skysight-inc/HackerNews huggingface dataset:
The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish.

Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with 2.5M/month), meaning a malicious actor could publish a new patch version bump (for every major and minor version combination) of these libs and ship whatever they want to future npm builds. Because most package.json configs use the "^1.0.1" caret convention (and npm --save defaults to this mode), the vast majority of future installs could grab the malicious version.

@seldo Is there a plan to address this? If I'm understanding this right, it seems pretty scary :|

[1] https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...
Did they? Most open source licenses aren't revokable - you don't have to stop distributing the code just because the author asks you to stop. That seems especially true in this case, considering the author chose[1] to license left-pad under the WTFPL[2]. I'd say re-publishing the package counts as NPM doing "whatever the f* they want" with the code.

[1] https://github.com/azer/left-pad/blob/master/package.json

[2] http://www.wtfpl.net/txt/copying/
There are two ways to bypass CloudFlare and related services.
1) Most of the time, as Kephael said, websites expose their back end IPs through subdomains like ssh.domain.com or ftp.domain.com. MX records also sometimes function in the same way. There are a variety of ways to resolve a domain through CloudFlare.
2) CloudFlare bypass scripts can be bought for around $400 which manipulate the JavaScript per client when sending an attack (mainly by disabling JavaScript). This prevents the so called "challenge pages" from blocking malicious traffic, effectively slipping through CloudFlare protection. Most of these scripts work on most other providers such as Sucuri as well.
The proliferation of female contraceptives is something we can all get behind (no pun intended).

Joking aside, I think this paves the way for legitimate, regulated drug delivery; which itself may create a more favorable environment for the legalization of recreational drugs.
A-Rod is dating Anne Wojcicki
Well, if Hershey bars lose a few grams as a stealth price increase at one store, they're going to lose them at every store. What you're talking about is orthogonal to what I'm talking about.
> Newegg seems to be switching to offence and has carefully chosen its moment.

This isn't offense; offense in patents would be asserting Newegg's own patents against others. This is defense, just defense of others.
Sure, unless the hotel at his end is in a "dry" location.
https://en.wikipedia.org/wiki/Unix_philosophy
The problem is iCloud Backup -- it really should work in a way which doesn't give Apple unlimited access. Yet, allow restore onto new devices, without requiring users memorize long passwords, and without a bunch of confusing options or steps for most users.

It's a fairly hard problem to do very well. What they do today isn't particularly close to "very well", so even some easy improvements could make it a lot better.
And I think you missed the point of my response. I chose a admittedly drastic picture to get across the point about causing collateral damage.
> Edit: Meanwhile the "PC" category became largely irrelevant. That's what Intel missed

That's a ridiculous claim. 2015 shipments of 288.7 million units (Gartner) may be down but they're still huge: that's 791,000 per day. And sales of Windows tablets and 2-in-1s are growing very rapidly.

Are tablet sales "largely irrelevant" because they're lower than PC sales (206.8 million, says IDC), and even if you include tablet PCs running Windows, declining even faster? https://www.idc.com/getdoc.jsp?containerId=prUS40990116
Gotta say, this is one of the most frustrating parts of using Tor.

For fun, I decided to try it out a few months ago after reading a few articles. Nearly every single site I went to visit required me to click on pictures of lakes, store fronts, street signs, street names and such. Often times after selecting an item, another would appear below it. This would repeat at least twice, but in some cases I received as many as 4. Not once did I receive a simple, single image CAPTCHA. All were multiple image based adding minutes to the time it took to get to a site on an already quite slow Tor connection. Visit a site that references images on an address different from the one you're visiting and they all fail to load resulting in pages that render terribly. Worse, it's not obvious why it's happening until you attempt to pull one of those images up by URL where you're provided another CAPTCHA to answer. Finally, the page renders as expected.

That was frustrating. I was unconcerned with my own privacy since I was using it for fun, so I enabled all of the script options and decided to do a Google search. They at least provided a single image CAPTCHA which would have been fine if it ever went away. I entered the correct value for the wavy text ten times before giving up.

I feel awful for those using Tor to bypass censorship. Instead of just being saddled with a moderately slower browsing experience, they're encumbered by a mess of other hurdles. It's a shame but I can't say that I'm sure what alternatives exist for protecting sites from bad actors that use Tor to hide attacks.
> So is the problem with fexprs the fact that subexpr elimination can't happen because you don't know what will be a fexpr at optimization time?

That's part of it. But the bigger issue is, I think, that you can't even generally compile[0] the arguments before runtime, because you don't necessarily know what expressions they'll be by the time they get evaluated.

