Any method does an extra null check and a cast to ICollection<T> which incur unnecessary performance degradation. Of course this is in micro optimization scale. If you do not call Any() on a hot path it does not matter which one you use.
I worked with Diego (the author) on a first version of this, since it was a project in the course "Artificial Intelligence Programming" IT3105 at NTNU in Trondheim, Norway where we both stayed in our Erasmus a year ago.
While it is not very sophisticated to use SOMs for this problem, it was rather meant as an implementation exercise. And TSP allows a graphical representation of the process, which is nice too.
That said, we spent way too much time in the course implementing and fine tuning Genetic algorithms...
That is just not true. Look at the numbers, and not on your feeling you get from the news. For I stance start with the number of bullets fired by police!
The statement was "There are no killings in cities", which is clearly not true - there ARE killings in cities. There are probably less overall than in America, but I really don't care enough to check.
If you can be bothered to go back and re-read my last comment, you'll notice I never once mentioned guns or even expressed a passing interest in comparing gun death rates.
With no real reaction after the NSA leaks and with people in various governments trying somehow to criminalize encryption and anonymity, this is exactly what we need. We don't need another centralized Google/Facebook/etc. powered application.
I know where you're coming from but I don't think this is the case. There are too many examples to give but here are some nice ones:
In 2013, there were only a small number of E2E encrypted messenger users. Now there are over a billion Signal Protocol users alone, not even including other systems. This isn't getting deployed because it's easier to develop, support, or use than plaintext.
In 2013, RC4 was widely used in TLS and random number generation (on BSD systems). It has been kicked out and now ChaCha is seeing wide deployment in the same places (although FreeBSD is lagging behind).
Let's Encrypt has substantially increased TLS availability and usage.
In 2013, the default crypto in OpenSSH was (IIRC) P-256 and AES-CTR, with ECDSA host keys. It's now X25519 and ChaCha20-Poly1305 with EdDSA host keys.
In 2013, TLS was mostly RC4 and CBC. Now (on my servers) it's mostly GCM and ChaCha. Even the IETF has said to stop using RC4.
The NaCl family, including in particular Libsodium, has a TON of users. Besides supporting only strong crypto, the high-level API has made it almost impossible to publish a successful new crypto library today that's in the style of OpenSSL where the only answer to "how to I accomplish X?" is "go fuck yourself." Good riddance to Russian roulette crypto libraries.
We're even seeing movement in pqcrypto. So while some people are being reactive and switching out bad crypto for good (as in above examples), some are being proactive. Google is experimenting with pq-safe key agreement, as just one example. Tor is working on it as well. So not only has there been a positive reaction since 2013, but people are beginning to be more proactive as well, trying to stay ahead of the curve.
The number of users of strong crypto has increased by several billion since 2013.
This doesn't mean much, in my opinion. It might stop several thousand teams of garage hacker heroes but it's hard to argue it would stop NSA / GCHQ / anybody else on their level.
With all of the leaks (good chunk of them are just theories, admittedly) that claim that agencies can utilize hardware backdoors remotely, it's hard for me to imagine I am safe from snooping, ever. What good would a stronger SSL/TLS key do if the agencies can directly connect to my CPU? What good would a strong VPN and a network like Tor do if my NIC reports my traffic via a backdoor in its driver without a chance of me ever noticing?
I definitely agree some progress has been made. No two opinions about it.
I do question if these countermeasures achieve anything at all against the biggest and most formidable snoopers however. I feel like they are letting us argue over things they've cracked long ago and are letting us think we're safe.
Usually when public statements are made by them which try to smear/outlaw a technology, it's then I'd think the agencies are having a hard time. If they don't say anything, I'm presuming they got things well under control and where they want them to be.
Not the ideal theory but all of this reply was just my thoughts anyway. If I had any facts whatsoever, I'd most likely be in a prison, so there's that. We can mostly only theorize here.
Indeed they are. And it's somewhat discouraging seeing people argue over the best encryption algorithm instead of trying to hunt down Intel's rootkits, for example. Again, I can't claim anything; I am just reading and hearing things. They might be total crap and I might be an idiot for thinking they might be true. But they're still worth considering IMO.
It's not at all discouraging to argue over the best encryption, it's plenty healthy to keep the research going so weak/defeated methods get deprecated and only the strongest remain in use.
But you're right that endpoint security is the next monumental task and the challenges are not entirely unknown [1]. How do you suggest we proceed to achieve trustworthy hardware?
That's a very good question and a very tough one to answer. In my opinion we the humanity gave up the easy way to a secure and publicly audited hardware when Intel started growing. We lost the battle right there and then. To try and do the same they achieved in 10-15 years but be entirely transparent and auditable... seems impossible right now. :(
However, projects like Raspberry Pi are admirable and are efforts in the right direction (even though recently it has been questioned if it can be hacked the same way that Qualcomm-based Androids can). I recently heard about that 1000-core CPU as well. I wonder if that's entirely public? If it is, it might render the x86 / AMD64 model irrelevant so we shouldn't spend gigantic efforts in trying to catch up with 10-15 years of hard work from Intel.
