff can be a bit of a career killer, since you can't talk about your past work when looking for a new job.
Plus there's the antipathy toward the current Trump administration, and the general moral unwillingness of many to do defense-related work in general.
Also, last I heard, cannabis use was still a disqualifier for DoD work and/or various security clearances. There are periodic ongoing polygraph tests, not sure about ongoing piss tests. The government is big; I'm sure the exact policies differ from department to department. But this turns a lot of people off.
Of course, every single thing I've said above might also be viewed as a positive by some engineers. Maybe they attract enough "true believers" to more than make up for the other factors.
I would argue that US intelligence, especially on the technical side of things has put emphasis on privatization of these sectors.
US intelligence knows they can't go to policy makers and get funding for billion dollar domestic spy programs. So they stand up private companies and give them smallish grants at the beginning to get them on their feet, i.e Flock, Palantir, Signal Foundation, EFF, cloudflare, oracle. I could go on and on about orgs that their start off the back of US intelligence, whether through direct funding or through their alumni network.
The US Department of Defense has a long tradition of private public partnerships, but the privatization of intelligence has been accelerated in the last decade.
So while the NSA might not be able to attract talented SWEs for gov salaries to work on defense, their vendors that owe them their existence can.
That’s not an excuse. They chose to operate an online service, one that collects personal information. That entails the responsibility to secure it. If they can’t do that, they shouldn’t have offered the service.
Not really. The victim here is the people whose information has been distributed, not the system (and the people running it) the information was exfiltrated from.
If we are going to use an SA analogy, this is closer to the recent case of a hotel chain where there were several instances of staff giving “randoms” keys to rooms that they should not have. Best practise procedures were not being followed, the ne'er-do-wells took advantage of this, someone else suffered as a result.
If you process personal data, you must secure it against attacks. Are you suggesting that they could just put the addresses of their customers on their website with a warning not to download them, and if someone downloaded them anyway then it would be the fault of that person that they were leaked?
Society hold a strong double standard when it comes to the notion of blame in criminal acts. In some cases, it is fully put on the criminal. In other cases, it is put on victims of the criminal. While each case can use logic to try to defend it, they are different standards not used consistently. Trying to call out this double standard is a sort of act of profaning the current social norm and not appreciated by most, no different than trying to attack the dominant moral system 500 or 1000 years ago for inconsistencies.
If we were being consistent, then to your later question, yes. But pointing this out is picking at society's reverse scale.
According to this logic, anyone using PHP should also not be processing personal data, and of course Java, and also Javascript, and any other language that has had a huge zero-day. In NYS, your name is considered personal data, so these libraries should not have any digital collection of the names of their members let alone any online services. Although, I'd prefer we start with Meta, Amazon, Alphabet, Apple, etc when it comes to making them lose the right to storing all personal data every time they have a vulnerability.
There is a difference between being hit by the exploit of a zero-day and being hit by the exploit of something (incorrect security implementations) that has been known to be incorrect for years, decades even. The zero-day in PHP is not your fault (unless perhaps you wrote or maintain that bit of PHP) but bad security implementation using PHP (silly example: not bothering to hash password because it is easier and allows you to allow for typos which is convenient for the user) is ultimately the organisations fault.
Or alternatively we could hold criminals responsible and return to a high trust society where you can provide public services without having your own military department.
You are aware that personal information is routinely stored in places that you can break into with a literal brick to smash a window? Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
> Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
I don't think I've ever seen anyone say they should be 100% effective. Even those physical locations follow some physical security practices. The difference is that computers can be attacked from literally anywhere in the world, and good luck finding the people who did it.
But even the best physical security principles really only deter polite criminals. The breach is just as impactful whether someone leaves a door unlocked, or if someone just observes the hour a janitor leaves at night and waits outside the door and clubs him before he can lock up. What difference does it make to those affected by the breach between those two situations?
You've completely missed my point. It's not about whether something can be exploited, but the easy with which internet connected computers can be exploited from anywhere in the world. No need to be at the physical location.
I imagine the result would be a mixture of elitism, community fragmentation, and a witch hunt that never stops. Like Stack Overflow meets The Crucible.
That’s because the Hacker News crowd has finally found a topic on which it is willing to engage with the same level of outrage that has long defined Reddit. That topic is AI.
Turns out the clienteles of the two platforms aren’t so different after all. The only difference is what triggers them.
Good point. In that case, the current setting may not help much. But I think we can extend the framework to put the question first, so all the states share one question. We'd decide dynamically whether to place state or question first.
> They are not part of any existing writing scheme
They are today, and there is now orders of magnitude more writing that uses emoji than the entire corpus of many of the scripts covered by Unicode.
