skysight-inc/HackerNews huggingface dataset:
Three reasons we sometimes see GOST (there are probably lots more; these are just the ones I'm aware of):

* It's a block cipher with a large key that was well-known in the mid-90s, when TripleDES was the best-practice.

* Its big competitor for the time, IDEA, had IP issues, so if you were looking for "natively better than DES", you might land on GOST.

* Schneier wrote about it in Applied Cryptography (blech; spit).

I think similar logic applies to why we still see RC4; when it was finally revealed, after having been an RSA, Inc trade secret for years, it was the only regularly-available stream cipher with any kind of pedigree. Since 99 times out of 100 when you're encrypting data with a computer you're really asking for a stream cipher, RC4 got a lot of use.

Obviously: don't use GOST or RC4 or TripleDES or IDEA (or Blowfish).
Functions Are Not Packages

Cracked me up :D
In the case of left-pad, 2538464 of its 2550569 downloads last month are attributed to dependents of the line-numbers package (https://www.npmjs.com/package/line-numbers). So it would appear that relatively few people directly rely on left-pad, which highlights the importance of vetting the dependencies of dependencies.
> However, I agree it is ridiculous to have a dedicated module for that one function. For most nontrivial projects I just include lodash, which contains tons and tons of handy utility functions that save time and provide efficient, fast implementations of solutions for common tasks.

I think that was largely the OP's point tbh. Using something like lodash [a utility library] is fine while using a module [for a single function] is not.

It might have gotten lost in the ranting from on high but I don't think the author truly meant more than that.
If tipping was merely a bonus, it might be useful as a mechanism for rewarding extraordinary service. But tips are expected unless there is really terrible service. This is because it has been accepted that in some professions, workers rely on tips for their income to be reasonable for their work.
Good. Some use Linux, and barely contribute back. Getting RHEL subscription is a good way to do it, because RedHat does a lot of work on improving Linux.
It's disappointing though it didn't get the latest OS upgrade. One of the reasons I bought the Nexus 4 is the promise that it would get updates...
Uh, no Left Padding is NOT built-in in JavaScript. The proposal to add `String.prototype.padLeft()` was just added to ECMAScript 2016.

JavaScript had a very minimal standard library, it's pretty asinine of you to compare it to C or any other language with a pretty extensive standard library.
This is from a client-side web dev perspective:

I'm hoping that proper support for ES6 modules to enable tree-shaking bundle builds (in the short term), and HTTP2 with client support for modules (in the long term), will allow us to head towards a world where we converge around a handful of large utility libraries.

In theory, tiny dependencies was supposed to allow us to only include code we actually needed in our bundled code. Bu the reality is that everyone uses different tiny dependencies for solving the same problem. So you end up with enormous bundles made up of different solutions to the same tiny problems.
I see. Thank you, tptacek.

> People generate large primes using programs designed to do that

Do you mind to name one such program?
When I was prevented from upgrading Xcode/Swift for a project last year because of podfile dependencies, that cemented in my mind that every time I include a dependency, I'm putting myself at risk.

If I can spend half a day writing the code myself, I will -- because I know it will prevent headaches down the road. Yes, yes, I know any code I write adds the probability of bugs down the road. But at least the roadblock would be of my own doing, and not dependent on if/when the package maintainer upgrades their stuff.
At the risk of giving a serious answer when your phrasing makes it seem like you're trolling: No. The Cloud ML service is your data and your model and your training results (except as required for google computers to touch it to train it and store it - but the results of that training are yours.)

The same question was asked earlier of the Vision API, with the same answer: https://news.ycombinator.com/item?id=11128444

At a high level, you can think of it as having mostly the same properties as if you rented a bunch of GCE machines (or AWS machines) and ran TensorFlow on them, with your data stored in GCS (or S3 or whatever). The difference is that Cloud ML handles the scaling pain for you -- managing the machines, starting and keeping tasks running, load balancing, etc.

