skysight-inc/HackerNews huggingface dataset:
While it's obviously true that not all Republicans are racist (for any given definition of racism, it's not a well-defined word), it is disingenuous to imply there's not a problem with racism in the Republican party, to a much greater degree than the Democratic party. Same goes for homophobia, islamophoboa, jingoism, and xenophobia.

You don't have to admit it. In fact, the fact that do few Republicans admit it is the reason they can't stop being "the stupid party," despite their best efforts. It's the reason the GOP is dying, and might very well die this election, if Trump is elected. So by all means, pretend there's no problem. Meanwhile plenty of serious Republicans are aghast at how much the Republican electorate and the establishment, not to mention the more fringe psychos, have destroyed anything good the GOP may have stood for with this fear-based insane focus on social backwardism.

Talking about the Republican party of Lincoln's time is silly. How is that relevant? No Republican alive today was alive then. It's a completely different party with completely different values. I'm sure you also like to mention how the Democratic party was home to the KKK decades ago. Just as irrelevant.
The article's basic assumptions are wrong. Money is flowing out of private investment, so they just assume it's flowing into index funds. However ... Index funds doesn't seem to be where it's going.

SPY lost 15% or more in Feb, and then recovered to only be down 5.5%. Before that a similar thing happened around new year. The trend appears to be down (in the sense that the second massive drop fell to a lower level than the first, and doesn't appear to be recovering the level the first recovered to), and a lot of banks are saying that people should sell the recovery. And if you prefer non-technical arguments : stocks in the S&P 500 are trading at a GAAP EPS multiple of ~21. Whilst that is actually a bit of a drop from before, that's still a >98% percentile for the multiple. "Normal" multiple is 16, which would have the S&P 500 trading at ~1550, and generally if you believe in mean reversal you'd expect it to drop below that before improving. Additionally the fed is raising rates, and that has always resulted in stock market drops. And all of this is assuming there isn't something more serious happening (global shipping has dropped double digit percentages since last year, which would seem to indicate a very serious issue, especially in Asia).

I'm thinking there is a general outflow out of the stock market entirely. Index funds and everything. I would even bet that private investments are dropping, partly because quite a bit of investment advisors are telling people to get out of the market.
Nobody is advocating that Microsoft should be thrown in jail or taken to court. This isn't about the legal protection of free speech.
Agreed, node exists becuase it can, not because it should.
Probably too late to comment (what a shame discussion is so time limited) but what interests me about this story is that they call out hosting costs as the reason to shut down.

I would love to see numbers from this operation, like we saw after Everpix. I would love to understand the scale, if it really would cost so much to host it?

So perhaps the actual take away is they didn't really violate the ToS as it is written, but they got kicked out and should have known it would happen. They may have been targeted because they show competitors pricing. Either way, it's sad to lose the service, but hard to chase those customers, because the customer won't pay. They are trying to sell the IP and maybe the company, and apparently there's some sturdy tech with broad applications!

What's so tricky is the dispute isn't about API access for the latest pricing, but rather their affiliate revenue. That can be canceled for any reason at any time, so that they still get the API and could find other revenue streams is a key point. They are not "entitled" to Amazon affiliate revenue, so then the question is -- where's the story?
The problem is A, but everyone is attacking B.

The issue: developer pulled their package off NPM, which many packages depended on.

The solution: keep all packages in NPM. If the software is open sourced, we can legally continue to redistribute the software even though author may not want us to.

Ecosystems with this issue: Python, Ruby, Go (google it)

Ecosystems without this issue: Maven, Haskell

I respect someone wanting to pull embarrassing or private data, or even just out of spite. In that case the package can be made undiscoverable, but still accessible from direct download.

