Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Book list for streetfighting computer scientists (2022)

nick-black.com

Post reply on HN
Print view View original

51–60 of 67 posts

Re: Book list for streetfighting computer scientists (2022)

#51

Post by wolverine876 »

frfl wrote: post #50
wolverine876 wrote: post #49

Earlier quoted context omitted.

> Unlike other PDF readers/annotators, it saves a separate file, so the original PDF is untouched. Just to give people another perspective on these issues [edit: not to deny the parent's perspective, just to add another]: In PDFs, annotations are effectively (or actually?) on a separate layer from the document. It's not like marking up a paper book; in a PDF the annotations leave the original untouched, and can be ea…

Fair enough. I was providing alternatives, not prescribing a single solution. You'll notice I said what I use and also provided suggestions that I don't use. Xournalpp uses layers as well, hiding annotations is also possible there. Just a different solution to the same problem. Xournalpp, is free and open source. It is actually a fork of an older software called Xournal. If it stops being developed, C++ compilers are…

> Fair enough. I was providing alternatives, not prescribing a single solution.

Yes, I agree completely. Sorry that I gave a different impression.

> Xournalpp, is free and open source. It is actually a fork of an older software called Xournal. If it stops being developed, C++ compilers aren't going anywhere, I'll compile it myself -- beyond that it's just pedantic to discuss what and what won't be possible in decades.

Few users will compile anything, and eventually incompatibilities arise between the application and the latest platform. My PDF reader functions fine with documents that are decades old - that is part of the PDF specification; it's not pedantic, it's deliberately and successfully engineered.

> PDF readers on the other hand, especially proprietary ones have a bad habit of, for lack of a better word, enshitifying (cloud, saas, subscription, etc). I've had PDF editors corrupt my PDF as well, my fault for not having backups I suppose, but I've avoided them since.

There are many, many PDF readers. I have no problem finding a good one (I agree, stay away from Adobe, which you seem to describe). Yes, I'd be careful with PDF editors - that's not really what PDFs are designed for afaik.

Re: Book list for streetfighting computer scientists (2022)

#52

Post by wolverine876 »

bawolff wrote: post #48
wolverine876 wrote: post #43

Earlier quoted context omitted.

Why? That's what will inform your fellow commenters. We can find people of every opinion; your existence and mine are not news. The 'why' or 'how' is what makes a difference.

I'm not a neuroscientist, i have no idea. If i had to guess, its because i have never found highlighting particularly useful (whether in physical or digital form), and i generally find it easier to read things in order first and then go back to fill in gaps of understanding instead of constant cross referencing which breaks the flow of thought. So in essence i personally find most of the benefits of digital form is l…

> I'm not a neuroscientist, i have no idea.

ok!

Re: Book list for streetfighting computer scientists (2022)

#53

Post by frfl »

wolverine876 wrote: post #51
frfl wrote: post #50

Earlier quoted context omitted.

Fair enough. I was providing alternatives, not prescribing a single solution. You'll notice I said what I use and also provided suggestions that I don't use. Xournalpp uses layers as well, hiding annotations is also possible there. Just a different solution to the same problem. Xournalpp, is free and open source. It is actually a fork of an older software called Xournal. If it stops being developed, C++ compilers are…

> Fair enough. I was providing alternatives, not prescribing a single solution. Yes, I agree completely. Sorry that I gave a different impression. > Xournalpp, is free and open source. It is actually a fork of an older software called Xournal. If it stops being developed, C++ compilers aren't going anywhere, I'll compile it myself -- beyond that it's just pedantic to discuss what and what won't be possible in decades…

One of the nice things about Xournalpp is that is just plain XML (the save file). So its really just plaintext, I don't have to bother with reading hundreds of pages of PDF spec to try and write a reader in the future. If I needed to, I only need to write an application capable of rendering a PDF page, then drawing text/lines as described by the XML. Assuming libraries to render the PDF will continue to exist in this theoretical future we're describing here.

        254.802 713.98302 283.955 713.98302
        283.955 714.01302 539.992 714.01302
        539.992 718.51302 539.992 718.51302
        Here the first capture group is
        `([\"'])`, which captures either a
        `"` or a `'`. Then the `(.-)` lazy matches
        any thing, and finally `%1` matches
        the original type of (closing) quote
        
        
        
        
        
        120 78 169.674 78
        265.784 77.97 292.676 77.97
        292.676 78 397.442 78

Re: Book list for streetfighting computer scientists (2022)

#54

Post by wolverine876 »

frfl wrote: post #53
wolverine876 wrote: post #51

Earlier quoted context omitted.

> Fair enough. I was providing alternatives, not prescribing a single solution. Yes, I agree completely. Sorry that I gave a different impression. > Xournalpp, is free and open source. It is actually a fork of an older software called Xournal. If it stops being developed, C++ compilers aren't going anywhere, I'll compile it myself -- beyond that it's just pedantic to discuss what and what won't be possible in decades…

One of the nice things about Xournalpp is that is just plain XML (the save file). So its really just plaintext, I don't have to bother with reading hundreds of pages of PDF spec to try and write a reader in the future. If I needed to, I only need to write an application capable of rendering a PDF page, then drawing text/lines as described by the XML. Assuming libraries to render the PDF will continue to exist in this…

Very cool. One thing I dislike about PDFs is the complexity, and like you I do use text when possible (text files aren't so great if I want to annotate them, unfortunately).

