skysight-inc/HackerNews huggingface dataset:
He pretty much gives entrepreneurs and high tech workers a pass, by saying that they have earned the right to be in the 1%.

The concern is more that their children, and their children's children, are likely to be in the 1% as well, no matter what they do, or don't do.
The note offers this workaround for npm: "Use npm shrinkwrap to lock down your dependencies", which will prevent the worm from spreading purely because of an install of a checked out app.

Any application package manager with a lockfile-based-workflow (like Bundler, Cocoapods, Cargo, etc.) would at least have this mitigation as a default part of the workflow.
All package managers (that I know of) for dynamic languages offer a mechanism for compiling native code for packages that include bindings to C libraries.

That mechanism could easily be used to achieve the same goal, even if there was no explicit "post-script" mechanism.
Hi there,
I'm interested to join you guys. Will mail you.
The 7 Habits of Highly Effective People
Compound interest is a joke for the 99%. My savings account gives me 0.65% interest I think? http://xkcd.com/947/ However when you start having millions on 10% interest you start talking real money, at least from the perspective of the person who will never have that kind of investment.
I ask this with genuine curiosity. I'm an outsider when it comes to js development really. A while ago a lot of discussion was made regarding libraries like jquery and frameworks made to solve common problems. Much of the argument went along as "why are you using such a big library when you are using just a tiny part of it?? Don't be lazy!"

Now in the wake of leftpad issues, the most common argument I've personally observed, has been "why are you using a library that solves just this one problem? Use a library that provides the full utility around this problem area (strings)".

It feels strangely contradictory but I'm most likely missing some context here. Just wondering what it is :)
>> ● Require 2 factor auth for publish operations

> This seems very reasonable, and the easiest to implement. It also has the nice effect of being a captcha to the publish operation, which gives it some of the gravitas it deserves in an open ecosystem like npm.

I agree, especially since Google Authenticator makes this pretty easy to implement.
The thing that bothers me about generational stereotypes in this context is that they assume everyone is an exhibitionist and an extrovert. Not everyone is interested in social networking.

Never in my life have I put anything truly personal online; not when I was in school, not when I was single, not even when I was drunk. With a couple of exceptions, most of my friends are the same, regardless of their age.

These types of social networking services attract a certain type of person, just as much as they attract certain age groups. Yes, there are more younger people on them, but there are more young people online in general. Lots of us stick to our little corners of the net, or wherever, and couldn't care less about the "look at me" circus.
Just get a mini-itx board on eBay or a board-cpu combo:

http://www.ebay.com/itm/Biostar-Mother-Board-A68I-E350-DELUX...

http://www.ebay.com/itm/Dell-Optiplex-745-USFF-Ultra-Small-F...

http://www.ebay.com/itm/Intel-DH61AG-Desktop-Board-DDR3-Thin...

And the CPUs are cheap too:

http://www.ebay.com/itm/Intel-Pentium-Dual-Core-Processor-G6...

http://www.ebay.com/itm/QTY-1x-INTEL-Celeron-CPU-G550-2-6GHZ...

http://www.ebay.com/itm/Intel-Pentium-G2030-3GHz-3M-Cache-Du...
man i didn't even know about "includes" -- i always use indexOf
I'd be interested to see the degrees of privilege that take place among the upper echelons of the 0.1% - what types of opportunities are only available to them? Are there tactics we are simply unaware of, that skew our understanding of the fight for economic prosperity?
It sounded like XiaoIce was a chatbot hosting individualized conversations, so it wouldn't be a platform for rebroadcasting bad stuff.
The author explicitly chooses an open source license and publishes to a public repository for other people to depend on. That action releases the package into the public sphere.

If the author then wants to undo this action, that simply will be difficult—more so the more people depend on the package.

If several people depend on the package, then they will try to put it back again, unless they sympathize strongly with the author's intention to unpublish.

That's just open source working as intended. There's no ethical framework that compels people to have that sympathy, in general.
It seems they are trying to reinvent Brainfuck language
The concept is great but the equipment must be very expensive.

