skysight-inc/HackerNews huggingface dataset:
All these threads are complete gold mines of years of hard won experience and system administration tips! Fascinating, especially the war stories I'm reading - both hilarious and horrifying in equal measure.
I don't agree with the explosion of micro-modules. There's a reason the vast majority of languages doesn't have them, at least not at function level.

IMO in the Javascript world they're only there in order to minimize script size for front end work. See lodash & lodash-something1 / lodash-something2 / ..., where there's an option of using the whole module or just including 1-function long scripts, precisely to avoid the script size issue.

Is there a solution for this? I know that the Google Closure compiler can remove dead code, ergo making inclusion of large modules less costly in terms of code size. Am I missing some ES6 feature that also helps with this?
> At what point does someone's routine vocal endorsement of racial superiority and advocation of violence become problematic?

As long as the person does all that on their own time and is professional and respectful in the work context? Never.

Any other questions?
This is a lot more interesting than I thought it would be from the title.

Obviously, anyone can trivially generate "backdoored" Diffie-Hellman parameters; for instance, just use a bogus generator that locks the algorithm into a tiny subgroup. No matter what private keys Alice or Bob generate, the DH computation will be predictable.

This writer wants to do something cooler: generate NOBUS parameters, in the fashion of Dual_EC DRBG, so that the parameter's authors can predict DH computations but (without Significant effort) nobody else can.

Several of the methods the writer is playing with involve DH parameters for which they can use Pohlig-Hellman to recover secrets. Pohlig-Hellman breaks DH when its victims are unfortunate enough to be in a group with a smooth order --- that is (I'm butchering this), when the group order factors into small primes. It works by collecting samples from the target for each factor of the group; each leaks a bit of the key modulo that factor. You knit the samples together with CRT.

David wrote this up well here: https://www.cryptologie.net/article/196/pohlig-hellman-algor...

Obligatory plug: a fun version of this attack is the kick-off problem on Sean Devlin's very excellent Set 8 of the Cryptopals challenges. Set 8 isn't on the website, but you can mail him (finding him is an exercise for the reader) to get a copy (on the honor system, like the other challenges were before we published). Set 8 builds this attack to an extremely useful attack on Elliptic Curve Diffie-Hellman.
So many people use lodash as a drop-in standard addon library that I'm surprised people aren't just using the padding functions that are right in there... Some of the packages that broke yesterday even have lodash included as dependencies already!
if you like big hangars, the old CargoLifter Hangar[1] near Berlin, Germany is also amazing. Even more amazing since they went bankrupt and it was converted into a tropical island resort[2] where you can go to sun bathe in the icy Berlin winters.

[1] https://en.wikipedia.org/wiki/CargoLifter
[2] https://en.wikipedia.org/wiki/Tropical_Islands_Resort
Good point -- I don't know what rules apply to jury selection and eligibility in civil cases.
That's what strikes me as odd. Even small and mid-size companies can do this for cheap if they're mostly cloud-based.

Stand up the environment at another cloud provider, keep resource use at 1% that of your current provider, implement a continuous replication procedure, document the failover procedure, and test-run once a month. Much less work than actually buying and organizing some small colo space in another DC, and way faster than scrambling to recover. Yet I don't know of a single cloud-dependent company that does this unless it's for performance reasons.
Front page of HN says that Apple suspects tampering with their hardware going in. What good is encryption when there's a back door?

The warrant canary! The warrant canary! It vanished. We really don't know what they're up to now.
Yeah, I thought the dependency thing was a joke (I mean, to have a package for is positive integer is already a joke, but come on)

Really
Service worker supports notifications: https://developers.google.com/web/updates/2015/03/push-notif...

The primary use cases for service workers today are robust offline support and notifications. More generally service worker gives you broad and very fine grained control over your app's use of the network. Service worker itself doesn't give additional cross-origin request abilities, except by giving more control over caching.

Web Bluetooth is still a work in progress, but you can try it out: https://developers.google.com/web/updates/2015/07/interact-w...

