skysight-inc/HackerNews huggingface dataset:
I assume their AI will learn from the Uber executives and will soon be responding with racist and misogonistic resolutions to problems.
Sure but why not implement CSP and also get your packages from somewhere trustworthy and audit the code you actually run? Just because "most people are lazy" doesn't mean you have to be. "Audit the code you run" is still good advice right?
This is what the Meltdown patch looks like
Eye Strain from LED Backlighting in MacBook Pro (2008)
I'm surprised there wasn't a global lock-down on new package registrations (or at least with the known names of lost packages) while they were working to restore them.
>I demanded to speak to a human, but got the same automated reply again!

Why? It's a low margin business and stuff like this drives up cost for everyone. I'd rather have low cost rides than talking to human support
And how would MS-DOS access the internet? Packet drivers?

MS-DOS was not designed for internetworking, whereas BSD has always had an IP stack.
"Bash is the glue which keeps everything working together.
Please don't build a complete cathedral out of glue."

--JepZ
What was the root cause?
Packages broke because of a literal two line function? That's hilarious and terrifying at the same time.
This has been debunked already - CEO sold the maximum amount of company stock he could from his yearly award every 4th quarter for the last 4 (5?) years in a row.
I suppose npm rebuild would work.
I didn't say it's ok, that was exactly the opposite of my point.

I'm saying they did something NOT OK, and their children get to enjoy all the fruits of their immorality without any of the blames.
I didn't think of it. But it is a coincidence, Good one.
Anybody got a qemu command line to run installer against blank disk image?
The theory for this was put forth by Cohen et al. in 2003 [1]. Whether or not it's been implemented, I'm not sure. Interesting idea, for sure.

[1] http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.84....
Sounds like the song for outsourcing customer support to overseas organizations. Don't think that worked out very well.

Is there any data on whether people prefer talking to a human being and having a less successful outcome vs talking to an AI and having a more successful outcome?
> those people usually and rightfully go to jail

Exactly my point. They got punished for it, but their children lived to enjoy the fruits of their labor, without any blame or punishment.
The IR port can be used for networking too, see https://linux.die.net/man/4/irnet

But it first needs a working system installed. I never tried it (actually I did the opposite), but it should be possible to install a minimal system on a similar spec-ed virtual machine, then write the created disk image into a physical disk, stick it into the laptop and boot it.
> Only for a version less than 24 hours old. You can no longer remove established packages.

Apparently, someone can remove established packages.
That’s one of my favorite Grand Designs episodes. They end up having to build a little ferry system to get the construction equipment over the water (which ultimately fails and dumps its cargo into the Thames, necessitating a whole recovery effort).

It’s a different flotation technique though (“boat in a hole”), and much more expensive. I think the breakthrough here is the relatively cheap approach of slapping styro to the bottom of the house and letting it ride. I assume if you were trying to lift a bigger/taller house, you may need to start digging down to find room for all the foam, which starts blowing up the price tag.
Well... I never expected one part of my process not to be able to peek into what the others are doing.
> Or has ancestors that killed native Americans

It doesn't matter if your ancestors were Americans. The prosperity and safety of the Bay Area, which you enjoy, was made possible by people who murdered and stole land. You enjoy that privilege everyday without taking any of the blame.

The fact that you're outraged speaks to your privilege because you've no understanding of what a bloody mess history is, and the amount of indencency it took to get the U.S. to the prosperous nation it is today.
It might be easier to catch if packages were namespaced by author and package name, or even directly by URL, the way Composer does with PHP dependencies. It's easier to spoof 'infinity-agent' than 'floatdrop/infinity-agent' or 'github:floatdrop/infinity-agent'
You should re-read it, because it explicitly rebuts the argument you're making. It holds specifically that Almeida-Sanchez stands, and that:

In Almeida-Sanchez v. United States, supra, the question was whether a roving patrol unit constitutionally could search a vehicle for illegal aliens simply because it was in the general vicinity of the border. We recognized that important law enforcement interests were at stake, but held that searches by roving patrols impinged so significantly on Fourth Amendment privacy interests that a search could be conducted without consent only if there was probable cause to believe that a car contained illegal aliens, at least in the absence of a judicial warrant authorizing random searches by roving patrols in a given area. Compare 413 U.S. at 413 U. S. 273, with id. at 413 U. S. 283-285 (POWELL, J., concurring), and id. at 413 U. S. 288 (WHITE, J., dissenting). We held in United States v. Ortiz, supra, that the same limitations applied to vehicle searches conducted at a permanent checkpoint.

It allowed the actions in this case specifically because they were not searches, in the same sense as a traffic stop is not a search, and the police, having pulled your car to the side of a city street for having expired tags, cannot without probable cause demand that you open your trunk to allow inspection.
Use btrfs.
Slide from a talk I gave at Intel (and many other places) 6 years back
Yes. In truth, I am far more likely to be swayed to read a book because some intellectual wrote a positive review, than because of crowdsourced ratings/recommendations.