Non relevant issues: laziness; micro vs standard vs kitchen sink libraries; package security; package quality; package maintainer coordination; ... but the color of the bike shed is just so interesting.
NPM could take a few actions. The original disclosure PDF[1] suggests these:

● Automatically expire login tokens

● Require 2 factor auth for publish operations

● Help users be logged out during install operations

vjeux mentioned a few others on HN a few days back[2]:

● pre-install/post-install scripts should require user to accept or refuse.

● make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions
when used over time.

● make updating a version an explicit decision via npm upgrade

[1] https://www.kb.cert.org/CERT_WEB/services/vul-notes.nsf/6eac...
[2] https://news.ycombinator.com/item?id=11341145

In the meantime, users may want to consider one of the following:

npm config set ignore-scripts true
npm logout
Do you have any more information/sources on this subject? I'm interested.
Confirmed.

This is not always listening app. You've to click "start listening".
The article can be read both ways (also saying that VR is a fad long term).

The fact that it admits that VR is "disruptive" and has "many uses" doesn't mean it's not a fad when it comes to the general population. Something that's trully useful in a lab or educational setting can still be a useless fad gadget people have bought for personal use.
3rded, as a C++ programmer of many years it took a while but I now enjoy JavaScript quite a bit
Having actually written something like this before --- and it remains on my machine as an executable of only a few kilobytes --- I'm curious about the thought process that could lead to someone uploading a considerable volume of potentially sensitive CSV data to this site, and then downloading a proportionally larger amount of JSON from it.

The site doesn't even appear to support HTTPS.
The Post-Trump Era
> extrapolate

So what - every language has places with extra verbosity, unfortunate function names, or other minor annoyances. The correct solution to this type of problem is either 1) just type it the compatible way and move on to a real problem, or 2) use an editor macro such as TextMate's snippet[1] feature or the emacs variant yasnippet[2]. Code templates have been a solved problem for a long time.

[1] http://manual.macromates.com/en/snippets

[2] https://www.emacswiki.org/emacs/Yasnippet
> I think the future belongs to statically typed languages that can offer DSL's as terse as Groovy but with actually types in them, so that the IDE can actually do the job it's being paid for.

Not as easy as it sounds. If the DSL is rich enough, and if the types are handled by the host language, type errors can become just as cryptic and unhelpful as with an untyped DSLs, and it's just as hard for the IDE to do something meaningful with them.
Developer Turned Manager
Did they also establish whether water is wet?
I haven't seen anyone use Bitstrips since at least 2013. I thought it was finally dead. How on earth can this company be worth $100m?
How exactly is the game rigged for Paul Graham, Mark Zuckerberg, Drew Houston, Evan Spiegel, Elon Musk, Peter Thiel, and the millions of other entrepreneurs?
Making the Switch from Node.js to Golang
Society doesn't think like that. What US society thought, was that everything should be determined by free markets.

This is what happens when you put the prison service out to the lowest bidder.

And lets not even get into the part where the private companies running the prisons now have a vested interest in hiring lobbyists to provoke tougher sentencing.

But perhaps it would be easier simply to stop at Society doesn't think.
You can say Kik was a dick, but they were actually super nice about it. They own the name kik in world trademark offices (this is a long and expensive process), they, under law, would be considered a famous mark and get the highest trademark protections, and they wanted to release a package called kik. If they didn't get Azer to change it, they would lose their entire trademark (it seems silly, but true).

I actually have received a nasty Trademark C&D in the past from NY attorneys (I live in Canada), and being told by our lawyers that it's actually on the "friendly" side of C&Ds they've seen. So what Kik did, and not get lawyers involved was actually the best way to handle it. Just look at the C&D and convo between Pair and Pair on TechCrunch.

Azer was actually the one being a dick, responding with "fuck you". You wouldn't expect someone to name an npm package called Disney or Apple or Microsoft or Intel.