Out of curiosity, is that SVG (which is an XML)?

Re: Book list for streetfighting computer scientists (2022)

#55

Post by frfl »

wolverine876 wrote: post #54
frfl wrote: post #53

Earlier quoted context omitted.

One of the nice things about Xournalpp is that is just plain XML (the save file). So its really just plaintext, I don't have to bother with reading hundreds of pages of PDF spec to try and write a reader in the future. If I needed to, I only need to write an application capable of rendering a PDF page, then drawing text/lines as described by the XML. Assuming libraries to render the PDF will continue to exist in this…

Very cool. One thing I dislike about PDFs is the complexity, and like you I do use text when possible (text files aren't so great if I want to annotate them, unfortunately). Out of curiosity, is that SVG (which is an XML)?

I think it's just XML, not SVG.

        
        
        Xournal++ document - see 
        iVBORw0KGgoAAAANSUhE...............
        
        
        
        
        
        
        
        
        ...
        
        
        
        120 457.20601 540 457.20601
        394.78 515.76399 540.01 515.76399
        540.01 520.26399 540.01 520.26399
        120 527.76399 156.1 527.76399
Here's the top of the file for context.

Re: Book list for streetfighting computer scientists (2022)

#56

Post by pvg »

tptacek wrote: post #45
heads wrote: post #12

Anderson, Security Engineering (Wiley) would make an excellent addition to this list. (The blog post omitted anything infosec saying the field is “part of QA” but it’s not like this list is pure CS — a lot of engineering topics aka “applied computer science” are on the list already.) Security economics is important when building real world software because one has to know one’s enemy in order to decide what to defend…

For people who call it "infosec", it probably is, or an admixture of QA and IT.

Wait, what do sophisticated people call it and if we adopt it, will they stop saying ‘nation state’?

Re: Book list for streetfighting computer scientists (2022)

#57

Post by tptacek »

pvg wrote: post #56
tptacek wrote: post #45

Earlier quoted context omitted.

For people who call it "infosec", it probably is, or an admixture of QA and IT.

Wait, what do sophisticated people call it and if we adopt it, will they stop saying ‘nation state’?

It's like 8 different and mostly unrelated disciplines, so, "hardware security", "software security", "vulnerability research", "exploit development", "software reverse engineering", "cryptography engineering", maybe "systems security" if you want to put OS security in a different bucket from software security. And then all the IT and risk management stuff (network security, corporate security, &c). This is off the top of my head. Most of this work is totally unlike QA.

Even the parts of it that are like QA (vulnerability research, say) are pretty unlike QA; the bugs you find in QA tend not to be driven by adversaries, so you get to work with a relaxed set of constraints. QA work is much more process-focussed, about repeatability and coverage, and less about detailed study of how systems work. In hardware and cryptography, the work closer in spirit to vuln research is called "verification".

There's superficial vuln research that any QA person can (and should! but probably doesn't!) do. But if "looking for bugs" is "QA", have fun explaining to people writing Tamarin proofs for protocols that they're just QA engineers.

None of this is to belittle QA work, which is very difficult to do well, and which has its own subfield of ideas and research and tooling and stuff.

Re: Book list for streetfighting computer scientists (2022)

#58

Post by pvg »

tptacek wrote: post #57
pvg wrote: post #56

Earlier quoted context omitted.

Wait, what do sophisticated people call it and if we adopt it, will they stop saying ‘nation state’?

It's like 8 different and mostly unrelated disciplines, so, "hardware security", "software security", "vulnerability research", "exploit development", "software reverse engineering", "cryptography engineering", maybe "systems security" if you want to put OS security in a different bucket from software security. And then all the IT and risk management stuff (network security, corporate security, &c). This is off the t…

Oh sorry, I meant ‘infosec’, the QA thing seems obviously silly. Is your objection to it that it lumps too many things together?

Re: Book list for streetfighting computer scientists (2022)

#59

Post by tptacek »

pvg wrote: post #58
tptacek wrote: post #57

Earlier quoted context omitted.

It's like 8 different and mostly unrelated disciplines, so, "hardware security", "software security", "vulnerability research", "exploit development", "software reverse engineering", "cryptography engineering", maybe "systems security" if you want to put OS security in a different bucket from software security. And then all the IT and risk management stuff (network security, corporate security, &c). This is off the t…

Oh sorry, I meant ‘infosec’, the QA thing seems obviously silly. Is your objection to it that it lumps too many things together?

Yes, it almost doesn't have any meaning at all as a term. It's an umbrella for a bunch of disciplines that are less similar than, say, QA and software development. It can also, as you intuited, kind of be a "tell" for people who aren't thinking seriously about the computer science of security. It isn't automatically, but it pretty clearly is when you're using it in the same breath as "security is just QA". It is the CISSP of terms.
Post reply on HN