> Because if it's just that, then why can't a fexpr just be an ordinary function whose canonical name is actually a macro that `quote`s its arguments?

That's exactly what they are, along with the environment at the call site. Then, when (and if) you need the arguments to be evaluated, you do it explicitly with a call to `eval`. But keep in mind that the fexpr body is free to modify those arguments as data before evaluating them.

> Or you could just `quote` the call yourself, like TCLers do.

Tcl is similarly a very difficult language to compile and/or optimize.

[0]: I mean ahead-of-time compilation here. I don't see any reason why a JIT compiler couldn't be effective.
And I think we can attribute that to the strategy Kraft used to specifically avoid what happened to Coke. What if Kraft had made the change and announced it?
The law (case law) says more than zero about this. https://en.wikipedia.org/wiki/Clean_room_design#Case_law
Question: if it means something other than NPE, then what vague definition of "abuse" should we be relying on? Because if a company is making a patented product, and someone infringes that patent, and the company sues them... and THAT'S patent trolling, then literally anything can count as patent trolling.

No. Words have meaning. Stop trying to pervert their meanings for effect.
> To prepare, Mr. Hallock, 29, spends an hour or two a day at his business, TopFloorStudio in Asheville, N.C., tracking venture capitalists and start-up news,

s/.*/He reads Hacker News/
Original credit goes to the hovertext of https://xkcd.com/1185/, I believe.
That's exactly what I said.
One of their posters seems perfectly apropos here (quoting from memory because their web site seems to be dead): "If all it takes to motivate you is a cute poster, you must have a really easy job. The kind robots will be doing soon."
You'd probably have more luck figuring out what dark matter is.
Death is irreversible. Imprisonment is not. Unfortunately, US criminal system routinely imprisons innocents (and in other countries I'm sure it is not much different). E.g. check out Innocence Project[1]. Criminal justice system is rife with errors, malfunctions and abuse. For imprisonment and fines, one can at least fix an error after the fact. One does not get back years spent in prison, but at least they can get free and maybe also compensated for it somehow. But if the person is dead, you can not fix it.

I was for a long time of the opinion that there are crimes deserving death penalty, and I still kind of think so. But - I am no longer sure the US government, and most of other governments, can be trusted with this power. They are too broken and dysfunctional to be able to wield it justly. As such, it is better to not have it at all.

[1] https://en.wikipedia.org/wiki/Innocence_Project
1mA/MIPS is a pretty generous power budget, with ESP8266 easily fitting the bill (56mA @80MHz + wifi rx; 10 uA in deep sleep [1]). Talking of which - here is Jeroen Domburg's project where he used exactly this chip to make a wireless battery-powered e-ink display:

[0] http://spritesmods.com/?art=einkdisplay

[1] http://bbs.espressif.com/viewtopic.php?t=133
> A short story placed in the 'near future' where people receive emails from lawyers about copyright infringement where settlement of a few cents is offered and can be paid right from the email.

I've read that story and think it was by either Cory Doctorow or Charles Stross.

There is automated high-volume litigation as a plot point in Stross's Accelerando, but I think that's not the story that you're thinking of.

http://www.antipope.org/charlie/blog-static/fiction/accelera...

I think the one you're thinking of features a little girl being sued for benefiting from colonial-era crimes in the Belgian Congo (among other micro-lawsuits).
Didn't NPM break builds by completely swapping out the contents of a known module?

Obviously NPM should not be relied on, but this really makes the case.

NPM will arbitrarily modify packages without notice -- this could be the unwinding of NPM.
This is a trademark dispute, not a copyright dispute. (And since Kik the company doesn't market a product in the field of command-line programmer tools, whether they have a legitimate case is arguable.)

There are other distribution architectures, both organizational and technical, which would be more resistant to IP claims, especially frivolous ones.
That's not how it works. You can't publish left-pad 0.0.3 again.
Its a problem yes, but the nature of javascript makes this a difficult problem to address. Node tried addressing this with the 'domain' module to help with propagating errors upward more generically:

https://nodejs.org/api/domain.html

But it was deprecated:
https://github.com/nodejs/node/issues/66

promises are a very nice way of drying out error handling and cleaning up callbacks for now.
Should one not be able to unpublish? What if there's a bug in a released version, and it's going to take a while to fix? Or what if you simply no longer wish to be associated with the organization anymore?
Highschool Poetry
I think I would love to use this, but since my computer has memory problems, this causes Trello to be even heavier than it already is -- because it has more cards now.
Small modules they say. Small standard lib is ok they say. Just going to point out that in a lot of other languages, string padding is just built into the standard lib.
Are you A/B testing properly? 10 questions to ask yourself to find out
As long as the market > 1, you can always fire a customer.
Barring an outbreak of hysteria about this device in your home that's basically capable of listening to everything you say....
http://conda.pydata.org/docs/using/envs.html

Glad to help :)
If the kik in question is kik.com then

>Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences that can be discovered and instantly shared by Kik's 240 million users.