It seems multi-national company may make money by providing a private room to enjoy the 'holoportation service'.
Windows is a malware
The Rete Matching Algorithm (2002)
shrinkwrap might work for a bit. but if you regenerate the file you will run into the same issue.

a way to protect you 100% against the problem is to define your dependency as a link to a specific commit or tarball.
To get that loan, you actually need the money that would make you an "accredited investor"?
Immutable Package Manager
The recent NPM situation was a real eye opener for me. I never gave much thought to the attack vectors involoving package managers.

> The post install script can be like any other script the user can run. There's no sandboxing so it can access anything the running user can access.

Wow. This just seems wrong that the script has such far reaching privileges.
1% is obviously a simplified, talking-point metaphor; not a literal 1 out of every 100. The sliding cliff, gray-area seems to be an issue regarding the problematic portion is around the top .01% or perhaps smaller still.

Another issue is that said narrow group is incredibly skilled in exploiting whichever rules are enforced, buying elected officials from all three branches of US government under the current campaign finance rubric and generally making sure their interests are first.

Folks whom have tax accountants, tax attorneys and investment managers are able to hyperoptimize purposefully-byzantine tax code while grandpa does TurboTax (in the US, take a look at the 1040 (full, non-EZ form) for all the odd, special interest tax deductions which clutter up forms and have the own extra forms (Schedule _)). Complexity is a game to catch the unweary, confuse most people and create an official "elite qualifying miles" gambit to reduce taxes in "certain" situations.

It comes down to whom has the most influence over collection, allocation and redistribution of taxation.
No. Reinventing wheels is also bad. Which one is worse depends on context.
I imagine a much greater emphasis is put on the value of time as time really becomes the only finite resource in most circumstances.
There is nothing to be done about what other people are earning in my opinion.
Missing: how defaults are wrong between UTF8 and EBCDIC. E.g. where a character in UTF8 outside the MES2 subset ('latin1') will be mapped to the x3F 'unknown' character of EBCDIC, which will be mapped back to the x1A character ('CTRL-z') of UTF8...
"It rather involved being on the other side of this airtight hatchway"

https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...
Disclaimer: I'm a developer at King. I work with "Fiction Factory" other of King's internal engines.

We had some weeks ago an internal presentation by the CTO and the Defold team. They explained their goals for doing it. The goals, as I remember them, to give Defold for free are:

* To improve Defold. The bigger the user base the more stable, relevant and useful it will be the product.

* To show people that King is a technology company. We do cool stuff.

* To be able to hire developers that already know our tech stack.

The first point is the most important one. What have helped to grow other engines has been a community of users that have helped to improve them in features and stability. Some times users help open source engines like Ogre3D, others they help paid engines like Unity3D. We think that King can offer a win-win situation with a free (like in free beer) engine with exciting features in exchange of a community that uses it and makes it relevant.

This ideas are in the box titled "Why are you releasing Defold free?" at the bottom of the site. If you want to read them from an official source.
Hey, I live there too.

On a recent visit to Boston I wanted to use my credit card to buy my wife a gift at Best Buy whose special price was internet-only for store pickup. For those of us whose credit card billing addresses have non-US addresses, their special magic address to get past the US-only address form is:

10780 Kempwood Dr.
Houston, TX 77043

http://www.bestbuy.com/site/help-topics/international-orders...
one of my fav parts of the book. I have to go read it again. THE CRYPT IS REAL!
You're assuming dentists don't invest. In the independent film business one of the secrets to finding funding was to find a bunch of dentists.
In general you're just seeing different people make different arguments, and the proposals which solve the most recent problem are the ones being suggested loudest right now.
Npm package hijacking: From the hijackers perspective
Decentralization although can have a hard time competing against more efficient centralized entities. A large amount of semi-cooperating smaller entities will not necessarily lead to less corruption, because small town corruption is a very real issue that doesn't get much sunlight.

One example is the internet. Why do large centralized entities seem to 'winner takes all' in many markets in software for example?