(disclaimer: I'm working on TensorFlow, not Cloud ML.)
One of the things I've enjoyed the most while programming in Go for the past couple years is the standard library and how much the Go community emphasizes keeping external dependencies to a minimum. For most projects I find myself using few if any external packages.

Now of course there are times you'll want to reach for a library, say for something like an http router, and up until recently the dependency management side of Go has been lacking. But when a pattern or library arises that many find useful the core team is open to pulling that in to the standard library if a strong enough case is made, for example in the context package (https://github.com/golang/go/issues/14660).
Not with the employer or manager, but with e.g. the busboy, dishie, line cook, cashier, etc. is allowed[0].

[0]: http://www.wigdorlaw.com/2014/04/07/unlawful-tip-pooling-und...
DPReview is hiring! (Software development manager)
I agree. But I find two problems with your proposal:

1- Maintaining a mirror of dependencies can be a non-trivial overhead. In this app that I was working on, the previous devs had forked some gems on github, and then added that specific github repo to the requirements. But they did not do it for every dependency, probably they did not have time/resources to do that.

2- As a corollary to the above, sometimes the problem is not the package itself but compatibility among packages. E.g. package A requires version <=2.5 of package B, but package C requires version >= 2.8 of package B. Now I hear you asking "then how did it compile in the frist place?" probably the requirement was for package A v.2.9 and package C latest version, so while A was frozen, C got updated. This kind of problems is not solved by forking on Github, unless you mantain a different fork of each library for each of your project, but that's even more problematic than maintaining dependencies themselves.

P.S. At least for once, it wasn't "my fault", I didn't build that app LOL ;-)
So this is like USAF's drone guys in mobile homes out in the Nevada desert? One notes that they don't handle aircraft with passengers either. Your idea isn't bad in general, and someday it will probably be accomplished in some form, but we're not anywhere close to that yet. Independent joint probabilities multiply, so the last thing a highly speculative aircraft needs is a highly speculative pilot arrangement.
I associate Kik with a textile discounter. Just because they are known by parts of the population and have copyrights in some countries, do they really have the right to claim their name pretty much everywhere?
Google Is Killing the Chrome App Launcher for Windows, Mac, and Linux
I wanted to say that it's built-in in pretty much every other language apart from JS
General stance on things. MS is anything but an open source company.
What I find interesting is that this article re-iterates that many times credit card processing fees have been entirely or partially subsidized out of the _tipped employee's tip_.

I was recently eating dinner at a French restaurant in Seattle that is working toward introducing a service charge (the current Seattle practice of a fixed service charge, vs raising prices, as consumers don't want to see a $40 steak frites on the menu before tax) and the owners were most concerned with how to fund the credit card fees, since they had not been doing this at all!

Talk about unfair to the workers...
Hedge fund manager attempts “reverse patent troll” strategy
Yes that was my case.
Thanks, those are better and the comment thread is really interesting.
Exactly!

How many machines have you purchased in your career? I've purchased THOUSANDS - which of these have been intercepted and compromised?

I have no clue.
This is awesome, thank you!
To me, this looks like a symptom not of bad programmers but of a terrible standard library.
Oh, that's not what I meant by `destroyed'. (And I think you knew.)
It is such an important lesson in life. Prepare yourself for the future. It doesn't mean you can't have things or do stuff. It just means be frugal, take a time out when you want to buy something. Most times you will forget about it. Watch your Bank/Investment account grow. It will make you much happier than the latest gadget or new car, etc. Invest in things that will protect you from inflation or will help you generate a passive income (rental home, Land, etc).

Wealth buys Freedom and will protect you in times of harm. I always try and tell people that less is more, save your money.
I dont understand tipping. Customers are already paying for the food and service. Why is there a need to tip?
Yeah, even though Iris is "good enough for light gaming", integrated still really lags behind dedicated GPUs in how smooth even a desktop experience is.
Well, anything that does RSA, right?

An easy way to do this yourself is to jump into a Ruby IRB and do "OpenSSL::BN.generate_prime(512).to_s".
You can select about 5 images and email them all at once.