Rather sounds like a valid use of the law, not necessarily nice but valid. They are in the same space, open source web development.
"The secret to dealing with internet trolling is some combination of ignoring it, turning your devices off now and then, and realizing that the character you are interacting with online is not actually a real person."

No. Gamergate has proven that "ignoring it" and "turning your devices off" is NOT the way to fix it. Neither of those things does anything.
Pardon my ignorance, but what was the matter? I loved Broken Age. I wasn't in the kickstarter, but I just bought it in the App Store (well, actually my wife did) and loved it.
I bought an apple IIe for nostalgia and one of the first things I did was hook up a null modem cable to the serial card and make it a linux terminal. I was able to use google via elinks. My kids love the various games like ultima because it's like minecraft (blocky) but you can't build in it.
2PP (the guys that made the Broken Age doc) have also made a "making of" featurette for the DOTT remaster: https://www.youtube.com/watch?v=LjF4eMrYfG0

It's pretty great - showing everything from how all the artwork was redrawn, to the remastered audio (pulled from the original DAT recordings), to Peter Chan's remarkable concept art. (which is included in the game!)

I have the original game packed away somewhere, and I'm sure that I could run a copy on scummvm, but for me, paying $15 to support the kind of care and attention that went into this remaster is a no-brainer.
Canada Tech Startups Winners as Morneau Backs Off Options Plan
Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long?

A bit of code duplication would go a long way towards bringing sanity to JS land.
brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder).

To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?!

And please, why isn't essential stuff like this in the JS standard string library?
Hyperbolic analogies don't prove points though.
Yes, I was rather neutral at first, but this is a complete dick move on NPM's behalf. Essentially they've just given the module to another owner.
Unless you're npm: https://twitter.com/seldo/status/712414400808755200
Apple can just buy stuff. It bought Siri, after all.
It's not a criticism, it's just an observation.
> In practice, that undergrad research is mostly for biomedical wet lab research ... ?

Why would you assume I would bring up wet lab work in the context of mathematics? https://sites.google.com/site/mathreuprograms/

Here's a 20-year-old 20-year retrospective: http://www.d.umn.edu/~jgallian/tanglewood.html
Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version.

EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor versions, which would have the more loose caret range behavior.
> if you simply no longer wish to be associated
> with the organization anymore?

Given that it's open source, (specifically WTFPL in this case), that's not something you can actually. Or rather, it _is_ okay for npm to republish stuff: that's part of the license.
I’ve Just Liberated My Modules [by Removing Them from NPM]
Personally i'm going to use an installable module for something even that small, because i can, and it works.

The benefits from an install registry don't go away just because the module is very tiny...

Why would i spend my time re-inventing the wheel for every little thing i do? And if i'm not reinventing, then i'd be copy/pasting which is much worse. At best that's a waste of time and effort to properly document the source, and at worst it's stealing or license violations.

I don't care if a module is a single line, if it does what i need it to and is well tested, then i'll use it. That might seem silly, but the fact is that it's pretty much no overhead, and no software is immune from bugs (even a 16 line function), so updates might be useful in the future.

Yeah, there is a chance that stuff like this can happen, but within an hour there were several alternatives to solve issues with installs, i'd say the system is working pretty well. Plus with proper software development techniques (like vendoring your dependencies) this wouldn't even be a problem at all.
By choosing to publish his work as open source, he made it possible for npm to do this. One of the great things about open source licenses if that the original author decides to remove their work (regardless of whether on valid grounds or not), the community can still access it.

If he wanted the ability to prevent who is able to reuse and distributed his code, a proprietary license would have been a more suitable choice.
https://twitter.com/seldo/status/712414400808755200

Just in case anyone was wondering why a large number of NPM-based builds broke today.
That might be what cautious scientists have been saying, but that's way too complex for a party line. To rephrase my original question, since when haven't (according to news organizations) scientists been warning about perilous climate change within the span of decades?
> Developers: less dependencies is better, especially when they're so simple!

No! The opposite of that. Lots of little µframeworks, defining composable and generic types, is much better than a giant monolith.