Another example is the bay area. Because the area is so balkanized, there is no unified transit system for the entire metro area and caltrain, bart, ac transit and muni all work badly together, with bart not being built as it was supposed to because 1 or 2 counties decided not to play ball.
TDD Beyond Basics: Contract Tests
A lightfield is a way of recording an image with ray angle information as well

This means that you know where the light has come from, which allows your to amongst other things alter the focus/depth of field after the image had been captured.

Because you can refocus and change the depth of field post capture, it allows you in theory to do better image segmentation.
There are good reasons to prefer free and open systems, even for "production" software. Those reasons are part of why people choose to use GNU/Linux, nginx, and all the rest of the open infrastructure.
I don't think anybody was talking about the legal protection of free speech, apart from that xkcd comic which uses it as a straw man to justify intolerant groupthink and corporate censorship.

In these days of digital sharecropping and social media saturation, the proscriptions on de jure government activity are much less involved with routine everyday freedom of speech.
(Agreeing with mcphage) Regarding "openly"... it's kinda funny that we encourage people to keep their darker thoughts to themselves. Learning is harder when you do not know you are "different".

So racism is OK if nobody is aware of it?

Somewhat related to the recent article about the CEO being fired for making honest (but offensive) statements... Silence does not seem to solve as much as an open dialogue would.
I still have my Handspring visor edge. I vaguely remember writing some software for it, but I clearly remember it running for more than two weeks on a single charge. Desktop sync probably would have been a higher priority if it had needed to be recharged more than twice a month.
It's not, Vice is just full of edgy hipsters.
So the plus side is their next gen fighter is shit too?
This team must have the best remote standups.
Hmm, I guess the way the enemies would line up for attack stances (being adjacent to one another to deal extra damage) caught my attention. That's probably the most notable feature I've seen in the game.

At the same time, you've laid out how the game works quite plainly, and I've read enough about Pac-Man to know that video games can seem more clever than they seem!
Replying to myself....

Now that I think about it, in a large chunk of the Slavic world (Russia, Ukraine, Belarus etc), the majority of people probably have no middle name. A patronymic isn't really a middle name as such.
We will never be able to enforce this and do productive research. It is all due to mathematicians' fantasy about how research works and researchers' fantasy about how stats work.

Something always needs to be adjusted that is figured out during the study. Focus on testing precise predictions and observing similar results in different studies rather than significant differences. Despite it being much his "fault", Fisher pointed this out nearly 60 years ago:

Fisher, R N (1958). "The Nature of Probability". Centennial Review 2: 261–274
Donald TrumpVanilla Spilla Are IBF Intelligence Members.Trump IBF Leader
Not hard at all, just shut it down.
I really don't like the 1% designation. According to [1], if you have an annual income of $55,000 or above (after tax) in the U.S. you are among the 1% globally.

I like the idea of equality and all, but it feels like, when people talk about inequality, they mostly want to be richer.

[1]: https://www.givingwhatwecan.org/get-involved/how-rich-am-i/?...
Concord man accused of not returning VHS rental 14 years later
I had a similar, derived issue. A new house I was renting was marketed as "24 Street Name",the lease document was written as such and the front door had a number 24 on it.

However, after moving in, we discovered that on all official databases it was "24-26 Street Name".

This caused a number of frustrations over the years. After a while we just put "24-26" on everything and be done with it.
Well, I don't know your specific circumstances, but I'll say one should strive to have as little logic in their build system as possible.

It essentially should be running shell scripts and/or language-specific build scripts/tools. All logic should be self-contained in your project(s) repos, so that it doesn't really matter what build system you use, and/or one could build the project without the build server if required.

With that said, I don't see any reason why release management, containerizing, versioning of assets, etc... could not all be done with Jenkins (or any build system).
thank you. ive been wanting to say this for 10 years but nobody will listen.

- powershell: packet logs, wtf you can do that? invisible os layers (invisible os is there, invisible shell, invisible user accounts, invisible logging)? admin priveledges and remote shells? cannot disable? wtf

- services: disable a service and risk breaking the OS? wtf? no depency list, disabling one breaks everything. dont let user land shit in here then.