You can also connect your device to your computer and download the images directly.

You can also share images over airdrop via bluetooth.
Yeah but you're loading an entire library to use one function?
This was probably grotesquely naive of me, but I literally had no idea how jenga-tower like the javascript ecosystem was. Eye opener!
Can you paste in the shell codes you use?
Wikipedia gives some information.

https://en.wikipedia.org/wiki/Primality_test

https://en.wikipedia.org/wiki/Fermat%27s_little_theorem#Gene...
I see what you mean, but uninstantiated also means unused. So we're not talking about anything that could possibly lead to runtime errors. It's not an issue with type safety.

It definitely has a downside for the development process, especially when it comes to writing libraries. But it is also to some degree inevitable if you want structural typing. Maybe there is a better way to do it though.
> if someones tips do not equal up to minimum wage the business will cover the shortfall, but if it exceeds it, the business only has to pay a special lower minimum and the server gets to keep the gratuities

Wow. Did not know this.
I don't speak with any authority on this. With word2vec you can do operations like king - man + woman and the nearest vector will be queen. Similarly capital cities will be in a similar relationship to their countries so if you take Rome - Italy + Spain you will be nearest to Madrid. That permits limited reasoning by analogy and there are some analogy benchmark tasks which those word models perform reasonably well on, effectively answering loads of questions like "Madrid is to Spain as Rome is to ____?".

This model is more complex and seems to be using a series of techniques to "disentangle" the parts of the network so it's better at separating identity, i.e. this is a white triangle, from the parts of the network concerning pose, i.e. it's rotated 20 degrees clockwise. See this paper[0] for definitions. So it can take an input triple and see what the transformation is that's been done to the first two images, and then apply that transformation, disentangled from the identity of the what the transformation was applied to, to a third image. The vector of the third image, with the transformation applied to it, is then visualised by the decoder network. So the key is to not just combine some vectors otherwise you'd end up with a mess, the key is to disentagle the identity so that the relevant part of the vector associated with the change, such as rotation, can be transferred.

I think the link between this kind of operation and word2vec is clearer in the paper Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks[1] (submitted for ICLR 2016 it seems[2]) which shows more explicitly the vectors being added and subtracted for images "smiling woman" - "neutral woman" + "neural man" = a series of generated images of a smiling man. Woman is the identity in the first two, by subtracting the identity is effectively removed and the "smile" is largely what remains in the vector to be transferred onto the neutral man identity as a transformation.

I suppose the more general point is that we are going to see more and more complex use of various kinds of thought vectors[3] and more and more attempts to try to improve their accuracy. This area is just going to keep exploding I think because the practical applications, such as they showed in this paper for animations, will keep driving work on it in multiple domains. The current pace of research, which has led to[4], and the results in this paper and in [1] are just mind-boggling.

[0] http://arxiv.org/abs/1210.5474 sections 1+2 have a good overview, and 4 has related work

[1] https://github.com/Newmu/dcgan_code

[2] http://arxiv.org/abs/1511.06434 (first submitted in 19th Nov 2015)

[3] http://arxiv.org/abs/1506.06726

[4] http://www.arxiv-sanity.com/
Not to mention how racist/sexist/ageist/etc tipping is.

It's incredibly naive to think the people who get tipped the most are the best employees, even if the pool ultimately levels out the playing field.

What kind of a fucking awful system do we have where hot white girls are better coworkers simply because they're hot white girls, and not because they do a good job?
Can you elaborate on how this charge is passed onto the service staff? I waited tables in college and I don't recall ever being forced to eat the CC service charges. for
What is the difference from a speech recognition API and [NLP libraries](https://opennlp.apache.org/)? This information was not easily found with a few google searches, so I figured others might have the same question.
But alas, here we are, talking about the JavaScript language and it's ecosystem.

