skysight-inc/HackerNews huggingface dataset:
Weed revenue is federally illegal. I think that's ridiculous, but buying crypto with that money in order to buy clean money is still considered money laundering under federal law.
Haven't read the book but the lectures are good!
https://youtube.com/playlist?list=PL2SOU6wwxB0uwwH80KTQ6ht66...
What hasn't?
It definitely doesn't have all the whistles and bells of Evernote, but maybe all the OCR and stuff isn't what you're after?
Could data become part of UNESCO's world heritage? Nowadays alot of culture happens in the digital space and it's always a tragedy when huge amounts of cultural creations just vanish into nothing. Web archives are perhaps not enough, lots of content are inside walled gardens, convincing a company to release all that information is a different question of course :)
Minutes before reading this comment I sent an email to our team to verify our artifactory did not download any packages over the weekend. Most likely not as nobody is working (to add a new one or update a version) but better safe than sorry. +1 for artifactory cache.
>in my opinion it's best to just let the matter drop

Sure, because you're focused on the quality of conversation. That's what you're optimizing for. For others, who are interested in the quality of available information, posting a quick rebuttal to signal to other readers that the post in question has issues may be preferable.

I see plenty of misleading and dangerous musings about law on the forum from people who don't know better and frankly don't care to know better; your advice would be to walk away. Mine is to signal to individual that there is clear and present danger in treating the post's content as factual.

You view that response as creating noise. I don't.
If you only need NPM support we are very happy with npm-register[1]. I also heard good things about verdaccio[2].

Plus you also get private packages.

[1] https://github.com/jdxcode/npm-register

[2] https://github.com/verdaccio/verdaccio
maybe it's time to push for adding signed packages to npm

long discussion here: https://github.com/node-forward/discussions/issues/29
The GPUs are even more out dated than the CPUs honestly.
Ubuntu’s kernel package updates are pending.

This Ubuntu Wiki page is being updated with relevant information and package updates as they become available:

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
I'd say it's a sign of the quality of the video.

Much of the reason we think the past seems so far away is that the media it was recorded on was either not so good to begin with, or has deteriorated over time.
Maybe you should have counted to 10 before writing a comment calling someone a "tool"?

Seriously name calling? Your comment contains 3 swears and name calling and you want to talk about another's "stupidity." Amazing.
Somehow i imagine a native C-Desktopdev and a Webdeveloper meeting in No-Mans Land each party escaping from its own nightmare with that line on the lips, starting with a "Dont run into this direction-"
Your idea is awful, but you really shouldn't be downvoted.

It is better to use content hashes and a system that distributes and enforces these, like IPFS.

Someone could just create some hooks for https://github.com/whyrusleeping/gx and we would have it done.
So people don't ever get signing bonuses either then, right?
Gotcha.

ps. Don't assume that people don't understand something just because they don't hold your opinion.
JS ecosystem is pretty well know for changing very fast compared to other mainstream languages. This is a fair point, NPM could implement the local cache without (hopefully) breaking anything
Not yet - keep an eye on their wiki page for Meltdown/Spectre:

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
Do you also run all processes on your server as root?

If you’re not going to apply patches that close privilege escalation bugs, you might as well. You’re putting all your security eggs in one basket.
Sure, I completely agree. It strikes me as unnecessary, however, for a manufacturer to deliberately add a counter-intuitive and indeed dangerous element to a device commonly used for backup. In particular, many home backup systems are not created by experts who might think of things like this.
How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown
Eelo: Open source smartphoneOS that is more focused on data privacy
It is fundamentally more secure as it functions as a private controlled proxy for the public repo. Also solves some other nice gotchas such as people pulling a left-pad joke on you and reproducible installs as all packages are cached so your build servers and dev systems get the same version of all packages (if properly used with shrinkwrap kind of solutions, or even without if properly handled).
A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards.

I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breaking. If everything is a house of cards, then why don't i hear the same stories about PyPI or gems or crates?
Extensive recent discussion: https://news.ycombinator.com/item?id=15482558
> But his/her definition of "partial execution" only considered state changes to the programmer visible CPU architecture state (i.e., the user level register set and the flags register). Their definition ignored the cache, because at the time the cache was considered simply a transparent optimization system that did not effect the values of contents of the CPU architectural state.

You're putting words in other people's mouths here.
BBC2 Documentary the Great Crash 1929
I take it that you've never had to work at a big organization? When you have multiple teams in different offices, it's incredibly difficult to constantly "herd cats" and point everyone to $latest_fad. And when you DO by some miracle get everyone (devs and management) to switch to $latest_fad, it's a huge pain to go back through and bug test/change every process to accommodate the new software.

I don't think "people should stop making and switching to new things" is a fair distillation of the parent comment, as it seemed like they were just expressing frustration at the blistering pace the Javascript community is setting.
I always wondered how a database would know which transactions to commit first in a relativistic world?
Not exactly sure what you mean. The foundation of philosophy is logic. Also the idea that "math in which we trust" is kind of bizzare, as mathematics is an axiomatic system. So really, it's the axioms in which we trust. But that also opens a whole can of worms, because some axioms are kind of weird and controversial (like the Axioms of Choice, Replacement, Regularity).

