skysight-inc/HackerNews huggingface dataset:
I've stopped wondering about NPMs structure. But still: Our bog-standard in-house java development setup would be unaffected by this class of problems. You need some kind of private maven repository, and nexus or artifactory automatically mirrors downloaded dependencies. And on top of that, versions are pinned per default. So new malicious versions wouldn't be used either. We could safely build new hotfix releases even with maven central 100% down or compromised.

Granted, we do depend on bitbucket. However, I am honestly scared to self-host our code. This is a small but old shop, so the entire code base is easily several million dollars worth in man-hours alone. And then again, it's git, so if push comes to shove, we could easily and quickly spin up an internal gitlab instance and push our stuff there to get back up.
I don't have windows installed, but it's highly unlikely that it'll help. This feature is baked into panel firmware, and while Dell releases firmware updates for some models, there is no official fix for 9360 FHD. For models with the fix there are two versions of firmware: with CABC support and without. Switching requires firmware reflash with a special vendor tool. So it's unlikely that there is a dynamic setting to switch it off.
How do you write a portable shell script? The programs invoked by your shell script need to behave the same everywhere. Even fundamental things like cp, rm, etc. don’t universally behave the same across the various Unix and Unix-like systems.

The joke is that your shell is actually more portable than your shell script :)
> But HN user "baby" recently made a blockchain based image board that was theoretically impossible to control. How would people behave in such a situation? Who would you even punsh?

Probably will get scooped up by pedophiles sooner or later, followed by a couple high profile arrests and everyone will be scared shitless to run a node for that blockchain. CP has always been a good source of scare for Tor exit node operators, thankfully enough Tor nodes don't store the stuff in contrast to a blockchain - so at least the operators didn't have to serve jail time but a couple have had their houses raided by the cops and all IT equipment confiscated for months.

Actually, from a libertarian POV I really like the idea, both behind an uncensorable imageboard and Tor, but the simple fact that pedophiles and Nazis can and will abuse the openness for their vile gains makes me believe that the world will probably never be ready for such a thing as widespread service. For now we as society have to be lucky that many pedophiles, drug dealers and Nazis don't really care about good opsec... but that one is bound to change.
Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared.

This isn't a standard practice in JS world?
>> Let's take a word that has an absolutely precise meaning, namely dynamic, in the classical physical sense. It also has a very interesting property as an adjective, and that it's impossible to use the word dynamic in a pejorative sense. Try thinking of some combination that will possibly give it a pejorative meaning. It's impossible.

Now I have to try:

"Dynamic, multimodal failure" (fail).

"Dynamic instigation of pain for information retrieval" (torture).

"Dynamic evisceration of underage humans" (slaughtering of children).

"Dynamic destruction of useful resources" (environment destruction).

"An algorithm for calculating dynamic stool-rotor collision physics" (shit hits the fan).

Not terribly good I guess but I think not that bad either.
The sheer number of software development organizations who cannot function when github or their package repository happens to be unavailable (for whatever reason) is incredibly disheartening.
You triggered the special snowflakes. JS community is full of them.
https://www.un.org/development/desa/publications/world-popul...
this is not a response?

http://blog.npmjs.org/post/168978377570/new-package-moniker-...
NPM specifically asks people to not try and republish the broken packages while they repair it. Incident status:

https://status.npmjs.org/incidents/41zfb8qpvrdj
Or just don't .gitignore node_modules, then diff any changes to node_modules on update.
Not familiar with SQLAlchemy. May I ask where do you host the search index and also why you decided to leave Algolia? Thanks.
> You can setup mirrors for dockerhub... Or any docker registry.

But you can't make dockerd talk to this mirror by default, unless you're running the fossil Redhat fork. That is the problem: if you want to use Docker, you must open up your server to the Internet, and the entire Internet at it as the Docker infrastructure is loadbalanced and there are no guarantees the IPs will stay stable.
You can use the <details> tag for that: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/de...
Probably not, since they also can't be denied entrance by executive order. But I'm not a lawyer!
While it may not be the right time to _start_, incidents like this are an excellent reason to consider an internal read-through proxy package repository. The last couple of organisations I've worked with have used Artifactory: https://jfrog.com/artifactory/
Detailed description what you could do with a malicious npm package is currently on he front page: "Harvesting credit card numbers and passwords from websites"

https://news.ycombinator.com/item?id=16084575
We know that parallel reconstruction is "common"? Can you back that up with evidence?
I do my best to apply my own formula: after all, if I don't think it's worthwhile to do, it would be disingenuous for me to recommend others to do it. I think I do understand where they're coming from, which is why I built upon that in my follow-up comment.

