skysight-inc/HackerNews huggingface dataset:
> iOS uses capsiculum to isolate applications while Android uses SELinux. They aren't executing each others' code.

XSS isn't about executing other people's code, it is about performing commands that you shouldn't be performing. There are a ton of instances in the pass where cross application communications have lead to privilege escalation in the same way that XSS does.
Within a month? Wasn't it a simultaneous launch?
There are people out there who are either going back to flip phones or getting rid of their phones entirely. I chose to go to a Nexus 5X instead, but I feel people wanting to simplify their lives and focus on things that matter to them more with fewer distractions.
Thanks, this seems like a good upgrade route from my current Avoton-based FreeNAS (8 cores, fanless, 2.4ghz, 64GB of ECC DDR3, 16 PCI-E v2 lanes, VT-x) http://ark.intel.com/m/products/77987/Intel-Atom-Processor-C...

Asrock Rack made some nice boards with onboard IPMI, dual Intel gigabit NICs, and 8x SATA. Kind of pricey but still under $500 for the board back in 2013. Been a great board: http://www.asrockrack.com/general/productdetail.asp?Model=C2...

Here's their Xeon D stuff: http://www.asrockrack.com/general/products.asp#Server

Denverton is the successor to Avoton; 16 cores, 16 lanes of PCI-E v3, 10GbE, DDR4: http://www.fudzilla.com/news/processors/39156-intel-s-denver...

Haven't heard anything about it for months, though.
here is the source for that npm package

https://github.com/bytespider/average/blob/master/src/averag...

and here is the code copied out in full

module.exports = function average(values) {
for (var i = 0, sum = 0; i < values.length; ++i) {
sum += values[i];
}
return sum / values.length;
};

is this worth adding a dependency to your build for?
great idea! now i can find some other left-pad function!
I fell for it...I figured the graph was just an illustration to give a general idea of what the data looked like, not the actual graph itself.
I agree with you, but s..t happens.
Also, can someone tell iOS libraries to stop relying on Cocoapods? After the github disaster, it should be standard to bundle dependencies.
Looking at the changelog, there have been more than 70 versions of Lodash in less than four years. The first was in April 2012. [1]

_.padleft

does not exist. It was added as part of version 3.0.0 January 26, last year and renamed to _.padstart in Version 4.0 on January 12, this year.

So in less than a year "padleft" came and went away because all strings don't start on the left and someone decided that "left" means "start" except that the reason that it doesn't is the reason that it was changed. Even worse, the 4.0 documentation does not document that _.padstart renamed _.padleft. It's hard to grok what cannot be grepped.

Why blame someone for depending on padleft in a world where libraries swap out abstractions in less than a year? Breaking changes are bad for other people. Semantic versioning doesn't change that.

[1]: https://github.com/lodash/lodash/wiki/Changelog
What I don't get about Left-Pad, shouldn't they have used Arrays.join for better perormance?
"There are no small parts, only small actors". - Constantin Stanislavski

If there's a flaw to this debacle, it's that packages can be un-published. That is some grade A+ BS.

But no, there is no such thing as a package too small. Coding is hard. Collaboration should be default-on, not default-off.
Reading it with Lynx also works
Yes that's exactly the kind of issues that I had experienced.
The original title is "Money talks: Linux Foundation pours funds into R language".

What is the Linux Foundation doing funding the R Consortium? R _can run on_ Linux, but it really has nothing directly to do with Linux per se.

And this isn't the first time I remember thinking, "What in the world is the Linux Foundation doing with _that_??" They're also funding the development of a real-time OS kernel for IoT devices.[1] Just feels like their mission is creeping, creeping....