(disclosure: I work on this kind of stuff for Google)
This is just more evidence that the unit of code is a function, not a module.

Eventually, given a pure enough language, every "package" could contain only a single function, and every function in a project could be published as an independently reusable unit.
"I like Prezto[1] nowadays" -- an `Oh my zsh` refugee

1: https://github.com/sorin-ionescu/prezto
> Try to rebuild that thousand-dependencies app in three years from now and you'll see ;-)

This is your fault for expecting free resources to remain free forever. If you care about build reproduction, dedicate resources to maintain a mirror for your dependencies. These are trivial to setup for any module system worth mentioning (and trivial to write if your module system is so new or esoteric that one wasn't already written for you). If you don't want to do this, you have no place to complain when your free resource disappears in the future.
Front page of HN says Apple suspects "third party tampering" with servers en route to them. The plot thickens.

If you didn't build it, you can't trust it.
He said that he was doing bare metal work on the AVR so I assume he wasn't referring to Arduino. Arduino aside, the default toolchain for 8 bit AVRs is really simple to get running. Just install AVR-studio with its built in GCC compiler and libraries. It was something I was always jealous of on the Microchip side of the pond.

As it is, I'm in the same boat as the grandparent comment. I'm moving over to STM32 and I'm loving nearly everything about it. While there are more toolchains and less hand holding the possibilities are much more exciting. All in all, it's a great time to be doing embedded development.
npm stats

jspm 115,692 downloads in the last month
rollup 95,038 downloads in the last month
webpack 1,407,499 downloads in the last month

jspm I believe had a good thing going for a while but webpack has well and truly replaced them now.
People generate large primes using programs designed to do that, and maybe generators/primitive roots for those primes using a CAS like Sage or Octave/Matlab. The same goes for ECC crypto, with a lot of extra testing/filtering to find "nice" constants.

A lot of the other giant numbers you see in cryptosystems are random numbers derived from other constants.

Sometimes there are things to learn by studying the numbers themselves. For instance, the prime field in Curve25519 is a special prime with (bit-level) characteristics that make it especially nice to do math on with general-purpose computers. Other times, the numbers are, for instance, just giant random primes, and aren't themselves very interesting.
> After all, Google is a tech company first and foremost... Amazon started as a retailer.

Yet, Amazon has proven to be extremely capable of being both technical and marketable. I almost wanted to stop reading your comment when you said that, but I kept going because I don't use Google Compute.

> The GUI is way, way, way nicer than the EC2 GUI

Absolutely agree, but I don't have Google Compute, can you share some screenshot or pull one off the internet so we can actually compare?

> There's no need to install multiple SDKs and libraries to interface with the "cloud" like there is with EC2

I think this goes back to legacy consolidation/ For example, we still have to rely on s3cmd for certain exclusive operations because aws cli does not offer that out of the box. AWS documentation itself is also not most readable. Furthermore, filtering is quite primitive and limited in most APIs (and also very inconsistent). Some products aren't even available entirely in CloudFormation, or partially available.

> Google has the advantage over Amazon of releasing its cloud product half a decade after Amazon, so Google could learn from the mistakes of EC2

Certainly.
As opposed to someone working a minimum wage job & trying to eat decently, for example.
I know. I just brought his point to a logical conclusion. We should tip everybody that provides a good service. Including 10% for the surgeon that just did your knee replacement for $15786 :-)
So I'm resident in China and don't use WeChat, but my wife (Chinese) does however for all the things you listed. One of the annoying aspects seem to be its reliance on QR, but that is changing (UnionPay now supports RFC at places like Starbucks, not sure if this is related to WeChat or not). I've always had a problem with online payment because they always ask for my Chinese ID number (non-Chinese Uber with a UnionPay card works like this also, Uber is in China BTW, but they are supported by Alibaba, not Tencent, so their WeChat app isn't allowed to work). I'm not sure what the process is to get a China bank account linked to WeChat if you don't have one, but to be honest, I haven't tried for WeChat yet (my wife has offered to just put me on her card), whereas ApplePay in the states doesn't have a problem with foreigners.