Side note: if Kik were really being dicks, they could have sued Azer and forced him to appear in court, and Azer would likely lose. Also, kik also has a unique spelling and Kik owns Kik.com, it makes it harder for Azer to argue "look at square" (where square is too generic of a word). Trademarks are weird, and unless you're a trademark lawyer or been sued, they may come across as stupid, but they really aren't.
Ask HN: With all our software built on so many dependencies, is anything secure?
Interesting, can you provide a link to the source code that supports your claim?
Show HN: Shit VCs Say
See also Ghost in the Shell:

https://www.youtube.com/watch?v=poKi7YyuamI
We'll just replace our eyeballs.
According to NIST, researchers are suggesting that a quantum computer capable of breaking 2048 will be available for less than a billion dollars within the next 15 years:

http://csrc.nist.gov/publications/drafts/nistir-8105/nistir_...

Also relevant is Frederic Jacob's analysis of the NSA's relatively sudden shift towards post-quantum cryptography:

"[It] says that it takes up to 20 years for algorithms to be fully deployed on NSS, and the equipment is often used for 30 years or more. NSA refers to “many experts” that predict a quantum computer capable of effectively breaking public key crypto within that timeframe and that it is important to address that concern."

https://www.fredericjacobs.com/blog/2016/01/27/NSA-QC/
It's an interesting article, but how exactly is "skill" measured for things like [1]? I couldn't find a description of this in the article or the linked paper (that I skimmed).

Furthermore, how does this account for personal preference for less dangerous jobs for example? I'd much rather be a waiter than a coal miner, even though you could say both require the same/no skill.

Pay is only one of many different aspects of compensation (a more dangerous/stressful job will likely pay more even if it requires the same skill; many teaching jobs have a lot of vacation which you might value more than a pay increase, and so on).

[1]: http://www.brookings.edu/~/media/Blogs/social-mobility-memos...
This is essentially what's known as "rentier capitalism", but the Brookings paper unsurprisingly limits its scope mainly to the medical and legal fields.

The much deeper problem is the degree to which much of "the system" itself is captured by these sorts of dynamics. Look at the amount many large companies and wealthy individuals spend on political lobbying of myriad forms. We're talking countless billions of dollars.

Money, power and connections are used at every level of government, from local to state to federal to subtly and not-so-subtly tilt the pinball machine in far too many and complex ways to attempt to enumerate, but anyone who has been in or near the workings of power understands intimately how this works.

One salient point for me is witnessing similar phenomena in other countries to a varying degree, down to e.g. official government border guards, law enforcement and civil service officials in some countries who openly shake people down for bribes to perform their normal duties, either expeditiously or at all.

So my takeaway is, this sort of subtle corruption is endemic and impossible to completely end in any human society, but nonetheless the degree and character of the corruption vary hugely from country to country, and the US seems relatively unique in the "first world" in allowing this corruption to grossly undermine basic foundations of modern western democracy to the point people are getting ready to grab the pitchforks.

One of the main things elites and intellectuals took away from the rise of fascism and communism in the 1930s/cold war period was the need for democracy, no matter how corrupt and sold out, to provide some sort of floor beneath which it would not allow its citizens to fall, and some sense of forward progress and shared success, even if not equally shared ... a sense of we're-all-in-this-togetherness. This is the principle that both political parties in the US have now effectively abandoned, rhetoric aside, and the consequences are unfolding before our eyes.
I think it was more of a gut reaction of "here's something moving towards me, let me get out of its way", rather than being extremely careful. I don't think we're at all ready for having things passing through us.
We've had optimizing C++ compilers for a long time - decades. I think it's safe to assume that the low-hanging fruit was picked a long time ago.
Alexa JARVIS
Excellent article detailing the anti-free market practices that the 1% lobby for allowing them to increase their financial advantage.