- svchost: hosts a dll as an exe, but average user cannot find out what the dll name is? cannot close the process, cannot tell what installed it? wtf.

- rootable samba file sharing: most versions of windows are vulnerable once they connect to the internet, wtf

- preinstalled open ports: um i dont really care what media player library wants i dont want port 443 and 52000 and 999 open.

- netbios vulnerable for unpatched versions: nothx

- 9 places to put a startup app and have it run silently

- registry is fucking spookware: just let me uninstall shit, from /usr/apps/appname, i dont need it modifying windows defaults in the registry

- worddoc, excel doc, pdf doc, flash doc exploits

and about 5 more i am forgetting
There are a lot DSLs writtn in Lisp, which don't use Lisp syntax and are not embedded.
Completely agree. When I first started using cron I was chuffed at this.
Sure, eventually, but I can't imagine that on any reasonable timeframe.
Welcome to Your World  Mixed World Skateboarding
Reddit Hacker News Be a Non-User User
ES6 Node Module Boilerplate
Oops! Really sorry, was using convertkit for the forms. I'm taking it out right away. Looking forward to more comments from you. Thanks!
Considering node.js is able to spawn subshells and execute whatever code it wants when running, install scripts pose no additional threat to just running the javascript.
But that's simply victim-blaming.

This is a professional conference about a particular apolitical topic. If the speaker, no matter how controversial or unpopular his unrelated personal views might be, is going to stay on the topic and not bring up politics, then anyone who tries to bring politics into it is being the disruptive force, not the speaker, and that is the person who is creating an unsafe atmosphere and needs to be ejected from the conference.

> it's pretty much impossible that TypeLevel employees would be able to magically argue him out of his existing position, and it's probably equally inevitable that he would be unable to argue them into his position.

Why is it necessary for either of them to argue the other into their position?

> Are you going to have a good Thanksgiving, or are you going to get into it with your reactionary relative for the thousandth time?

I'll tell you what I wouldn't do: I certainly wouldn't demand that my reactionary relative not be permitted to attend, and if she's gracious enough to not start a fight at the dinner table I won't start one myself. If she can be polite, I can be polite.
> Freedom of speech is not freedom from criticism.

“Sorry, you wrote this and we don’t like it, therefore you’re not invited to this conference on an irrelevant topic” or “… therefore we’re not going to a conference to which you were invited” is not valid criticism of an idea.
You've got to write a lot of crappy code before you can write good code, so it works out.
Not an actual flight path http://www.russianspaceweb.com/images/spacecraft/planetary/m...
I didn't downvote you, but I'm guessing the reason for your downvotes is that in this day and age, even junior programmers should be expected to understand map. It's such a simple concept that anyone who writes code for a living should be reasonably expected to understand it. If you're on a team with a bunch of programmers and nobody understands map, GTFO. It will not end well.
Indeed. If self-important bullies are demanding that folks get thrown out of professional conferences because of their personal political opinions, men and women of good will everywhere need to forthrightly stand up against that.
The right thing would be to remove the possibility of removing a package so that the registry doesn't break.
Very sorry to those who signed up, I'm experiencing a bit of technical glitch with convertkit, they are very awesome. I know you are supposed to get a free starter kit once you sign up, there's some problem linking some of you to get it downloaded. I'm on it now, those who've signed up will get the free kit soon, thanks for your patience!
Pretty cool demo! Maybe they got inspired by what this guy did a while back with 3 kinects: https://www.youtube.com/watch?v=Ghgbycqb92c?
Scripts of dependencies don't run. Period. You'd have to fork someone else's repo and run npm install on that fork. If you're doing that, you ostensibly trust their code enough to inspect and work on it. If not, wtf are you doing?

If you run `npm install` on a project, you're simply installing its dependencies (and actually running any pre-publish hooks too, for some stupid reason).
IMHO the primary issue at play here is that publishing to the npm repository doesn't currently require proof of user presence, which enables a worm to propagate to other packages automatically.