[1]: http://www.linuxfoundation.org/news-media/announcements/2016...
Digital Technologies Will Add Over $1 Trillion to the World’s Economy by 2020
Here's a juicy tidbit from the design documents for Star Raider 2:
"If a player if desperate and cannot return to Terra for lack of energy or time, he may be able to destroy the Planet Crusher by flying himself into the exhaust port and self­destructing his ship at the center of the battlestar. This would give the player points for saving the Federation but not for returning alive."
This sounds like a symptom of an inadequate standard library. I do expect to be able to call "average" on a list of numbers without writing it myself, but I expect that to be part of the language not a 3rd party package.
But Kik Interactive wouldn't have taken them to court over this. It's a 100-person company. No one has the time, or the motivation to go on a tangent like that. Especially since they'll be paying hundreds or low-thousands in lawyer fees just to file.

npm dun goofed.
Reminds me of Nathan Marz's great piece about lessons learnt from creating, and maintaining Storm as OSS: http://nathanmarz.com/blog/history-of-apache-storm-and-lesso...
> But... (maybe I'm reading this wrong) what, exactly, is problematic with NPM?

I think the problem is that people should not (except in rare circumstances) be able to just remove packages. They should be immutable and have versions associated with them so that your builds are reproducible.

Sure I think that in some cases you should be able to have them removed like if there is a security vulnerability or something but I don't think some guy being upset should be sufficient.
This shows the beauty and success of npm in making it very easy and cheap to publish small modules.

It's not that we can't write a left pad function ourselves. It's that we might easily miss an edge case or make a mistake in doing so.

The author seems to be hung up on a preconceived idea of what a package "should" be without actually offering a compelling argument for why a single short function can't be a module.

Yes, every dependency you introduce is a liability. But so is every line of code you write. I'd much rather take the risk on a shared library which can be audited and battle tested by the entire community.

If a function is so easy to write, it's trivial to check out the module's code, review it does the right thing, and then lock the dependency.
This post is too dismissive and confuses some topics.

"Packages", "modules", "functions", and other words can mean different things within different contexts. Well-known and tested functions are useful. Putting them in a "package" is just a consequence of how node/npm work. There should certainly be a much, much better implementation of code sharing, but sharing and using well-known, singular functions should be exactly what we are going for.
I heard of zsh back around 2012, lots of colleagues who I respected very highly were using it. But I just never could get behind the idea of using someone else's defaults. Even when I switched to Emacs, I hand-picked every line in my configs from looking at a bunch of people's configs and with a lot of random googling to solve things. Even though it took like 2 weeks of constant tweaking to get just right, I haven't touched it much in like the past 3 years or so, and I've been super productive ever since. So meh, seems to have worked out for me. But YMMV. Also, I use eshell (with some tweaks) almost exclusively now, as opposed to a "real" terminal with bash or fish or zsh (etc.)
This is more a reflection of how bad the JS language is than anything. Real programming languages have means of standardizing the most common UX and simple patterns into a standard library. Javascript is a consortium hell that never gets updated sufficiently, and has no good standard library, so NPM basically replaces the standard library with a thousand micropackages.
Link text says "Extroversion and introversion" but links to wiki page for "Extraversion and introversion" (the correct spelling).
Thirty years of C obviously has fixed the mindset of many developers so much that they don't even want to think in different ways :-(
Yeah, I think the takeaway here is something like: "find the right middle ground between reinventing the wheel and dependency hell"
You're absolutely correct. I participated in the above conversation because it's interesting, but you're right that it's missing the point. The original blog post is really thoughtful. I enjoyed it.
No, this is again completely incorrect. This had nothing whatsoever to do with the C standard. This is Valgrind's issue. Valgrind does not care about what the C standard says. Valgrind is a bug-finding tool and as such can make its own rules.

Once again, if the C standard were to change to allow uninitialized variables to have live ranges, Valgrind would not just "git rm -rf memcheck; git commit". That is because Valgrind is a tool that is designed to check for uninitialized memory. It did its job properly. It is not designed to check for undefined behavior according to the C standard.

You seem to be determined to lay the blame for every problem at some combination of C compiler authors and C spec writers, regardless of whether the problem actually is theirs.
* https://www.washingtonpost.com/news/wonk/wp/2016/02/18/i-dar...

* https://www.washingtonpost.com/posteverything/wp/2015/01/21/...

* http://www.slate.com/articles/business/moneybox/2013/07/abol...

* http://www.esquire.com/food-drink/restaurants/a23132/why-tip...