I do wonder if there aren't other factors contributing to the issue. The ready dismissal of corporate taxes (read loopholes) seems slightly premature.
Podcast Interview with Koverse CTO Aaron Cordova on Big Data, AI, and OSS
And yet, they're still in business after Microsoft Bob.
Remote Working on the Rise
These things will be the end of all of us.
How is it lunatic to use the same language for client and server?
That's still an assessment of VR as it currently exists in current products. It's ludicrous to argue that VR as a whole (immersing someone in a believable, manufactured reality) is a fad. IMAX movies, video games, Second Life, and even role-playing are poor versions of VR that demonstrate that humans are striving toward it.
This is an analysis of top 1% wage earners, not top 1% capital owners; and besides, it's not really the top 1% where it gets egregious; more like the top 0.1%. The analysis of returns to capital doesn't seem to include capital appreciation itself, and how it is taxed much more favourably than labour.
Closest I could find to boondaburrah's claim was:
http://www.defold.com/about-privacy/

"We provide data collection and statistics of your players, if you want it – In order to provide Player Analytics, we need to collect data on your Players such as how they play Games and what device they used. If you choose not to use Player Analytics, we won’t collect any data relating to Players (except for errors directly related to the Defold Engine). Please see our Privacy Policy for Players http://www.defold.com/about-player-privacy/ for more information about what Player data we collect and what we do with it."
Linux Foundation pours funds into R language
It's not copyright, but trademark (it's a subtle, but important distinction). And for trademarks, the short answer is it depends. Some trademarks have no protection (generics or ones that become generic) and others have infinite protection (famous marks, like Apple and Disney). While most have protection in their field (think the word Mac, it's a computer, a burger and a cusmotic brand).

Field however is hard to define, for example Trademark offices have categories and theoretically, you cannot have 2 trademarks owned by 2 different entities. That said, it does happen, because the "fields" are actually defined by likelihood of confusion, which is shown in court. If this is all confusing, it is.

But long story short, if your mark is famous (and kik's would be considered famous), you're the only one allowed to use it, and you HAVE TO in force it, otherwise, you lose it.
The problem is browser vendors wouldn't want to implement that spec because if updating your browser breaks the website, no matter how much you explain it to the user, it's your fault, not the website owner's. It's why we have Quirks Mode even after 15 years. It's why Linus is so adamant about patches breaking userspace;[1] if your update broke it, it's your fault, no matter how bad the truly broken thing is.

[1]: https://lkml.org/lkml/2012/12/23/75
For me, using React makes it possible to write UI code like I am writing UI code for the desktop (e.g. .NET). When I first saw it my reaction was "Finally! I can stop pulling my hair out!". And the more I use it, the more I like it. I am working on a highly dynamic UI right now that I started building with Knockout, got pissed off, tried React, and haven't looked back.

React really is different than everything else that has come before. I don't know if React will be the final, new framework most developers use. But whatever is the final framework will almost certainly borrow many of React's ideas.
Lodash has a left pad function that can be installed individually. People just don't know/wasn't available before.

I vote for lodash to become the new STL. It's even faster than native JS.
THIS IS HUGE. They are creating/calculating the missing "dimension" based on statistical input. That is amazing. Physics experiments are all about trying to understand the unknown dimension(s) as well! This D to D+1 dimension transformation is mathematically likely to be solvable for any D value that is an integer too.
This ignores the fact that js libraries need to be downloaded on every run. Even if there were a great general-purpose string module that included the functionality, a micro-package like left-pad would be less to download if you didn't need the other stuff so I imagine some developers would still use it.

It's almost ironic really, that js has the worst standard library situation of any popular language yet it would benefit the most from having a good one since it would save everyone bandwidth and page load time.

Maybe someone can write an amazing replacement stdlib and we can all agree to include it from the same CDN so it'll be cached on every browser in the world...

EDIT: I see from other comments that lodash functions can be required individually which I hadn't thought about. But the point still stands, every function that you use in a big project that could have been in the standard library is more to download.
Unless I'm not understanding this correctly, every package manager is vulnerable to this attack (along with many others). I'm not sure why someone bothered to write this down and make an official "disclosure". Maybe someone more knowledgeable can explain?