Re-reading my comments above, one thing I think that could be improved is the use of "you": it's colloquial to use it to refer to a person in general as opposed to the person you're currently responding to, and that can be misread (perhaps even unconsciously), particularly when discussions get heated.

Do you have other recommendations as to how this might be better conveyed? What indications do you have that I'm misreading 'chickenfries? I recognize that whether I actually am misreading them (which is always a possibility) and whether or not you read me as misreading them are distinct, and it's my responsibility to do my best to reduce the likelihood of mismatch.

As for your last paragraph, ff you've determined your conversation partner is not actually interested in having a discussion, in my opinion it's best to just let the matter drop, which is what I recommended in my initial comment. You're right, I don't think it's fruitful to create a position for them. Continuing the discussion at that point just adds noise and arguably degrades the forum. FWIW, I'll take my own advice here if I decide that my contributions to this thread are contributing more heat than light.
Does not work as soon as you use node modules that come with native components that have to be recompiled for the machine, and there are many of these.

Colleagues have been bitten by this - one used OS X 10.11, the other 10.12, and they experienced weird bugs from this. Went away once they kicked out node_modules from git.
You can make your statement more accurate by saying that a clock will measure vanishingly little time as you get sufficiently close to the 45 degree line. But the 45 degree line isn't achievable.

(Note I've made the same inaccuracy further up the page. Sometimes it's just easier to drop the epsilons and speak informally.)

Physicists are precise people :)
In my org, we use Artifactory as a cache between us and external sources. They have a free version too. I'd encourage everyone to use it, or something like it. Stop pointing your package managers to the public registry.
Major customers are absolutely the primary revenue source. AWS revenue follows the pareto principle.
> The entire point of ‘raw water’ is that it’s unfiltered and untreated

Applying UV light wouldn't make the water non-raw, since it's not heated above 104 degrees or whatever raw food people believe is the magic number.
This is amazing! I remember having to study and draw some of these diagrams in an undergraduate Philosophy of Space & Time class.
It's not necessarily helpful, since "Python" doesn't indicate 'single-threaded' or 'multi-threaded', and whether or not your threading is constrained on outside resources (MongoDB) or purely internal worker calculations, and etc. But it's interesting!
Well, the packages seem to be all from floatdrop[0].

[0]: https://www.npmjs.com/~floatdrop
That boundary is in 45 degree angle for a reason.

Spacetime interval is lightlike when spacetime interval is zero (Δs²=0). Spacetime interval is zero when Δr²=c²Δt². In other words light moves exactly as much in time (t) and space (r).

If you want to see 'lights point of view' in spacetime intervals and not in the block universe model, every reachable spacetime location is zero distance away. The whole cone, not just the boundary is just one dot (light can travel into any point inside the lightcone using mirrors) and outsides are removed.

.

edit: the whole eqution is Δs² = Δr² - c²Δt². If we write all coordinates x,y,z,t open, the distance is Δs² = Δx² + Δy² + Δz² - c²Δt². Otherwise nice euclidean distance measure is screwed by that minus sign before time that makes spacetime hyperbolic.
That’s probably fine from the security perspective, but the hash won’t make the package re-appear if it disappears out of nowhere. That’s the other benefit of a private/on-premesis mirror.
Nope, it might use TCP for negotiation of things that aren't time sensitive but it uses UDP for replication[1] as has pretty much every Unreal or Quake based engine since they were first developed.

I've worked on a variety of engines which were either UE or Quake based. All of them use UDP for temporal game state updates to avoid head of line blocking[2][3].

[1] https://answers.unrealengine.com/questions/197713/is-replica...

[2] https://stackoverflow.com/questions/39323556/why-do-game-dev...

[3] https://www.gamasutra.com/view/feature/131781/the_internet_s...
I don't see it mentioned in the README, but is this something I can package into a distributable package?
A similar project, but for C/C++/Go (using gtk-webkit, cocoa-webkit and mshtml):

https://github.com/zserge/webview

Does not require a web server (uses JS-to-native bindings instead), which might be a benefit.
Why assume they’ve already seen it? They probably just haven’t
Can't help but wonder if committing node_modules to your repo is now a good idea...
Why would you allow that to happen?

I don't think there is any part of my little software empire that is dependant on code for which I don't have the source or underlying .dll checked into source control.

It's part of your project. You absolutely need a copy of it.
Ask HN: What would you do with a team of ML engineers and 3 months time?
Hi HN,

Say there is a team of 5 Machine learning engineers that are booked for the next 2 years with 3 month "free" time before start and no projects/agenda but doing kaggles to get warmed up. What would you do/build/dream if you had this work force at your disposal?
Yes you can, that's the purpose of the mirror. To do this you set the "--registry-mirror" option on the daemon.

