skysight-inc/HackerNews huggingface dataset:
You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).
The same happened with my Github account.
So they didn't learn anything from left-pad situation from 1.5 year ago?

Packages that are published should be immutable, just like in maven repo case.
This is awesome - thank you! Love being able to download files via curl and search with grep under iOS. Any chance of adding a basic text editor (vi, pico, or even ed) and maintaining history across launches?
PingStatus 2018 Crack Patch and Registration Code Free Download
For my similar purposes I made this:

https://github.com/marczellm/tkpf

It's a declarative way to do simple Tk GUIs. Also, Tk does not have to look like 1997, it's themable and it can also use the native widget library on Windows and OS X.
I've not found my two kids and wife to be such a burden on me. What I can't do is watch television all night, or go out drinking all night. But productive stuff, that's pretty easy to fit in.
> Update - Most of the deleted packages have been restored and installation of those packages should succeed. Nine packages are still in the process of restoration.
> Jan 6, 20:12 UTC

https://status.npmjs.org/incidents/41zfb8qpvrdj
Kops seem (from quick overview) to be focused on AWS and/or other cloud providers. Several times I've been limited either to actual hardware in a room, or a contracted provider giving me something along the lines of OpenStack. Unless there's a project I've missed, at the moment that means I either have to deal with kubeadm, or just roll from scratch myself (umm... nope).
Eh..

He was a somewhat distant father, until his children were old enough to join him in the business - he was a good man - but generally contemptuous with convention, and conventional thinking (often seen in people regarded as 'visionaries') - in business dealings, he certainly was an asshole, but thats not unheard of in his time.

Tesla by modern standards was.. somewhat crazy - out of the two I consider Edison to have a greater vision, and to be a far more transformative figure - and honestly someone who left a larger lasting impact on the world.

I've been to Edisons home, and his final lab in West Orange NJ - I think very very highly of the man - but I also think he was an asshole.
For a single observer that area is effectively invisible; they cannot be affected or affect things in it (outside of their forward/backward light-cone).

However, other events can still exist in there. And their lightcones may intersect at a later point in time, so they are not totally uninteracting. Point (x1, t1) may never be able to affect (x2, t2), but it can always affect (x2, t2 + <waiting for a while>).
Wow, they comment faster there than one can read :D
This is a reddit quality comment. On what basis do you justify classifying the treatment as brutal? Or that the dose was high enough that the test subjects underwent ego death? Were you just exaggerating for comic effect and didn't really have anything to add?
Also, there are a lot of great libraries (e.g., for visualizations) in JS that this would allow you to use.
Does "stalinist" work?
I'm not an american programmer, and we used to have 2-3 of our own encodings in my country (or "codepages" as it was referred to back in the day) before utf-8 took care of that. Because of that having to handle international text was the default from since I started professionally programming. So, nope.

Still, missing the point.

The difference between plain text formats and binary formats is not that plain text files do no consist of bytes or don't need an encoding to read them.

It's being able to work on them with a plain text editor, and being based on actual written text -- as opposed to packed bytes and custom (proprietary or not) formats.
Personally it was because I wanted to use some widgets from jQueryUI, but mostly people are just lazy and they happen to know HTML/CSS/JS already
Have a local mirror with the relevant packages, or a caching proxy.
This has been around for a while. While quite remarkable (and I admire it), this effort, IMHO, adds little to whatever you could gain from running Version 7 on an emulator of a PDP-11. If anything, the experience using an emulator feels more genuine; you also get access to the two classic C compilers (and their source code).
"I did stalinist see that coming" doesn't have the same ring to it.
NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that they hope that malicious actor won't exploit this behaviour. According to my tests, typosquatting 3 popular packages allows to take over around 200 computers in 2 weeks time it takes their moderators to notice it.
pipefail do nothing here

Isn't that because the syntax provided doesn't use a pipe? Which is why actually using a pipe, rather than paren redirection, is easier on the eyes and the shell. It reads more like the flow of text:

maybe_failing() {
if ! some-failing-command; then
echo "That did not shake out" >&2
return 1
fi
}

maybe_failing | some-command

Is that one of the things StackOverflow said? And if so, why is it not a "good" answer (verbosity concerns aside)?
I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being installed is the one in your lock file? If not, why isn't this a feature especially after the clusterfuck of the guy deleting all his packages back about two years ago, breaking tons of things including Babel and React?