On the other hand, much of the functionality of WeChat is app based, so I can and do use didi dache without WeChat (if I pay with cash, of course, and the non-taxi service is off limits to me).

I was impressed by Australia, where RFC seems to be ubiquitous, you just swipe and that's it. Hopefully China moves in the same direction.
Why did you have to rebuild it?
Spoken like someone who doesn't have a tight deadline.
Spoken like someone who isn't on a tight deadline.
Some of the libraries people were mentioning broke yesterday already have lodash as dependencies, I have no idea why they wouldn't have just been using this...
This doesn't make any sense. Firstly, it's common practice (the norm) for tips to be pooled and split among all staff, so it doesn't, in fact, result in good employees being paid more than worse ones.

Secondly, solving the principal-agent problem is the employer's problem, and they could do that by collecting feedback, paying bonuses, firing people, etc. Punting the whole thing to clients just means that it becomes a lottery based on the client's mood, wealth, expectations, instead of something objective.
I'm happy to make an issue of professionalism in a professional environment. I spend my day in suits around businesses that will openly tell you they won't work with you because your tie looked cheap. There are businesses involved here, and people in business roles making, imo, unprofessional threats.

When you work all day, and then come home to provide unpaid support for a project, things are different. You're sitting in front on a television in shorts, in the least professional environment imaginable, and you're helping people who have issues with your code, because that's what it means to give to the community.

Then someone comes out swinging with a list of demands, regarding what you do in your own time. What is the return threat? "He wasn't professional so I'll stop making unpaid use of his products"?
No, no, no

Left padding is (almost in all languages) built-in, even C can do it with printf (edited)

The problem is not having a library that offers that, but having this micro-module thing as a whole NPM module. No other language does that.

If it was inside a string helpers, that's great.

But don't make me one single module for just left-padding (or is-integer-number)
This looks like a more rough version of A Softer World (http://www.asofterworld.com/index.php?id=1240)
Am in the same boat ... Moto G (3rd gen) has been the best decision of my mobile life for a long time.

Stock android, waterproof, swift, solid (I've dropped it an unbelievable amount of times (my HTC's didn't survive even one drop)).

The UI is absolutely fine. Nice and clean and quick. And I concur, don't need to fiddle with anything.

Brilliant phone. I'll have it over an iphone or Sammy £500 phone in a second.
Ask HN: Why MOOC don't work?
And what's your opinion on it ? Do you see it like a university alternative or a university killer ?
Only if your modules are little more than textual inclusion and perhaps a mechanism to deal with name clashes. ML style modules are way more substantial than that, they can be used as units of abstraction.
Nitpick, but: I read this caption and stopped. In the photo, there are five white men, and one woman of Asian heritage. How does this make the dinner "multicultural"? http://imgur.com/hy0BmEZ
Don't use GOST.
Unlike the HN readership, most people don't want to think about the tech. They just want to get things done, and are willing to pay big bucks for that convenience.
And this is how you run a business. It seems every person who worked with you had integrity and true leadership in spades!

That's rare. Too rare!
Good advice, but things get a lot more complicated with HIPAA-protected data. Alas we can't simply move our prod data to any place less secure than prod.
I think this is some sort of cargo cult UNIX minimalism - do one thing and one thing only.
It beats the alternative - pulling in some huge package with lots of little functions, all of which end up in the output. At least you're not loading huge amounts of unreachable code into the running system.

In languages with linkers, the better linkers would discard all unreachable functions. Then came DLLs. Use one function in a DLL/.so, and the whole thing has to be loaded. Go and Rust are usually statically linked, reflecting the fact that pulling in big DLLs was usually a lose. You rarely have two different programs on the same machine using the same DLLs, except for some standard low-level ones such as the C library.
Everything in this article is categorically wrong and antithetical to every principle of good programming ever articulated. The only problem here, as others have already noted, is that NPM allows people to delete published packages.