* http://www.wagehourlitigation.com/files/2015/10/cornell.pdf

* https://news.ncsu.edu/2012/04/wms-rusche-restaurants/

* http://viewfromthewing.boardingarea.com/2016/02/19/45436/

* http://business.time.com/2013/11/18/worst-restaurant-custome...

* http://www.npr.org/templates/story/story.php?storyId=1329241

* http://www.tippingresearch.com/uploads/JFSBR_race_revision_a...

This is not (just) my opinion.
Studies to back it up: http://www.tippingresearch.com/uploads/customer_racial_discr...
The choice quote is here --

"In the end, we all converged on the same opinion: that LambdaConf should focus on the behavior of attendees, rather than their belief systems."

What you believe in, in everyday society, shouldn't matter either. It is how you treat others and if you do so with politeness and respect, you should expect the same in return.
If they were really paranoid they could build a new Xserve powered by an offshoot of their A series ARM chips. To help defray costs, they could actually sell the thing.
So I don't think this is an example of core team members who don't know what you're doing.

This function repeats a string up to a certain length. e.g.

repeatString(foo, 10) = foofoofoof

This could entirely be what the developers needed in their code base.

The fact that it doesn't repeat a string N times, is at best, an example of bad naming.

The issue here is that someone unrelated to the core team grepped the node codebase for the term they wanted and threw a function up as a SO answer without understanding what it did.
I can't speak for him, but upgrading really old Rails apps can get complicated very quickly. Especially when you're going across multiple major versions and have to deal with significant changes in Rails behavior and broken gems. "Rebuild" might not be the most accurate way to describe the slow, steady incremental approach you're forced to take (you aren't redoing huge swaths of your domain logic, for instance), but it gets the gist across.

The same goes for almost any legacy app.
Eh, to date, a large part of the JS community still recommends including .js files in script tags in HTML. So, while this has been possible for a while, there hasn't been widespread adoption.
my complete shock that anything in this article is unknown to all is inversely proportional to my programming abilities.
I'm commenting on this old link here because my comments for it on Reddit r/programming haven't passed moderation. You can see my history of comments at https://www.reddit.com/user/vorg -- not sure what they don't like. Here's the comment...

In questioning the Tiobe index, the article doesn't even mention fellow JVM language Groovy's suspicious behavior. Click on "Groovy" and you'll see the graph at http://www.tiobe.com/tiobe_index?page=Groovy which shows it rose from 0.33% to 1.8% in the last two months, and from 0.11% to 1.8% in the last 12 months -- both very fishy.

The graph shows these sudden peaks have happened before (Apr 2011, June 2012, Oct 2013) and are always followed by just-as-sudden falls. Check out the definition of the TIOBE ranking at http://www.tiobe.com/index.php/tiobe_index?page=programmingl... and you'll see Groovy's backer (the individual who privately owns the groovy-lang.org DNS domain) can game the ranking by "optimizing" any one of 23 of those 25 sites monitored. Groovy's long-term usual ranking for the last 10 years has been 0.1%.
Agreed as well. In fact, I would posit that this wasn't even really a problem until npm@3 came out and made installing dependencies far, far slower. Yet it was necessary; a standard project using babel + webpack installs nearly 300MB (!!!) of dependencies under npm@2, and about 120MB under npm@3. Both are unacceptable, but at least npm3 helps.

I want to plug ied (https://github.com/alexanderGugel/ied) here, which both installs about 5x faster than npm@2, yet deduplicates as well as npm@3.
Is it really a good idea to use RAID 5 on a database? If the database is large enough rebuild time can be more lengthy than a straight restore and under many RAID 5 setups you have the added problem of slower write performance.
To an extent, at least, it's not so ridiculous as your "logical conclusion", at least not based on current US tipping etiquette.

For one, 10% on $15786 is a little silly, sure. But current etiquette already recommends flat rates for certain types of services so this could logically be extended to certain other cases.

And secondly, even brought to the logical conclusion, extending tipping would only make sense where it could reinforce proper incentives and would be actively bad where it reinforces perverse incentives. A legal avenue for bribing cops is certainly problematic in a way that bribing waiters for better service isn't, for example.