But that intellectual will not be someone who is placed before me as a generic source of "discernibly good judgement". I'll do the discerning for my self. The critic I follow we usually be a blogger or columnist who I have followed for posts that they write abou their own field of expertise.
I'd make the limit a lot more than 10 lines.

I certainly prefer Perl for large scripts (Python is good too but I happen to know Perl better), but I often have to write scripts for targets that have bash but don't have Perl or Python. Since I've been forced to use bash, I've found it to be a better scripting language than I expected it to be.
John Young, Who Led First Space Shuttle Mission, Dies at 87
Canonical said they were told in November.
This does not protect said CEO from breaking the insider trading laws. Nor does it protect Intel as a company from conveniently "omitting" the elephant in the room in their press releases and financial risk statements.
> The burden should be on the state to demonstrate that voting is secure and accurate

It doesn't work this way. It can't. It's like I am saying "you are a reptiloid alien from planet Nibiru planning the conquest of Earth" and now the burden is on you to prove that you are human and not an alien wearing human skin as a costume. Normal people do not behave this way, and if you claim the election has been tampered with, you need to present at least some evidence why you think so. Otherwise you're just running your mouth (or keyboard) and blowing hot air.

> As it is, the state's position is circular: "we won't give you access to the information you need to prove something

Not true. She does claim there's evidence that something is wrong and she can prove it statistically - we just don't know what it is because there's no reporting on it. So we can not verify whether she is onto something or her statistics is junk and she's just trolling, in which case the state is right to refuse to spend time on her.

> the state should be able to show why there is no cause for concern in ways that allow the public and outside experts to verify for themselves

How would that look like? The vote is secret, for a reason, and if you do not trust the state mechanisms that collect that vote, how would you become convinced that the vote is accurate without some trust in the process? How that mechanism would look like?

> they continue to use machines that have demonstrated vulnerabilities

It is true that the machines have vulnerabilities, as do about 100% of computer equipment. Given that, I am not sure what your proposal it - not using computers at all and count everything by hand? What is the counters are dishonest too? How paper trail would help - personalized vote log is highly private information, and non-personalized one can easily be faked - how do you know if the system didn't report your vote for D as R and vice versa if you are just looking at the stream of Ds and Rs on the tape and don't know which is which? How do you make the system that demonstrably can not be tampered with while you have zero trust in hardware, software or people dealing with it? I don't think it is possible.

Of course, there are mechanisms to prevent election fraud, and they are being used, but each of them involves a degree of trust and can be questioned, and I don't think any of them can be scientifically verified without destroying the privacy of the vote in the process.
I thought it was elegant and civilized to chop somebody up with a light sabre. Have I been misinformed?
The only thing surprising about this is that anyone is surprised.

Only takes half a second to think about where wages are on a balance sheet then tune out empty PR.
Forgot about segments! Time to resurrect them on x86-64 cpus?
Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored:

https://status.npmjs.org/incidents/41zfb8qpvrdj
Smart Home Smackdown: Nest Cam IQ Outdoor VS Arlo Pro 2
With Cryptocurrency, Buy the Substance, Sell the Hype
That makes sense but then the article's claim of losing half the credit cards is only true if we assume even distribution of user activity which seems far fetched at best.
A great example of the problem of even reading Amazon reviews: I was looking for a translation of the Analects by Confucius (more correctly, Lunyu by Kongzi).

A well-respected translation was criticized by at least one Amazon reviewer for its commentary, which veered off-topic, included the editor's own ideas, etc. I ruled out that translation.

Then I read a scholarly review of the translations (found via Google Scholar) and learned that such commentary is the proper way and that it's been done that way for centuries or more. The editor is meant to interact with the Kongzi's text.

If I didn't read the scholarly review, I would have believed the Amazon reviewer. It was a lesson to me - one I finally accepted: No matter how smart you think you are, unless you have expertise in a field then you lack the ability to discern the truth from ignorance. Persuasiveness is not a measure of truth. You're a sucker, a mark, if you think otherwise.

I no longer read Amazon reviews for such purposes and don't trust Wikipedia either. Also, note that reading the Amazon review actually hurt me; bad information is worse than no information.
What's the advantage of Prgmr?
Correct.

The only way you can use those IOUs is if the roles are reversed and the U.S. starts maintaining a trade surplus with the rest of the world (and so the rest of the world a trade deficit with the U.S.).

Before the dollar became the reserve currency of the world, the world settled trade in gold. With gold as the reserve currency it was very important to not run out of gold, and this served to keep trade balanced in the long term (and probably also served to keep the lid on growth of international trade, since to buy one kind of thing you'd have to sell some other kind). Incidentally, the concept of comparative advantages is probably a lot more meaningful in the context of balanced trade...