The RH fork doesn't let you do mirrors, it let's you change the default registry, this is very different.
How are these going, by the way?

- https://github.com/elsehow/gx-js

- https://github.com/ipmjs/ipmjs

- http://everythingstays.com/

- https://github.com/pnpm/pnpm

- https://github.com/nginnever/ippm
I used your explanation in a longer note, "Spectre: How do side-channel attacks work?"[^1] to try and explain how side-channel attacks work (partly to myself, and partly to non-hackers).

[^note]: https://www.facebook.com/notes/petrus-theron/spectre-how-do-...
yeah it looks like one user's packages just disappeared from their database.
> "I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me."

I share your concern. It's a tradeoff: tools that do this are very convenient, and the people who have thought about it have decided in some cases that convenience outweighs the security or stability aspects. And people can make that determination on a case-by-case basis.
It is at big orgs, but not small shops.
I’ve worked at places where the Java devs used Maven Central directly. I’ve also worked at a place where the Node devs use an on-premises copy of dependencies for builds and deploys.

It might not be as standard a practice in the Java world as you think.
You can tweak the experiment to get arbitrarily close to 0% chance of exploding the bomb.

Instead of using a 50/50 beam splitter and passing the photon through the system once, you pass the photon many times while gradually rotating it from the free path onto the bomb path. If the bomb isn't present, you end up with a photon on the empty bomb path. If the bomb is present, the zeno effect will keep the photon on the free path. Then you just check which path it ended up on in the end.
Yes, for those who use `yarn`. (Yarn's package caching looks a lot like Mavens)
Yup, this is pretty much on the mark. Game updates are sent at a fixed rate(usually 10-20Hz) so you could batch up all outgoing game state into a single dispatch. It'd probably take a bit of work re-architect the output loop(pre-allocate for max number of players to avoid per-frame allocations) but should be reasonably straightforward to implement in most engines.
It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.
broken concepts get re-validated :)
What gives you more confidence in them? Just a better track record, or is it a fundamentally more reliable model?
It's useless in cases like this though, where the package is already invalidated in the yarn cache, which is the case right now for many packages.
When they said "30%" they really meant it: the usage went from about 10% to about 40%, for an increase of 30.
Most Internet content providers have advertising, sometimes invasive based on my browsing history — YouTube, I am looking at you — to offset costs or rack up profits. Therefore, your beef with broadcast networks based on advertising is on shaky ground. There are many reasons to dislike broadcast TV vs. Internet content, but advertising cannot be one of them because both mediums have it.
I’m certain no one at Atlassian wants to stifle Trello. Trello is Atlassian’s Instagram.

By the way did you see Trello is now part of Bitbucket as a default?

What exactly was HipChat competing with in the Atlassian portfolio when it was acquired? Nothing. HipChat was three people when it was acquired. It was over 100 not long after. That space grew so fast that you could argue maybe Atlassian should have put 200 on it. Regardless, it got the biggest investment of any group chat tool in the game at that time. Slack did an amazing job in the viral growth front. Credit to them. Atlassian is beefing up HipChat for enterprise/BTF and launched Stride for everyone with an email address and a need for something more focused than slack.
Just today, someone posted an article about how malware can be distributed via npm:

"Harvesting credit card numbers and passwords from websites"

https://news.ycombinator.com/item?id=16084575

If you self-host a stable version, you'll have some time to hear about potential problems in a new version before updating it.
> The Supreme Court disagrees (Almeida-Sanchez v. U.S., U.S. v. Martinez-Fuente),

Martinez-Fuerte sharply limited Almeida-Sanchez: Almeida-Sanchez (1973), it's true, seemed to require warrantless border searches to be at the border, but Martinez-Fuerte (1976) allowed warrantless “border” searches at immigration checkpoints on public highways leading to it away from the Mexican border, even without any individualized basis for suspicion (much less probable cause) or when the decision to make stops was based entirely on the perceived ethnicity of drivers/passengers.
Downvotes? What did I get wrong here?
As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..
This was the officially recommended solution for long, but suffers from a few issues. Most notably for me is that pull requests that change any dependencies become impossible to read (on github at least).
cool except it's not self-hostable/oss. why would you use a hosted frontend for a local app?
Would be interesting to see the load curves on github and npm servers due to people and servers retrying downloads.
We use Nexus at work and have linked up NPM to it along with several Maven repos. I don't know why anyone wouldn't do this if they were a business.
> By convention, everyone processing the blockchain looks to make sure that the new blockchain they get is a descendant of the previous blockchain they already have.

This is not true. Bitcoin-esque blockchains are NOT append only. The only thing clients do is: 1) ensure the blockchain they have received is valid, and 2) that it is longer (more total PoW). If those conditions are met, they will consider that new chain the current chain.