This wouldn't fix the issue of someone deleting the actual package (this happened here?), but it would prevent some malicious code being installed if someone uses the same package name.
How 2017 Completely Kicked My SaaS
I don't understand much about the blockchain, but one thing I have heard is that it's impossible (or very hard) to remove things from it. It is immutable, sort of append only, if I understand it correctly. So my question is, is there anyone working on moving npm to the blockchain? Or doing something like a package manager on the blockchain? If not, why not?
create a mirror registry containing the packages you depend on
Not too much; The job was oversold to me during interviews (or I did not ask the right questions) and that means, I've gone from working on massive scale distributed systems infrastructure to network automation configuring a handful of devices every now and then. I think my skills may have atrophied even though I have been keeping up on the side - not sure how I can sell this in my next interviews.
What's keeping me here? An awesome manager (learned how to lead from him, just by observation), and my green card application is in the final stages.
I wanted to argue that POSIX didn't define this behavior. But, reading the spec: I agree with you, Bash is non-compliant there.

According to POSIX (2016 edition)

date&>F

should be equivalent to

date &
(exec >F)

where in Bash, it's equivalent to

date >F 2>&1
A Digital Ocean droplet @ 1 GB runs at $10/mo which I have Docker Swarm + my app containers running on.
It's not just cheaper they are not allowed to arrest you in Canada. They can only deny entry or detain you until the Canadian authorities make the arrest.
I seen that. I took a look through the open biology textbook. After going through it I still think the lessons don't go into enough detail. Most biology lectures I eent to covered about an hour and a half to two hours worth of material in each of those topics along with the textbook material.The lessons are too small and don't get into enough detail to understand the concepts enough to understand the later concepts. The early stuff won't be a problem but as you start getting into the organic chemistry and cell cycle stuff the lessons that come before aren't enough to teach you what you need to know to understand it.

Like I said, it's a good overview. But I still see it as being more useful if used alongside a proper course.
You can use apropos to search names and descriptions inside man pages. For example:

$ apropos timezone
Date::Manip::DM5abbrevs (3pm) - A list of all timezone abbreviations
dm_zdump (1p) - timezone dumper
Time::Zone (3pm) - - miscellaneous timezone manipulations routines
timezone (3) - initialize time conversion information
tzfile (5) - timezone information
tzselect (1) - view timezones
tzselect (8) - select a timezone
zdump (8) - timezone dumper
zic (8) - timezone compiler

Can even search using regular expressions.
Yes, I know that, though if I'd want a simple GUI in few lines of python probably it's something not client facing and internal use only, thus design aspect is not bothering me.

Simple, functional cross-platform GUIs with Python and Tk is a very nice thing.

If we talking cross-platform production ready, pretty GUIs, probably Python is not the best choice or if we insist on Python, then in pair with something like Qt
Yes, but the packages disappeared. That people can dupe these suggests that the database was modified.
I think having a separate app for editing files makes more sense on iOS. There's iVim, for example (https://itunes.apple.com/us/app/ivim/id1266544660?mt=8).
Maintaining history sounds like a neat feature, thanks for your feedback!
If you were thinking you got away with the easter egg, you didnt ;) Good job kiddo !
Do you have a source for that? I'm super interested into reading more.

I had to do Tox21 I was using Bayesian Network for drug toxicity at the FDA we used the DILI database.
I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me.

In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and control what goes into it instead of just trusting a manager. Especially for server-side deployment this is mandatory for security. Things like let's say ffmpeg etc - we never get from random packages but we host them ourselves.
And ppl think i'm crazy for keeping packages in SCM repo. NPM get so much abuse, people depending on them without paying a dime. At least put up a caching proxy hosted by your own if you depend so much on npm for your operations.
Total Guide to CNC Jigs, Fixtures, and Workholding Solutions for Mills
Thinking big about the boundaries of science
Agreed. My point was that the experience listed is not directly related. But it's certainly true that significant experience elsewhere can provide useful perspective.
Realistically if someone were to sneak something in, what kind of audit would you need to be able to catch it?
I don't want to have to download 135 gigabytes to require left-pad.
> Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources.

Install an instance of Sonatype Nexus, create a proxy-repo for npm (and Maven if you also use Java) and that's it.

What, however, won't be caught is Docker (because that crap insists on directly talking to the Dockerhub servers, which is a giant security hole waiting to happen) and PHP composer (because it likes to pull dependencies via git from GH, so no caching there).
They document that they curate package names here:

https://www.npmjs.com/policies/conduct

I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.
This, or if you have the money there are companies that do that for you.
Btw. for those who don't know:

Yarn (which is an alternative to npm) uses a global cache [1] on your machine which speeds things up, but probably also protects you from immediate problems in cases like the one currently on progress (because you would probably have a local copy of e.g. require-from-string available).