But the dollar is the reserve currency. Which means that the world maintains a trade surplus with the U.S. Which means they export things to the U.S. in exchange for IOUs that will get them nothing much (it does help to defend their currencies during crises, but not much more).

Meanwhile, Chinese people (in China) are effectively paid less than they should be for the labor they put into manufacturing things to sell to the U.S. This is obvious in that China forces exporters to exchange their dollars for Renminbi, which means those exporters can't buy other things with those dollars than Renmimbi. Also, all those factories in China make things people want in the U.S., not things that people want in China (though maybe there's a lot of overlap).

So my take is that mercantilism hurts the mercantilist. It does also hurt the importer in different ways: by reducing employment, for example, and removing productive assets for another, and these things might hurt more when it comes time to rebalance world trade. Who knows, maybe Chinese people in China and Americans will gladly continue this state of affairs. But somehow I doubt it.
What was the root cause of the issue?
Unfortunately in a lot of environments if you are the kind of person who likes to spend most of their time focusing on politics you can get very far. This is because most of the other people are too busy working to have time to compete with you on a political level. I think this is why we see a certain percentage of destructive people in leadership positions. The only way to sort this out is from the top. But often the people at the top are also too busy to figure out what's going on. It's a weakness in the system that incompetent people can exploit.
Oooh, they referenced both national security and got a "THINK OF THE CHILDREN" in for good measure.
We're using KVM on OpenStack. We use a number of the services and PostgreSQL is our main database platform with our main backend platform being C++ based.

I have performance trending going back 1 year and honestly other than Postgres, the performance #s are like rounding errors. PostgreSQL is getting about a 7% hit on our databases that don't fit in memory.

We also run SAP and again we're not seeing anything. The SAP Database runs on POWER Servers, so obviously unaffected at least by Meltdown.

In our case, there was a major kernel version change, so we're just at the tail end of QC before I can release things to production to begin the rolling restarts tomorrow morning.
It's not clear to me what the best approach is here. The wider the circle of those who know, the more likely it is that there will eventually be a leak. Three can keep a secret if two are dead and all that.
Ask HN: When/where are the Spectre and Meltdown patches for OS X 10.12.6?
Isn't this a case for a microservices, etc.?

Independent teams providing business capabilities through APIs would mostly eliminate the need to keep consistent technologies as long as the interface design follows shared guidelines.
Just the once, though.
We're mis-communicating. You said:

Nothing prevents police or prosecutors from using inadmissible evidence, they just can’t produce it in court.

That statement by itself is clearly false. The police cannot illegally search you and use that evidence as a means to find additional evidence, and then present that evidence in court as if it was untainted.

What I gather you meant now was that parallel construction allows them to do this. Parallel construction is the process by which unlawful evidence is used to direct the attention of LEOs, who, after plainly observing some other crime or probable cause indicator, then conduct a search.

I know what parallel construction is, but what I do not know is why you believe the process is common. Do you have any evidence for the frequency with which it is used? The revelation that it had ever happened was a major news story just a few years ago. Is it your belief that it was common practice, and that even though there are something like 500,000 working law enforcement agents in the US, somehow the secret never got out until recently?

To be very clear: I believe parallel construction has happened and will happen again in the future, but I do not believe it is routine or that any process at CBP is tuned to amplify it.
Agreed that this would be really nice to have! We are working on a compile-time plugin system, so it should be possible to setup something the executes embedded SQL at compile time to allow generation of more dynamic documents.
Ya, I get that, it just doesn’t seem to be always the case that you’d find something to do with the heat, especially given proximity of the coal plant to places that could use it. It wouldn’t seem to work well for Australia, at first glance (no serious heating needs, no desalination plants).
Thanks for the input on this. Shaping the language around how to describe the project has been one of the most difficult things for me so far.
See also the video "A Trip Down Market Street" (1906), recently discussed [1] at HN. Though it arguably weren't "thousands" of walking people.

[1] https://news.ycombinator.com/item?id=15944621
I think he just means it's fortunate from Zuck/FB's perspective, not from the perspective of the rest of the world. The context is startup success.
When was the only other time this problem happened?
Well, that would make it hard to impossible to compare different societies, or the same society at different times.

Even if we ignore corruption and bad incentives, values change.
Yeah, there are some Amish in the area but it isn't an Amish town in any way. The whole Rock Lititz thing they built is pretty awesome. It also brings lots of huge name acts to the whole Lancaster area. Especially Katy Perry, but if you want to see her you have to go to Olive Garden, seriously!
It's almost like the browser is being abused to do something it fundamentally should not be doing. If you need to do that much client side heavy lifting maybe a web browser is not the place for it?

The ship has probably sailed on that line of thinking but in my opinion a lot of the pain we experience in web security today comes from people trying to do things they really should not be doing.
Perhaps BH is a bad example.