You can come up with a new, completely different sequence of blocks, send it to clients on the network, and get them to start using that new chain instead as long as it has more PoW.
Portable WiFi Analyzer
Yeah, it’s an annoying problem. Maybe you could gitignore the *.node (the native module file extension) files only. But I’m not sure how you’d rebuild those “on demand” after a checkout without running 'npm install' from the top level.
Why Weddings Are a Scam
What's the syscall/sec per CPU rate for this workload? My guess: over 1M.
> The exact issue we're talking about here has been tried all the way through the Supreme Court, which found that the border search exemption only applies to people with some nexus to an actual border crossing.

Wrong. It found that warrantless “border” searches on public highways leading to it away from the Mexican border were legal based on either perceived ethnicity of drivers or passengers or even no individualized basis for suspicion. No nexus between the searched person or vehicle and an actual border crossing beyond being on a road which eventually led to or away from the Mexican border is required.

It's true that the only places that the decision applies to are public highways, not (e.g.) the interior of residences or businesses, so it's not any place. But it's pretty extensive.
I completely agree with you on that. We have built a 3d try room using nothing but three.js

http://sensestyles.com/tryroom
"How many people are doing that?"

Probably very few. AFAIK, wired keyboards were never officially supported. Plus one needed the "Camera Connection Kit" adapter (later rebranded as Lighting to USB connector). Plus some USB keyboards would not work.

The only officially supported keyboard option was bluetooth keyboards.

In the real world, I have never seen anyone plug a keyboard into an iPad. I have only seen people use bluetoth keyboards.
That's okay, but it's not enough - it's easy to swap two letters and do similar substitutions to fool many users. If a package is downloaded 10,000 times every day, surely once in a while someone will misspell the name somehow.

Other than that, their reaction to similar incidents was to wait for somebdoy on twitter to notify them, ban the responsible users, and hope that it won't happen again. It's still extremely exploitable and there are surely many other novel ways of installing malware using the repository that we haven't even heard of yet. The NPM security team is slow to act and sadly doesn't think ahead. They're responsible for one of the largest software ecosystems in the world, they should step up their game.
seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.
As a kid there was a military air base in the neighboring city, so fighter jets passed our home regally. It was always fascinating that the sound and the plane where on different locations. You could always hear them but it was hard to spot the actual plane in the sky. Now imagine if they jets where going faster then light and that light was a bit slower so we could see them. That would mean the visible position would be different then the physical position of the plane ...
That's what the article is recommending.
Having additional copies is always a good idea, but you already get that by just installing the modules on developers' machines.

At some point you have to trust a third party. Even if you run your own hardware, you still depend on power and internet provided by someone else. And unless you are a massive company, time is typically spent much better on other things than hosting your own NPM packages and git repos.
Again, I am pretty sure that they were disclosed the details. This however is very different from being able to commit patches on the day of the disclosure. For one, neither Linus nor Greg are actually writing the code.

The problem here was that discussion was confined within company barriers (with small occasional exceptions) until last Wednesday. Linux thrives because it is based on reaching consensus among all stakeholders, and not being able to discuss the approach to take with respect to Spectre directly resulted in chaos.

I am very happy with the work that we at Red Hat did on this project (though of course not perfect in any way!) and I am proud that our articles are published openly and are being widely shared among the Linux user community at large. However, I certainly would have preferred to work together with all other vendors on a common solution before. But unfortunately, even if (as is the case with Red Hat) upper management is extremely supportive of upstream collaboration, you do what you can.
After the first time I took LSD, I, too, noticed an elevated mood for several weeks afterwards.

I was not depressed at the time - I might have been a little down - but my mood was better - things that used to annoy me now annoyed me much less, while things that used to make me happy made me even happier.

Since LSD and Psilocybin are so similar in their effects, I would not be surprised if the mechanism turns out to be the same.

Now that I think if of it, I remember a mushroom experience when I was maybe 19 or 20 years old, and, at the time, quite unhappy about my life, quite likely even depressed. I did mushrooms with a friend whose parents were on vacation. The trip itself was very depressing. But when I woke up the next morning, I was happier than I had been in months, and that, too, lasted several weeks.
Shameless self plug: You should check out my Youtube channel. I have a playlist that I cover Webgl (not 2) https://www.youtube.com/watch?v=oDiSqQT_szo&list=PLPqKsyEGhU.... I've done 108 WebGL screencasts, everything is built up slowly over time from scratch (so nothing is hidden away), and covers a lot for beginners to include covering drawing multiple things. Cheers!
Google “parallel reconstruction stingray” or “parallel reconstruction dea”

Nothing prevents police or prosecutors from using inadmissible evidence, they just can’t produce it in court.