Small modules are not evidence of a problem, and they certainly aren't evidence of an inability to implement these things on the part of the people depending on them. Why would I implement left-pad myself when there is already a well-tested implementation that I can install? Building up an ecosystem of tiny abstractions, bit by bit, iteratively and evolutionarily, is how we get robust, well-designed complex systems. We don't get there by everyone reinventing the left-pad function to sate some misplaced appetite for self-reliance.

The author seems to make some arbitrary distinction between things that are 'large enough' to be packaged and 'pure functions' which are 'too small' to be their own modules, and I just couldn't disagree more. Tiny, pure functions are ideal modules. They facilitate the greatest degree of re-use, most clearly articulate what they ought to be used for, and stateless things are, in general, more composable than stateful things. There is no better unit of re-use than a tiny, pure function.
Grafomap: A map poster of your favourite place on earth
Most of the time this is something you inherit. Not something you wrote.
(That was a different poster's assertion.)

The code actually says that you agree to be removed if you "wantonly behave in a manner inconsistent with" it, and only one of the paragraphs mentioned minorities: they chose to lead with a general requirement to treat others with respect, dignity and empathy, regardless of who they are.

This is not a code of conduct designed to punish accidental "thought crime" against minorities: it is designed to prevent intentionally or recklessly offensive behaviour towards any and all conference attendees.
Dumb as a cucumber. https://twitter.com/TayandYou/status/712776646890106880
I would say tips are another word for "broker fee" then.

If restaurants want to motivate their wait staff, they can pay them an actual commission based on sales if that's the goal.
I will, thanks.
That service doesn't even come close to functioning properly. Search for your own name and you'll see what I mean.
> Nim is frustrating

I have used Nim heavily for more than a year now, and it turned out to be the most productive language I have every used. Nim could be considered a modern Lisp with infix notation and Python like syntax with native C performance. The macro system is incredibly well designed and easy to handle.

I also tried Rust, and it turned out to be much more complicated and time consuming. I would use it for systems programming only. Redox is the only reason for me to learn Rust.

> The one thing is its rule for when two identifiers are the same.

First it looked strange to me as well. However there are actually good reasons to avoid case sensitivity.

http://blog.codinghorror.com/the-case-for-case-insensitivity...

As for the user_sort and use_rsort example, such semantic errors can easily be fixed by qualification (a.user_sort and b.use_rsort). Errors like the following one however are very hard to fix in case sensitive languages like C++ and probably even Rust:

module A: func smart_func (x,y) = do_this
module B: func smart_Func (x,y) = do_that
module C: func Smart_Func (x,y) = do_something_else

main:

import A, B, C
smart_func (a,b)

hmm ... smart_func(a,b) doesn't work. Seems to be a typo. Which function did the author really mean?

Nim would reject such a mess in general.

The developers of Nim have implemented a lot of nice features. A really silly idea however are strong spaces. No serious developer would ever use such a dangerous "feature". It should be removed from Nim.

https://github.com/nim-lang/Nim/wiki/Whitespace-FAQ
This is better than the usual fluff, but obviously we had to change the baity title. If anyone can suggest a better (more accurate and neutral) title, we can change it again.
(Also, tipping is a wonderfully efficient way to discover which customers are not worth being nice to. ;) )

Not when the tip is collected after the meal. If you want to make an argument for tipping on these grounds the tip needs to be made before the meal is served.
Dune is probably the bestselling science fiction novel ever. By 2000, it had sold more than 12,000,000 copies[1]. It also won both the Hugo and Nebula awards. It's true that it hasn't penetrated popular culture like Game of Thrones but I think the reasons why are obvious.