How about these:

http://text.npr.org/

http://lite.cnn.io/en

http://valentinpapon.com/

More at the following link, but I warn you some of the websites go to a great extent in the favor of functionalism/brutalist expressions to the point where the damn thing is completely unusable. Cool though, very.

http://brutalistwebsites.com/

Also note the recurring themes:

- Monospaced fonts
- Full saturated blue #0000FF everywhere
- unexpectedly large fonts
- Retro 80's vibe (cursors, fonts, gifs, etc.)

:-) I find all of this very interesting.
How do you not feel embarrassed using such low quality insults..?
Unclear that diversifying helps solve this sort of problem. More vendors could lead to the same number of bugs, but less investment in quality control per product e.g. if you make $1b and spend 1% on quality control, then you spend $10m checking your product for bugs. If the market fragments into 10 $100m vendors, then to get the same amount of money spent checking each chip for bugs, you'd have to spend 10x as much of your budget on quality control.

It gets even worse when you consider the incentives of private/academic/third party researchers to search for bugs, since there is a lot less prestige in catching a bug in a smaller/less well known product. e.g. I'm pretty sure no white-hat security researcher has checked for security problems in the cheap wifi light switches I bought on Amazon.
> incorrectly written program

In principle programs shouldn't stop working just because they are old.

Yes, no language completely realize this. But there's a world of difference between C's "it was written only 40 years ago, why did compilers break it?" to Python's "yes, you are expected to review your code every 3 or 4 years", and there is another world of difference to the faster Javascript frameworks that practice "your code is 6 weeks too old, your looser!"
Most leading book reviews are available online. Try:

* NY Times Book Review: https://www.nytimes.com/section/books/review

* New York Review of Books

* London Review of Books

* New Yorker

Here are a couple of aggregators, but I haven't tried them very much:

* iDreamBooks: https://idreambooks.com/

* Book Verdict: http://www.bookverdict.com/
Yes I'd be very curious to see a debrief on what the technical cause was. Thanks to the npm team for a quick weekend fix, at any rate!
No I didn't. From the article you cited:

"Swan's carbon rod lamp and carbon filament lamp, while functional, were still relatively impractical due to low resistance (needing very expensive thick copper wiring) and short running life."

It also mentions the high current.

As I remarked, Edison's breakthrough was the thin-filament high voltage, low current lamp, which made it practical.
Why not host a validated version of jQuery on your server instead of relying on a CDN?
> Yes, obviously during “rush hour”, the public transport would be a lot more full, but often frequency is increased to compensate.

And during rush hour, the highways are a lot more full, and often capacity (number of lanes) is increased to compensate. If people didn't typically commute at the same time, then busses, trains, and car transport would all benefit from a reduction in required peak capacity. This is not in any way specific to cars.
One thing is probably easier than the other, and can be tackled asynchronously.
One example would be malicious Javascript - or WebAssembly - strolling through your browser's memory looking for passwords to send home to the mothership. Or other sensitive information, like credit card numbers and so forth.
> Does this still happen, given the rise of the torrents, on-demand streaming, and the way TV shows distribution tend to be spread out over time?

Those are all near instant. They compete with cable TV.

One reason it happens is that right after the broadcast, Facebook will be full with jokes and spoilers. Whether you see that depends on your bubble, and whether you use/visit Facebook. Same could be true with school & work.
I take it you're replying to me? My little software empire also keep local copies, that kind of defeats the purpose of using git for teamwork or package management to keep dependencies in check.

These are building blocks in a normal dev environment, and it would take me massive amounts of time to manage everything on my own.

The local copies are fragile and not as easily shared.
It is the "write the created disk image into a physical disk" that is the hard bit though :-P. It has some tiny HDD. Although now that i think about it, i wonder if it can be used with another laptop that i have. That one only has a floppy disk, but it is still better than nothing.
I got this today as well! WTF? It showed up today and is preventing me from using npm, node, etc...
It wouldn't be that hard to skew different regions plus or minus one minute; that'd still be close enough to "live" that it wouldn't matter.
Don't forget the audio recording industry, electric car batteries, mining advancements, the carbon telephone microphone, innumerable major advances in telegraphy, the electric power utility, etc.
The npm repository is the largest package repository in the world. A lot of the major incidents they've could have happened to other ecosystems (e.g. PyPi allows a user to delete packages that other packages depend on), but they've either not happened or haven't had as large an impact. When npm breaks, everyone notices, because everyone either uses npm or knows someone who does.
Chrome is the only OS that makes this ridiculously easy, I think..
Gentoo makes it easy: https://wiki.gentoo.org/wiki/Distcc
The problem is chip R&D is super capital-intensive and the space is highly competitive even with so few companies.
Given that Javascript is a known attack vector for the very bugs he's talking about, yes apparently he does know better.