It's easy to say "I don't see why there's a need for an 11 line module to pad left on a string" when your language of choice has a robust standard library with such abilities built in.
"My YC app: Dropbox - Throw away your USB drive" (3276 days ago)

https://news.ycombinator.com/item?id=8863
I think the article's thesis is essentially that every dependency your project pulls in -- which includes all the dependencies your dependencies pull in -- is a point of potential failure. I understand the "don't re-invent the wheel" defense, but the Node/JavaScript ecosystem tacitly encourages its users to build vehicles by chaining together dozens of pre-made wheels, all of which depend on more wheels, and each and every one of those wheels has a small but non-zero chance of exploding the next time you type "npm update."

(And, y'know, maybe it's because I'm not a JS programmer, but the notion of looking for a module to implement a string padding function would never have even occurred to me.)
That's true, I don't. But if your deadline is too tight to do it right, maybe you need to reevaluate your project plan.

I mean, I can certainly see using more dependencies than I'm using. Mail is a great example of something that probably should be handled by dedicated, well-tested code. But to carelessly dump piles of third-party dependencies in your project to save a few minutes, as talked about in this article... just crazy.
In recent years, I created a homework assignment for a security class where the student's job is to crack a set of password files. First easy, un-salted hashes, then salted hashes, ... etc.

To illustrate the badness of using dictionary words as a password, I randomly generated a unique password file for each user by sampling from /usr/share/dict/words.

> One afternoon I thought, wait a minute, what's actually in Wordnet?

I know exactly how you feel. It took me about 5 minutes to find Shutterstock's list of dirty, naughty, obscene, and otherwise bad words [1], and about 20 more minutes to add a blacklist check to my script.

Fortunately none of the students had actually been given a bad word. Whew!

[1] https://github.com/shutterstock/List-of-Dirty-Naughty-Obscen...
There's a lot of good stuff on eBay and Craigslist.
For what it's worth, that's what I read in to it too.
Oh, I even agree. For myself, I just rent a car whenever I need one.
npm install goldmansachs
A fun r/programming subthread about this package: https://www.reddit.com/r/programming/comments/4bjss2/an_11_l...

Those are just the three top-level dependencies. The package has 9 recursive dependencies.

There's also a nice table explaining how a package called "is-positive" managed to reach version 3.1.0.
Looks like HN doesn't do FTP links. Is there an HTTP URL for this?
Long story... we had the git repo but lost access to any working installation. I had to rebuild a dev vagrant VM first, and later on a production-ish setup on a server.
Similarly, the `average` package on NPM is one that I came across:

https://www.npmjs.com/package/average

var average = require('average');
var result = average([2, 5, 0, 1, 25, 7, 3, 0, 0, 10]);

console.log('The average for all the values is:', result);

It's hard to not stare at that in complete disbelief; someone thought that it was worthwhile to create a package for determining the mean of an array of numbers.
Since when did it become the norm to split tips among all the staff? Are you talking about tip jars at Starbucks or tips for a waiter?

A waiter may tip out a bartender depending upon how much of their tab was alcohol but otherwise they generally don't divvy it up with all the other servers.
Agreed the JavaScript standard library is poor and instead of addressing it they've mostly just added syntax changes to ECMAScript 6 and 7. It's incredibly disappointing.

For instance I added a utility to my own library (msngr.js) so I could make HTTP calls that work in node and the browser because even the fetch API isn't universal for some insane reason.
Publicly visible source code is not enough. You need be able to modify and (freely) distribute changes to that source code.

When I can write my own patched version of Windows (A Windows distribution if you will) and people can download my modified version then it will be open source.
A maintenance programmer should be raising to management the risk if they do not have reproducible builds.

The issue isn't that the company's software has a dependency. The issue is that the company is taking for granted the generosity of others. If they did not get a reproducible build before, they should attempt to get one as soon as they are aware of the problem. If the package is no longer available, they must now accept the punishment in terms of lost staff time or dollars to work around the lack of the dependency.
PS I did not downvote you and I find your question legitimate...
Compare Google image search:
https://duckduckgo.com/?q=!i+brot vs https://duckduckgo.com/?q=!i+bread

Have you ever had English bread? See eg https://en.wikipedia.org/wiki/Chorleywood_bread_process

Basically, the two words fray at the connotations. The denotation is the same.
The recursive folder structure in npm-modules was the first indication. At least Java had a single tree with com.bigco.division.application.framework.library.submodule.NIHObject.java
You should then go dive into the passAll function:

https://github.com/tjmehta/101/blob/master/pass-all.js

It’s written in such a way that every time you call...

passAll(f1, f2, ..., fn)(args..)