[1] https://yarnpkg.com/lang/en/docs/cli/cache/
Can LPR’s be denied entrance for refusing to unlock?
My cynicism towards 'health experts' is not unjustified. The wiki page on giardiasis [1] gives a good overview of some data. Some random snippets:

- According to a review of the literature from 2000, there is little evidence linking the drinking of water in the North American wilderness and Giardia

- Treatment is not always necessary as the infection usually resolves on its own

- It can result in weakness, loss of appetite, stomach cramps, vomiting, bloating, excessive gas, and burping.

Wiki gives about 300,000,000 people with giardiasis. The article mentions 4,600 needed hospitalization. So a hospitalization rate of 0.000005 with the typical consequences being gassy and having the shits for a few weeks. Being afraid of this sort of stuff is simply irrational. Another datum I left off is that 3-7% of Americans already currently have it.

There may be a reason for concern about 'natural' water, but this certainly does not seem to be it.

[1] - https://en.wikipedia.org/wiki/Giardiasis
I guess what I mean is that the presence of smartphones still stands out for me, and the absence looks normal.
Are you here to get work done or are you just Stalin?
You can naturally find them in nearly any climate. Maybe worth a try
Intel Bug Security – Software – Haiku Community
Seems like images don't load if you block wired's own javascripts.
(IANAL.) Employment agreements generally are not enforceable when they conflict with the law, AFAIK. The security guard might be required to never open the door, but when a police officer or court gives them a lawful order to open it, they open it or go to jail. I doubt they could be fired for opening it in that circumstance; your employer cannot require to you violate the law.

Another way of looking at it: You can write whatever you want on paper and sign it, but that doesn't make it enforceable. You could sign a document that makes you a slave or puts up your children as collateral for your ISP bill, but those agreements would be scrap paper (or evidence for the prosecutor).
The first blockchain art fraud scam. How I fell victim
Workholding is something that I feel gets totally glossed over in the hobbyist CNC world. This is a big critique I have if my local maker space.

I strongly don't believe that one should ever plan to cut into the “spoil board” bed of a cnc. Yes, I’m looking at you shopbot and shapeoko users
As a discloser, I work at Mesosphere who engineers DC/OS.

I would like to note that DC/OS now has Kubernetes [Beta]. You can manage Kubernetes resources on your DC/OS cluster now.

Here are the instructions on Github to get started: https://github.com/mesosphere/dcos-kubernetes-quickstart
You can also join the Slack to help you on you out: http://chat.dcos.io/ (the #kubernetes channel)
This requires that some-command takes input from stdin (many commands don't) and that there's only a single input. What about:

process-stuff --file <(make-input) \
--extra-data <(make-more-stuff | grep blah)

This is the point at which one reaches for tempfiles, usually.

The point remains that <() was made for a purpose, yet lacks error handling, thus undermining its usefulness to the point of uselessness.

Edit: Isn't substitution using pipes, though? As in FIFO pipes? You get a file descriptor device which is closed at the end of the script. I don't know if the fd is wired directly to the command's stdout or whether the output is written in its entirety to a hidden tempfile first; the former sounds more natural and efficient.
They do apply to WASM. However, these mitigations are hardly air tight. I'd expect new exploits anyways.
And this is why I avoid "package managers" that follow the wild-west model like the plague.
Maps have north at the top, but it could’ve been different
I like this site very much. As a hoarder, it's a pleasure to read the ideas that others have had, and abandoned. It makes me want to finally let go of some of my domains, so that they may be memorialized.
That’s cool and I hear you; that’s a complex relevancy definition.

( Maybe surprisingly? ) This is type of query is natively supported by Postgres. That support is robust and mature, you don’t have to hack it together.

ES is a great tool and it’s clear your a fan of it. If you’re interested, I’d recommend you look into Postgres capabilities. It’s not a replacement for ES by any means ( or even a competitor to in my opinion; Postgres isn’t even distributed ). But for specific use cases, you might find that Postgres capabilities surprise you!
Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed.

I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholesome.

And it's doubly interesting because it's easy to think of cases that wouldn't be funny at all, even in theory. New Geometry Representation might be a fine name for a new format, but you're not going to use its acronym. So then what separates the latter case from the former? And you'll find it difficult to turn "Forget" into a file extension.