The Swift Package Manager is taking this approach, and I think it's great: https://github.com/apple/swift-package-manager#modules

The caret character doesn't appear anywhere in the semver spec, so whatever that does, it's non-standard: http://semver.org/

If your modules are small and well-defined, they probably won't need many versions anyways - they might just stay on 1.0.x forever. If you want to do something different, it might make more sense to just write another module.
With portable software (as in, portability is more valuable than other factors), imperfect is the enemy. ;-)
rlimit ftw
A company like this that manages to produce a supersonic flying scale model will probably have access to the capital required for those later steps.
If you ask me, I'd bet that it's because the brand behind the 'concerned' trademark is up to something and they are just doing their homework.
Paste the code into here if you’re having trouble following:
http://coffeescript.org/#try:%7BliftAll%7D%20%3D%20require%2...
Just because they've trademarked "kik" doesn't give them complete control over all instances of that 3 letter string in the world. See the 8 factors of trademark infringement, and trademark law in general; this is just a kik lawyer being threat happy.
I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive dependency resolution is nice and all but isn't this going to create a massive technological debt that needs to be maintained? Semver is not a magic bullet.

Also, seems like a security disaster waiting to happen (I don't use CDN because I like to make sure I review code before putting it on my important websites). Linux distributions like Debian have put in huge effort into making a packaging system that is secure and doesn't lead to dependency hell. You can argue how successful they have been but, and maybe I'm ignorant, I don't see the same effort and level of maturity in the Javascript/npm ecosystem.

As an alternative to React, I'm looking at Mithril. It's relatively small and has no dependencies. I'm quite a bit more comfortable building on that foundation as opposed to a giant house of cards.
Quite a bit are pretty small.
Meet the Online Hair-Care Millionaire
I want one of those monitors so bad. Why does it have to be $1000?! Anyone willing to contribute to my Indiegogo campaign? ;)
Having no understanding of the broader js context I assumed the comment to mean "all library dependencies should be checked in, build tools should be defined & specified & able to fully recreate the build given they are installed".

For the record this is a well known & frequently advocated for build pattern.
If you delete a module, the name becomes free. Someone else grabbed it and publishing code he has a license to redistribute under it. NPM is "only" fudging with the version number, the author gave the module away.
Nope, nothing wrong. The code he wrote is his, but he doesn't own the npm namespace, which is all anyone cares about here at this point.

But you know what also _feels_ wrong? people who had no involvement in this at all having their day get fucked up because of this one dude who _suddenly_, just now realized that npm isn't going to really help him out and did the internet equivalent of taking your ball and going home.
I really don't get why Americans are so drawn to such a nasty processed food. Italians must cringe at the sight of such an abomination.
For example: http://www.scs.stanford.edu/histar/src/pkg/echo/echo.c
> I've been thinking of getting a PhD in an engineering sub-discipline, but not sure how to go about doing it especially since I have no research experience. .... (I live close to a major research university)

If you know the discipline you want to study, email someone like the Director of Graduate Studies in the department in question. If you don't know the discipline, email someone in either the Graduate School or the College of Engineering, or both, depending on how you school's organized.
I can't help but think about waste of power and radiation of CRT. Green movement poisoned us for life.
If that was his goal, to make noise, then that was a pretty "destructive" way to spark a discussion.
Logging client web app activities to a remote server (Microservices)
Hi Guys

I have a JS web app. I would like to create a snippet to log various event/interaction from user within the app (kind of google analytics but custom made for various interaction). I was thinking to build a node.js API server to catch all those events and a JS tag to send those events. I google to search if any microservice is already available for such use case but i could not find any. I just found an example of server build with node.js and socket.io. However socket.io is not compatible in all browser and I don't think i need socket.io for just sending event (without sending back message to the web app).
Do you know any microservice available for such use case? Do you have any experience in similar setup? What would be your ideal architecture/technology for it?
Writing a 15 line function shouldn't grant someone the right to break an entire language ecosystem

I think the real issue though here is technical - does npm really allow mutation of published assets like this? That's a shitty situation that can only lead to unreliable builds
Imaginary Spaces: Es Devlin and the Psychology of the Stage
I have never heard the word "Waldeinsamkeit" before and I'm a German native speaker.
You must be really fun to be around.

Really, comparing this to mass murder, well done. It's more like he had a bunch of toys, someone stamped on one of them and he took the rest home with him whilst the other kids are still playing with them.

These are his repositories which he created, he is welcome to remove the code, and others are more than welcome to rehost (as they require).

If you are depending on npm (or any other build tool such as composer, whatever) or on Github, you really need to have a backup plan when the shit hits the fan.
What is the legal basis for the claim that NPM package names are somehow exempt from trademark and other law?
So what keeps Kik from going after Github?

https://github.com/starters/kik