Language and writing have always been continuously evolving and that process didn’t magically stop when the Internet was invented. The first emoji preceded their inclusion in Unicode, humans used them in writing, therefore they belong in Unicode.
Correction: Unicode emojis are, because they got added to Unicode.
>Language and writing have always been continuously evolving and that process didn’t magically stop when the Internet was invented.
Okay but why should Unicode be a part of it, and a judge on what to include? That sounds like linguistic prescriptivism, while the original role of Unicode was descriptive and the evolution was happening outside of it. Emojis before Unicode were perfectly fine as composites that weren't mandated by committee.
> Okay but why should Unicode be a part of it, and a judge on what to include?
How could it be otherwise? These debates have been a part of Unicode since the beginning, such as which Chinese characters to unify, which ancient scripts to include, which attested glyphs get their own code points etc.
That’s simply what it means to be a standard: Decisions need to be made, and not everyone will agree with all of them.
Ancient glyphs and Chinese characters existed before Unicode, the committee didn't conjure a new form of language out of thin air. The decisions with Chinese writing were necessary due to practicality (there are various composable encodings, including IDC in the Unicode itself, but they're not very practical for a general-purpose text processing encoding).
Unicode emojis did not exist before Unicode, the existing composite emojis/kaomojis/etc were already perfectly expressible in existing symbols, and were nothing like Unicode emojis. This was a huge distraction from their mission, and definitely not inevitable.
Today's emotes became customized, and it's impossible to express them in any encoding. They diverged too much from writing to be called writing, it's a volatile signaling system at best. You can literally make an AI generation or upload your picture, how do you even encode or standardize that? But because of their blunder Unicode got stuck with its role of a judge and censor of a new entirely synthetic language it created, which wasn't the original purpose of the consortium.
It’s for many, many things besides letters, and was designed to be so from the beginning. Pictograms of various types have always been in Unicode, and even in many predecessor codesets.
Unicode is for text symbols, some of which represent one word (e.g. &, U+2116) and some of which represent multiple words (e.g. U+FDFD). Other non-letter characters include numbers, punctuation, and so on.
I've worked on systems this decade that still relied on floppy disks. It's getting harder and harder for them to operate because the disks are getting rarer, as are the drives. And often the essential component is not the disk itself. There are some other computers in the system that cannot be upgraded to any more recent device, systems from the 1980s and 1990s that force them to continue using a floppy disk.
If it was just two modern computers and transferring data between them, the floppy disk would have been dropped in a heartbeat. But it's the old computers still in the critical path that are holding everything back. And those are really hard to maintain. Last year we phased out a system that was dependent on computers from the mid-1990s, getting replacement parts was practically impossible, they mostly just don't exist. You'd buy old systems off ebay and hope that they had enough working parts to scavenge, and the right working parts.
EDIT: Light editing because I had some extra words.
There was a time when the company I was working for was selling service contracts for DEC TZ30 tape drives to DEC itself because their own internal service organization was unwilling or unable to support them.
The application was software distribution, most likely to customers they were contractually obligated to support, and no newer drives were able to write the required tape format, so upgrading to newer drives wasn't an option.
Systems are dynamic, not static. There are secondary consequences and forgotten/ignored opportunity costs. Sure, the existing system has proven workarounds, though labor and attention intensive. When a floppy disk fails it won't directly create disaster. But these legacy requirements do block the more cohesive and thorough introduction of additional safety mechanisms that increase redundancy and reduce the scope of possible human error - such as new sensor hardware and their automation, latency improvements, and information synthesis/notification clarity.
Here's a software analogy - required support for very old OS versions often interferes with the scope, simplicity, and security of new feature work, and even if the work is still feasible at that point it is slowed down greatly, eating up attention and time that could go towards addressing other important issues. That accumulates over time, and cumulative loss of improvements that could have otherwise been made has a real effect in unprevented disasters and wasted controller availability.
It's both time tested and at risk of ripping at the seams. Floppy disks and the mechanisms still wear. And because neither are still made, the chances of a zero population scenario happening is greater every year.
It's better to test a replacement while you still have the time, than to risk rushing something else.
The overall reliability of a system is time invariant... its either reliable, or not.
The fact that it has gone x days without an incident doesnt upgrade or downgrade its reliability. The engineering and processes are function in an equation that calculates mean time to failure. Life-critical processes have numbers placed to this... like a failure every 50 years or 100 years... or 100000 years, and you work towards solving that.
Fortunately the choice isn't between 1980s hardware with floppy disk requirements and rented servers in someone else's building. There are a lot of options in between those two.
They also often don’t match reality either.
reply