... there are something like 5 + 2n attribute accesses, 5 + 3n function calls, 3 + n new functions created, as well as some packing and unpacking of arguments, not including the actual application of the functions to the arguments that we care about. That’s in addition to the several functions defined in the dependent submodules, which you only have to pay for constructing once.

[From my quick eyeball count. These numbers could be a bit off.]
He offered it to them for $30k according to that medium post. Thats something
Shouldnt the Gemfile.lock have prevented that? It takes your gemfile and makes a specific-version locked file of those gems.
Is that a factor of tipping or of the overall traffic in a restaurant?
Npm install goldmansachs
Hi, I didn't realize my info would be shared. Thought it would only be used to compare to others. I would like to edit my entry to remove employer name. Please advise.
Wow, a real-life chaos monkey!

https://github.com/Netflix/SimianArmy/wiki/Chaos-Monkey
It was the CGI equivalent of matting for nearly the whole movie. Sill a very nice looking but unnatural film. Which seems appropriate.

I think Lynch's characterizations were superior. But the SciFi one was long enough to do a better turn to the book.
You can be multicultural but not multiracial. I'm a white male but from a different culture.

As an aside; is it racist to assume all white men have the same culture?
I'm not sure where you're from, but Europe definitely has tipping. Over here in the UK, it's almost expected, sometimes even as an addition on the top of the 'service charge'. Heck, it's not even just restaurants, people over here also tend to give tips to hairdressers and beauty salon staff as well.
What would happen to all those NPM projects if GitHub is destroyed? I don't think it will close anytime soon, but lets say, a meteor shower hits GitHub data center or something along the lines of this.
That whole thing is crazy, but what sickens me the most in this article is this part:

> Isaac: In this case, we believe that most users who would come across a kik package, would reasonably expect it to be related to kik.com. In this context, transferring ownership of these two package names achieves that goal.

How is that remotely a reason? Is a .com domain a trademark now?
Same here. It's hard to want to upgrade a 2500k stable at 4.6ghz on air with no overvolting. Got it right when it came out. OTOH, starting with a Radeon 6870 then later adding a second for crossfire and Bitcoin mining when that was profitable still barely give me the power to play the newest Rainbow 6 on low everything @1920x1200 while keeping >30FPS min on Win10. I'm personally waiting for the new GPUs to come later this year before upgrading, then seeing if Oculus or Vive has better game support at that time.
It really is the fault of the language that something this fundamentally horrible is allowed to exist in itself.

When people ask why Javascript is terrible, show them this.
true, but as of now only a handful of native apps support it (e.g. Uber does, but then Uber supports any major password manager including LastPass).
> (Also, tipping is a wonderfully efficient way to discover which customers are not worth being nice to. ;) )

Which is a problem unto itself.
Personally, it's not about the 'original' developer pulling out, but about the simple question: who or what do you trust?

1. The developer,
2. The content distributor,
3. The code (by git SHA ref perhaps),
4. The contract of the code (using formal verification),
5. The legal contract with the code supplier.

And if you trust 1, do you expect of him to sign the stable releases using GPG tags?

All the focus on OSS nowadays seems to be on 1, but as professional engineers, shouldn't we focus more on 4 and 5?
I've seen the movie about the movie, and I've seen some of Jodorowsky's work.

I dunno, man.... :) Too bad CGI wasn't available earlier in his career.
Our Startup Toolkit: All the Tools and Apps We Use to Serve 2,000+ Customers
And 54 people found it a worthwhile package to install _this week alone_.
Android is far from "freedom". Having to find exploits in order to get root access on your own device is just wrong.