I mean really the idea is just that if someone got somebody else's password, they could use it to trick other people into installing a program. Even email has this problem. So really the only thing NPM could be accused of here is not doing more to make publishing secure (like using two-factor authentication).
"If the software is open sourced, we can legally continue to redistribute the software even though author may not want us to."

Right, you can legally redistribute the software, but can you ethically do so? Some people have complained about the bad precedent set for allowing left-pad to be reuploaded again after it was deleted, and the reason they complained is because the developer has lost control over the fate of his own package.

These people can't complain too loudly, as the author in question did indicate that he was willing to give ownership of his npm packages over to someone else. But you could easily see a situation where a developer would want his stuff deleted and not be accessed, period. Why should this request be refused?

The idea that the developer has lost all moral rights whatsoever to his/her work just because they attached a LICENSE text document feels wrong to me. Just because a license says you can 'do whatever you want' doesn't mean you should do whatever you want.
It's definitely a nuanced issue.

> ● Automatically expire login tokens

I don't see how this helps the issue at hand; a worm could spread very quickly, requiring just a single publish from each freshly infected user.

> ● Require 2 factor auth for publish operations

This seems very reasonable, and the easiest to implement. It also has the nice effect of being a captcha to the publish operation, which gives it some of the gravitas it deserves in an open ecosystem like npm.

> ● Help users be logged out during install operations

This may break far more packages than might be considered acceptable.

> ● pre-install/post-install scripts should require user to accept or refuse.

Presumably this would be unnecessary with 2FA for each publish operation.

> ● make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions when used over time.

Doesn't do much to address the issue at hand. A static dependency tree doesn't mean benevolent dependencies.

> ● make updating a version an explicit decision via npm upgrade

Same issues as shrinkwrap.
See my second to last paragraph for my response.
> It's better to have these things written out so that no one can claim they didn't know any better.

No, it's not better. One cannot substitute common decency with a document, and it's a fool's errand to try.
The Way of the Gopher: Making the Switch from Node.js to Golang
Come on. If your AI can't handle the Internet then it doesn't deserve to be on the Internet, let alone in charge of important stuff.
>Public Transit Is Worse

Depends on the country. In some places it is excellent.
You're right. We should have no laws. /s
And I think that's a pretty good compromise that I'll accept. I could also suggest a manual deletion process as well in case you accidentally released security credentials or something very private that really shouldn't be open source. (Manual in the sense that you have to send an email to tech support and wait for them to respond...)
And if we're being picky, name: 艾未未, and oops, there goes my other idea that I can at least use the spaces between words to figure out what's going on... ;)
No The Tay AI is objectively terrible for not properly knowing how to deal with humans.
And you're thinking star lawyers. Think countless thousands who also work as such...
"It really boggles my mind that we don't air-gap every single one of these types of critical systems."

I would go even further.

To air-gap something implies that you are breaking the physical link that it could interact on the network with.

I would suggest that these systems should not have networking capabilities at all. The controllers for a dam, or power plant, or (insert critical infrastructure here) should not have networking hardware or even a networking stack.
Nah, it can handle the Internet just fine. It just can't speak on the Internet.
I read the entirety of his AmA and did not once see him "advocate for slavery". Could you directly link to where he does and quote him?

for reference: https://www.reddit.com/r/IAmA/comments/4bxf6f/im_curtis_yarv...
EDIT: morbius says it much better than I did.

I'll add that they also are all Americans, 5% of the world's population with an enormous advantage. Based on the success rate of tech startups in Somalia, I would guess that if they were born there we never would have heard of them. How many brilliant people does the world lose to bad circumstances like that? Almost certainly, it's nearly all of them.
Vulnerability #319816 – npm responds
I don't think there is any dentist or lawyer (nor a lobbyist for that matter) who is richer than Paul Graham. To say that the rich only benefit from rigged markets is a simplistic and naive way of understanding how the world works.