Yet this is all very English-centric. I've often wondered whether foreign users ever get annoyed with some of our names that happen to acronym to something unfortunate in their native language. Do they just have to live with it, or does it never happen? What if "emacs" was a smear in Portuguese, or "vim" was an unspeakable slur in India? "Coq" was named Coq partly so the dev would be able to unironically give conference talks about Coq. Was that only allowed because its author is French? All kinds of interesting questions!

I don't know. Just pointless thoughts. Personally I'm happy npm values quality; complete anarchy might not necessarily work.

Or maybe it would. I've always wondered what would happen if we develop clones of popular systems but with zero controls. Even 4chan has moderators. But HN user "baby" recently made a blockchain based image board that was theoretically impossible to control. How would people behave in such a situation? Who would you even punsh?

It's so fun to think about.
well 50:50 chances are high that if a process goes bogus, that you have more problems than just "memory is readable from every process".

(of course that does not apply to clients where code can run in jit (javascript), software that communicates with the internet, etc and runs on a remote machine).
most servers probably should only run trusted code (of course that is mostly never the case because no company evaluates every process they running) but chances are high that if some uses linux and gnu stuff that most shady stuff gets catched. (I mean if not, some people could do a lot of bad stuff, consider a misbehaving systemd, nginx/apache, databases, which could basically do a lot of harm.)
Wouldn't just pinning the hash of a package be a better solution?
Open source hwithswithcrypto residency in NYC
That's weird because I used an 11-45 with RK05s running V7.

afaicr there was an informal distribution mechanism were you could get a bootable RK05 cartridge from another site so I suppose that's how they got it going.
I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile, the C# backend (a huge, complicated behemoth of software) ran on the first click.
Good thing you wouldn't ever need to do such a thing.
Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...
Exactly. Hardware rental is one way to tackle provisioning. You're still left with all the other tasks required to bootstrap your own datacenter. As you build up the roll-your-own solution, you end up in the same place: hire IT headcount.

If you are a small startup looking to validate market fit, your best bet is Cloud + Kubernetes. If you are an established business with millions of daily customers and serious IT headcount budget, you may look into roll-your-own. The best orchestrator at that scale is, again, Kubernetes.
Thanks for this, will look into it.
You can setup mirrors for dockerhub... Or any docker registry.

You also can require image signing such that if an image is signed by an untrusted party it will fail.
You don't need a full blockchain for this: the relevant property is (somewhat tautologically) that it's an append-only data structure. By convention, everyone processing the blockchain looks to make sure that the new blockchain they get is a descendant of the previous blockchain they already have.

There are lots of other structures that work like this. Git is one - when git fetches a branch, git will check whether the remote branch includes all the commits it saw last time it fetched, or some are missing. (By default this is non-fatal but tends to produce warnings/errors when you try to actually use the replaced branch, but you can easily make this fatal.) Another good one is the style of Merkle trees used in Certificate Transparency: there's no proof-of-work, so the trees are small, but they still include a cryptographic hash of each previous tree so you can detect if something has gone missing.

The other relevant property of the blockchain is that it's not a reference to data elsewhere, it (like git) actually contains all the data that's ever been on the blockchain, and you need that data to verify the blockchain properly. This may or may not be what you want for a programming language package manager; it means that in order to set up a new development environment, you have to download every version npm package that ever existed. It does accomplish the goal of preventing things from being removed, but it's pretty heavy-weight.
In any reference frame, light moves one (light) second of distance in one second of time. So the worldline of light should always be at 45 degrees in a minkowski diagram (with appropriate units).

Is your issue that, loosely speaking, if you travelled from X to Y at the speed of light, you wouldn't experience any time elapsing as you travel? If so, remember that the Minkowski diagram relates to the observer's reference frame, not the light's reference frame.
That is a smart idea. but it would cost a lot to publish a package.
Did Intel find a solution or just biding time?
> The free market is working on frivolous problems because that's what's left to do when you don't have the force of a state behind you.

Can you clarify what you mean by this?
info works without emacs, but some people prefer emacs' info viewer to the console one. The console viewer does have some idiosyncratic keybindings - for example, "n" means "next node at same level", and "}" means "search for next occurrence". "H" will give you a quick overview.

I'm surprised indexes aren't working for you - unfortunately I don't know of any suggestions to fix that.
I thought so too. I thought they did that after the left pad incident.