That's not to say I'm arguing in favour of tipping but I don't think it's as clearly unreasonably as your example would suggest.
A version can't be republished.
I somewhat agree with you about its specs, However when it came out of the box it was a smooth and snappy tablet.
you missed the biggest one:

browserify 2,218,006 downloads in the last month

But my prediction is Rollup will take off in a big way at some point in the next 2 years. It's not quite stable enough yet, but it's just fundamentally better designed than everything else. Rollup is the only tool I'm aware of that properly exploits static analysis of ES6 module syntax. Every other bundler is full of hacks and moving parts, Rollup's codebase is clean and beautiful. It's already very good for bundling ES6 modular code, it's just still got some kinks when it comes to integrating people's CommonJS code. And I guess not enough people are actually using module syntax yet for Rollup to come into its own, which is a chicken and egg problem. It will get there though.

Until Rollup is stable enough, I recommend Browserify. In my opinion Webpack and JSPM both try to do too much and are too prescriptive about workflow. My team switched from Browserify to Webpack a few months ago, and I now find it a bit suffocating and slow.
Yes I agree, yours is a very good summary of the main alternatives at play. They all have pros and cons as you have rightly noted.
Patrick struggles with money? What's your source for that? Last I recall he was writing about how he did consulting gigs making tens of thousands of dollars a week.
Mycroft
https://mycroft.ai/
910 contributors, 191 issues, 516 pull requests, and his response is that "reviewing and approving pull requests is a nice-to-happen versus a need-to-happen." While I'm glad I am not in the position of maintaining that (or anything else important), that doesn't really speak well to the long-term prospects for the project. Clearly this is something that I and many others find very useful; It would be a shame to let it stagnate. The glib part of me would suggest either 'stepping up, or stepping down', but I can't really credibly offer solutions, I just am trying to point out a problem.
Allocate and join an array of blanks just to repeat a string is acceptable?!
> Removing tipping removes a fundamentally personal element from the service economy.

What is the nature of this "personal element" exactly[1]? All I expect from a waiter is that they bring what I actually ordered, and bring them hot.

[1] incidentally user Laaw posted the racial angle here: https://news.ycombinator.com/item?id=11349092
That sounds like my experience with it from about 5 years ago or so. I gave up on it also. It also didn't help that CMUSphinx has had more than one version in development in different languages.
Businesses love it because every major release is like Ubuntu's LTS releases. RHEL 4 (released in 2004) is still in extended support!

I assume their support is good also, but I haven't used that.

For me though, I have a bunch of servers running CentOS just because it's extremely solid and stable. The price you pay is that all your packages are a little old, but there are repos to get new software, so I can be on the newest Postgres and Node etc.
I agree with you to some extent. I universally tip well (my baseline is at least 25% largely regardless of the circumstances) and I am rewarded because of it due to preferential service. If service in a given situation is objectively terrible, I'll cut that down to 15%, but the service must be absolutely terrible for me to do that (rude and intentionally unhelpful).

I will never tip 0% because I have worked in the service industry

I tip well because I know that I make ~3-7x what the people in the service industry are making annually and I feel obligated to share the wealth.
So what? How do you know Dell/HP/Whoever has not been forced by NSL letters to implement backdoors.
American Bars Apps Released
Check out the best new bar apps:

iOS: https://itunes.apple.com/in/app/american-bars/id1090377977?mt=8

Droid: https://play.google.com/store/apps/details?id=com.spaculus.americanbars&hl=en
I'm reading many libraries here, I wonder what's the best open and multi platform software for spech recognition to code with vim, Atom etc. I only saw a hybrid system working with dragon + Python on Windows. I would like to train/ customize my own system since I'm starting to have pain in tendons, and wrists. Do you think this Google Api can make it? Not being local looks like a limiting factor for speed, lag.
With Android you have a choice to buy devices with unlockable bootloader so you can get root without looking for on exploit. On iOS you have none such.