So probably the general direction would be to make old and good hardware protocols famous by trying to "libre"-ify them and bring them up to speed to today's computational requirements (mind you, I still want to play my games on Ultra settings). Even if we start replacing things one by one, every iteration could decrease the attack sufrace. That'll force the malicious actors to take counter-measures; for example, I'd think trying to outlaw ARM (or economically attack its usage, which is the much more used way of doing things IMO) and only license Intel/AMD for certain applications would be a telling sign that somebody doesn't like what's happening.
I am not a hardware person (wish I was; I am not even electrical / electronical engineer!) but I am a privacy-conscious person, and quite paranoid too. I am sure there's a way but alas, I can't answer you in as constructive manner as I'd want to. I can only do a "boss speak" and be oblivious to the details. And at 36 with a well-built career I am beginning to doubt I'll ever try and become a hardcore hardware engineer in addition to my programming/sysadmin experience.
A little remark: Raspberry Pi is a nice market for Broadcom, Premier Farnell and other big players involved in making it. It also has proprietary chip that needs closed source software to work (while Intel provides a lot of open source code).
I guess their project has been really successful if “privacy-conscious” and “paranoid” persons consider it “admirable” based on nothing but the internet hype.
The answer is simple: there is no libre hardware if you want top performance, common architecture, don't have ability to order chips in hundreds of thousands or to make your own, etc.
The question is not whether some proprietary solution looks “free enough” if you squint your eyes more than the other proprietary solution. The question is whether people understand that chain of trust that ends in someone else's hands has its problems no matter how big that someone is, and bother to fix that vulnerability.
I've been waiting to run across someone who may be able to scratch an itch that's been in the back of my head for a few months now and you seem like you might be able to help me out...
Would the developing J-Cores[0] being worked on by 0pf[1] be able to catch up (I'm thinking more along the lines of performance of recent mobile processors, not desktop processors)? I am under the impression that, while a monumental task is ahead of them, they have the boon of hindsight. Of a dozen processor architectures competing back then only a handful survived the decade and only 2 or 3 are being fabbed now (i386/amd64, ARMvX, and IBM?) and they can base decisions on the successes and failures of other chipsets, speeding up the development process. Is that fallacious thinking?
I know most of their goals are along the lines of getting custom fabs down to $20k and making the term "penny processor" a household term, but is there potential (read:hope) for a secure, performant (whatever that means to you) processor that we can use for daily computing without fear of a hardware-based backdoor?
> there is no libre hardware if you want top performance, common architecture
Performance is definitely a difficult sacrifice. Consider however that your general computing could be split into a privacy sensitive component: sending emails/messages, assembling documents, banking website, etc, and a privacy insensitive component: compiling OSS, playing games, etc. Composing/sending email for example is not computationally demanding... so one might use a high performance Intel machine for insensitive computing and a lower performance libre machine for sensitive work. It's not perfect (web browsing can be both private and not, and demanding and not) but a refinement of this separation approach could be an interim solution until high performance libre hardware is available.
Depends on the application, but as one possible general solution: have microservices talk to each other directly when it makes sense to rather than communicating over RabbitMQ / central message bus out of laziness/convenience.
Doesn't this make the architecture a lot more complex though? I mean if every service uses a common messaging broker, number of connections to every other service is O(n). While if every microservice needs to talk to every other microservice, its O(n2). And analysis is much harder, unless all the services send their logs/metrics to a common logging/metrics system.
If you don't have every service talk to every other service then it is either a deployment problem or a load balance problem.
If a service only say talks to instances of another service that is local, then every node in a cluster must contain ALL services. If the local service is overloaded but a remote service isn't then the service you are talking to will be slow, regardless of any front end load balancing.
Every service must be able to talk to every other service, because if it cannot then you cannot load balance or deploy without it being an n^2 problem. So the question is how to implement it WITHOUT complicating the services
profilesvc may only need to talk to (depend on) usersvc and accountsvc to do its job. usersvc and accountsvc may only need to talk to (depend on) their data stores.
Yes, every instance of every service needs to manage its communication paths to other services. That's N connections, rather than just 1 to the message bus. But this is a pretty well-understood problem. We have connection pools and circuit breakers and so on. And the risks are distributed, isolated, heterogeneous.
Service Discovery often removes the need for load balancers. Let the clients discover where all the instances of Service X are and build the clients to handle failures to connect to individual instances.
Service discovery does not remove the need for load balancing.
For example, if you had three nodes, each with every service and round robin service discovery to overload the system is just a matter of receiving a difficult request every third query. No matter how good your front end load balancing is in a micro service system, if your intra-service requests are not load balanced you can have problems with overloading one node, while others are idle.
Service discovery can remove the need for load balancing, if you move load balancing logic into the client services. Have them architect their own load balancing over available instances of their dependent services.
Unless you're deploying a Smartstack-esque LB strategy, where each physical node hosts its own load balancer, then the details of what's deployed where are mostly irrelevant. You use your SD system to abstract away the physical dimension of the problem, and address logical clusters of service instances. And you rely on your scheduler to distribute service instances evenly among nodes.
Is this really true for the example? To me it seems that the implementation for .Any actually uses .Count when available, see https://github.com/dotnet/runtime/blob/main/src/libraries/Sy...