[1] http://www.nytimes.com/2000/12/03/tv/cover-story-future-myth...
Another interesting argument for micro-modules:

https://github.com/sindresorhus/ama/issues/10#issuecomment-1...
Padding a string is a one liner. I'm perfectly happy to write it, test it, convince myself that it works, and then forget about it and just use it.
It does seem pretty insane, but how many of these are polyfills?
> if I can be mildly affective at a job, and the environment changes, and I don't keep up, why should I be given preference...

Seniority and firing are two different things.

Seniority kicks in when there are layoffs. You have to lay the younger people off first. This prevents management from using "layoffs" to suddenly reduce their salaries by swapping out all younger people for all older people.

Firing is available at any age. However, the union will force you to DOCUMENT it. The problem is that management almost never wants to document things because it invariably makes management look bad--their demands look silly, the historical record is against them, end users love the person they are attempting to fire, etc. The reason for this is that the number of people actually being fired for being grossly incompetent/work hazard/etc. is dwarfed by the number of people management is trying to fire for political reasons.

Yeah, you all have apocryphal stories of the youngsters being disadvantaged. I have real stories of being part of strikes, the abuse companies used to try to push people out before they could get their full retirement benefits, reassignment of roles to abuse someone for speaking out about dangerous conditions, etc.

And, those of you who suggest that lawyers are the answer have never actually sued someone. I have. And won. It would have been more profitable for me to lose if it had happened 3 years earlier. The law is expensive and slow.
cool, next up is a way to tweak the speech API to recognize patterns in stocks and capex .. wasn't that what Renaissance Technologies did ?

really GooG should democratize quant stuff next .. diy hedge fund algos.
Over the past decade and change, the story of entrepreneurship has been conflated with the story of the capital-S Startup. You know, the one that goes for VC dollars, launches itself at "the moon" (if not some equally recognizable celestial landmark), and belts out the heroic hymn of unbound (and unbounded) ambition.

Patrick's writing and experience have offered us a refreshing counterpoint to that narrative. I don't know if Patrick set out specifically to provide that counterpoint, or to be a poster child for small software business in general. Regardless, he's kinda sorta become one. Which is cool. He reminds us that there is an interesting, livable life to be had running one's own business(es) and not grooming oneself for unicorndom.

It also helps that he's contributed sensible, detailed, thoughtful, honest commentary throughout his tenure in this community -- be it about BCC in particular, or about any other topic he comes across.

Finally, he's been at this slowly and steadily over the course of however many years. That authenticity contrasts very starkly to, e.g., the legions of folks who pop into HN every so often for the explicit purpose of marketing themselves. Patrick's HN fame is a side effect of his contribution to this community, and not the result of some calculated campaign to achieve it. That's awesome for Patrick, and Patrick's presence has been awesome for HN.

I'll stop now, as this was not meant to be a hagiography. I don't know Patrick from Adam. For all I know, he once refused to help an old lady cross the street. Maybe he grabbed an extra slice of pizza from the high school cafeteria once when no one was looking. Who knows. But from what I can tell of him, he seems like a stand-up guy. :)
I didn't know premii had other 'backends'... life: changed.
it's a module with exactly one dependent module -- by the same author. Daily WTF material but who cares beyond that?
A few months ago I ate kumquats for the first time in my life (weird, but delicious). Before that I only knew the fruit from playing this game when I was young! (not a very common fruit in the Netherlands).

I had not expected them to be like tiny oranges/tangerines you can eat with peel and all. From the graphics in the game (IIRC basically yellow circles) I always assumed they might some kind of small peaches or you know, yellow cherries ... :)
Shypmate (W16): http://techcrunch.com/2016/01/28/shypmate-pays-travelers-to-...
Exactly. This is how sales staff are motivated in all other industries where tipping is not the norm.
This is a non-issue and taking focus away from the real issue. The issue is the security hole that NPM opens up when a namespace can be grabbed up by anyone if the original developer pulls out.
JavaScript much to my dismay has no sprintf. It's one of the most annoying omissions ever for server side work.
"This isn't your average everyday darkness.... this is Advanced Darkness." - S. Squarepants