And the fact that every iOS version ever has been jailbroken only tells you how hard security is... specially against an adversary with full physical access to the device.
Sounds like the author was aiming for something to put on his resume: e.g., "Author of 25 libraries on NPM, some with more than 500K downloads." etc...
Close.io Is Hiring a Customer Success Manager (Remote)
At Close.io we’re building the sales communication platform of the future. We’ve built a next-generation CRM that eliminates manual data entry and helps sales teams close more deals. We’re looking to hire our first experienced Customer Success Manager to service our rapidly expanding customer base.

The Customer Success Manager (CSM) has dual responsibilities. On-boarding larger customers to help them set up for success, and building relationships with our existing customers to deepen the relationship and increase the value they get from our service. Must have previous SaaS experience.

Learn more about the role here!: https://jobs.lever.co/close.io/0cdc3c8a-e81d-48c3-aa57-5bbf2...
Every once in a while, I come to HN, and inevitably find a post about some new JavaScript technology on the front page, wherein I find some comment that gives me a new appreciation for the web app language I use at work, which fortunately is not JavaScript.
The funniest thing about this entire debacle is the thousand of self-assured programmers coming out to show the JS/NPM world how it's done, only to have their short, simple, no-nonsense functions fail miserably on some edge cases they didn't think about.

This discussion about the "isarray" package is probably my favorite: https://www.reddit.com/r/programming/comments/4bjss2/an_11_l...
NLP libraries process written text.
This new API processes speech and extracts text from it.
I'm not sure whether or not it would have been a good movie, and its deviations from the source material would surely have driven me up a wall, but there we parts of that documentary that gave me goosebumps.

Absolutely recommended to watch.
You could always fork it. It is MIT licensed after all.

Personally, I just built my own zsh config that solves my problems without all the framework mess. Its less than 150 lines + some related dot files for aliases, vim, etc.
Sounds like he needs some help. Maybe a linux kernel model is more apt? Have a few people helping and looking at PRs and approving them in just the areas that they are experts in.
Let's fix NPM with IPM – Immutable Package Manager
Perhaps neither here nor there, but an often overlooked feature of boto (the official python AWS client) is that you can create an SSH client to an instance:

http://boto.cloudhackers.com/en/latest/ref/manage.html#boto....

given that you have an EC2 `Instance` object, which can be hydrated in a variety of ways.

Edit: Wow, a lot of you have built or found ssh-to-ec2 clients.
> Why would I implement left-pad myself when there is already a well-tested implementation that I can install?

You call 4 basic assertions "well-tested"?

https://github.com/azer/left-pad/blob/master/test.js
I would say that Google's main goal here is in expanding their training data set, as opposed to creating a new revenue stream. If it hurts competitors (e.g. Nuance) that might only be a side-effect of that main objective, and likely they will not aim to hurt the competition intentionally.

As others here have pointed out, the value now for GOOG is in building the best training data-set in the business, as opposed to just racing to find the best algorithm.
How Nike Lost Stephen Curry to Under Armour
I think the scarier thing there is this line: "0.0.1 is the latest of 2 releases"

I wonder if there will be a 3rd release with an updated averaging function.

Edit: to be fair, it was an optimization from reduce to for loop [https://github.com/bytespider/average/commit/7d1e2baa8b8304d...]
>> I’m talking about stuff that QA should have caught, stuff that if anybody at Apple was actually building ? apps this way would have noticed before they released.

> A: They do pass QA, that's why features are removed

Even if QA catches stuff, it frequently gets ignored by developers and product managers who don't want anything holding up the ship date.

If the software gets frequent updates, this becomes the norm. Bug fixes come in future development cycles, not when they are found.

QA is the least powerful group in any software engineering setup so it's amusing that consumers think of them as God-like powerful creatures who can hold up releases.
I think what sets Red Hat apart from companies like Microsoft, Google, Apple, etc. is that those do have a lot of open source code, and it's an important piece of their strategy, but their most critical code is not open source. And not just the most critical code, but most of their code is not open source.

Open sourcing some strategic things makes sense for them. But for Red Hat, open source itself is the core strategy, and they open source everything.