The npm team is working on 2fac (https://twitter.com/seldo/status/713623991349411840) which will be an adequate solution to this issue.
Tay did not come to logical (or racist) conclusions. It was taught to be anti-social. Humans had to make it that way.

Much like weaponized diseases, AI will just be a very powerful tool that humans can misuse. Hopefully, like nuclear weapons (incredible power, but highly exclusive), AI will be incredibly difficult for the average person to use in a malicious way.
There is also a huge difference between knowing what you are going to write up front, and not having much of a clue. A lot code for research is in the latter rather than former bucket. There is no doing it right the first time because what is "right" is not clear yet.
This works great until someone who comes in with a lot of money hires a bunch of these individuals to enforce their will on others.
#include <iostream>

int main() {
int nope_not_initialized;
std::cout << nope_not_initialized << "\n";
}

cc1plus: warnings being treated as errors
In function 'int main()':
Line 5: warning: 'nope_not_initialized' is used uninitialized in this function

( http://codepad.org/6xrFQZuL )

Edit: And a C version. Amusingly, it will print "0" if I only use one printf statement:

#include <stdio.h>

int main() {
int nope_not_initialized;
printf("%d", nope_not_initialized);
printf("%d", nope_not_initialized);
}

-142791388-142791388
Exited: ExitFailure 10

( http://codepad.org/TgGfL7QW )

Edit x2: Apparently "implicit return 0 from main" is only a thing in C++? And here I'd assumed it was some silly carryover from C...

( http://codepad.org/JIH9ZteL )
That was just one example though. And it's a quirk of the current moment-in-time that interest rates have been hovering around historical lows for some time now. But I stand by my overall point that lack of financial knowledge and wherewithal is a significant factor that inhibits upward mobility.
"Google is an NSA front" and "Google may kill any product/API that you use" are in completely different orbits in terms of rationality.
There's really only lodash now that individual functions can be imported without bringing the rest in.
Install this at sports stadiums and not only make my own viewing more "embedded" in the action, but allow replay to get any angle (granted lower res than they are used to for really tight calls). I imagine that many sports organizations would be lining up outside MS research's door with cash in hand. Though the tech probably needs to advance quite a bit more to capture that many 3D objects in real time.
You could try adding in some simple motion, like raising your hand, before the system would start listening for hot words. Maybe connect a cheap infrared sensor to GPIO and block its view so it only detects motion at or above certain height.
This has always seemed pretty marginal to me. You might be able to turn the microphone on, but when my battery dies an hour later I'll be suspicious.
Once you've installed a malicious package that you intend to use, you've already lost. Even without a pre/post install script, it'll be executed eventually. The underlying problem is managing risk of the packages you install.
Or a specific version since they can't be written to twice in the npm repo.
off topic, but anyone know if there wifi mesh software went any further than this ? http://research.microsoft.com/en-us/downloads/994abd5f-53d1-...
Have you been in La Sante prison in France? How about any Central, South American or Asian prisons? This has nothing to do with prison privatization and it's clear many don't have a clue of the conditions outside of a few newsworthy European prisons.

Talk to a US consular officer who's been at the job more than five minutes, then we can make some comparisons. Blaming privatization is a red herring.. Venenzuela prisons aren't a place I even want to spend five minutes as a visitor.
Matt Might – A PL Professor and Now a Researcher of 'Precision Medicine'
3 Tips to Destroy the Presenter’s No.1 Enemy – Waffling
In development, you should separate your npm publish credentials from your dev execution environment. Use some kind of sandbox where you `npm install` -- a VM is best.

In production, you should review the packages in your dependency tree and ensure that the exact version you reviewed is what you deploy. To that end, you should shrinkwrap your dependencies. Vendoring works well too. Shameless plug: for additional strictness in your shrinkwrap, you can use https://github.com/chromakode/exactly to store content hashes.
Unfortunately native modules like canvas cannot be installed with npm install --ignore-scripts