Not to mention that any for any system (> Peano Arithmetic) you can't have your cake and eat it, too; sound, complete, consistent: pick two.
Shouldn't be different to any other server. I've not heard of it happening. However I've heard of many bugs in Overwatch which let you crash the server via in-game actions and kick everyone out.
youtube username 'youtube pedant' is actually techmoan, and hes done a great video all about DVHS and its context here: https://youtu.be/jiu0LPeLQPE
Show HN: Memeois – a personalized approach to memes
They're referencing the Bible: https://www.biblegateway.com/passage/?search=Ecclesiastes+3&...
Provisional offers are common in the UK if the company uses references (which are being used less often nowadays) or requires a DBS check.
Launching My first Side project
from their perspective, to charge people, I guess
>> It’s sort of like paying for the internet connection and still paying for the content. No thanks.

Every streaming service works this way.
Yes, of course. A centralized repository for a package manager is always going to be a single point of failure.
What is Opus? Here’s all you need to know about SoundCloud’s new audio format
Not in this case; the bash manual is not in Info form, but a regular old-style Unix man page.
yarn does local caching in developer laptops. What GP is referring to is having an on-prem private dependency server which acts as a cache and proxy to the centralized public dependency repo.
http://acko.net/ is a good example of how visualizations can make articles better.
With the (apple.com) it looks like an official release
> Amazon and Goodreads ratings, and numerous online book-reviewing sites, have all contributed to and reflected the democratization of the arbitration of literary taste. But such democratization is not intrinsically a good thing.

Same phenomenon, though, occurs with TV/Film. Brett Easton Ellis's podcast riffs (extensively, caustically and yet wonderfully) on this "democratization of art" as it occurs in TV & Film.
It actually is self hostable (that's how quite a few of our customers use it), but no, it's not OSS (because we needed to build a sustainable business).

Anvil isn't for distributable desktop apps (that's not where most of the action is these days, for better or worse). But we use it for one-offs (driving local code via the Uplink) all the time.
Because each thing has a constant price in learning effort that is familiarizing yourself with its idiosyncrasies, which you have to pay even if you're experienced in the domain. When tools constantly get replaced instead of improved, you keep paying that price all the time.
It's a shame there are enough edgy teenagers making npm packages that such a policy is warranted
If you are interested in this, check out the formalization of space time in geometric algebra. It kinda makes sense! (i.e. more sense than in other formalisms) https://en.wikipedia.org/wiki/Spacetime_algebra
To use (whatever is your provider, often Google's) cache, just replace the protocol with "cache" like this:

cache://www.unixprogram.com/churchofbsd/

Or use the Internet Archive / WayBackMachine (from 5.1.): https://web.archive.org/web/20180105140154/http://www.unixpr...
During the launch of the Apollo 16 mission, Charles Duke had a heartbeat of 144. It’s an absolutely natural response to the sensation of 7.5 million pounds of thrust lifting 95 tons into orbit. John Young was commander of the mission. His heart rate was 70. When asked about this he simply replied in an even voice:

“Yeah, well mine was too
old to go any faster.”

The above is a quotation from
https://medium.com/@room_n/john-young-the-astronaut-fe2c1076... which was submitted to HN some 9 months ago and got no attention. There have been a couple of other submissions[0] about Capt Young's passing, but I remember the way T.K.Mattingly, Tom Stafford, and Charlie Duke all spoke of him. They all considered him one of the best they'd ever worked or flown with.

As Scott Kelly said: Fair winds and following seas, Captain.
Very nice so far! Could this run an actual shell (bash), with support for a .bashrc (aliases!) and readline?

Could there be compatiblity wrappers for rsync/scp, falling back to curl?

I'm also not that into green on black. Any plans for themes?
This is called postmodernism. If things aren't the way I like, it must be a conspiracy, if necessary by the entire world.
i use yarn-offline-mirror and save all tarballs in the repository, works fairly well.
That would be amazing. Flying above the clouds with unobstructed sun hitting the panels you would imagine should be possible one day.
I agree that it's important to point out things that are actually harmful. That quick rebuttal needs to include more than a snarky snipe, an insult, or a statement that "No, you're wrong." If that's all that's being added, you may as well just downvote, which is, among other things, an indication that the comment isn't a worthwhile contribution.

To be useful and more than noise, it needs to actually rebut the point in line or pointing to additional resources. HN is pretty good on that point: the community is large enough that it's going to get addressed well. Quality of conversation and quality of information needn't be at odds, and both are addressed in the guidelines.
Can you do a quick guide?
This sounds extremely usable!
> These vulnerabilities affect everyone, and only a special few were allowed to prepare in advance. That's just preferential disclosure.

In this particular case, most of the fix had to be done in the operating system (the new microcode only enabled extra functionality needed by part of the operating system fixes), so it makes sense that operating system developers were allowed (and required) to prepare in advance. The three most relevant operating systems are Windows, OSX, and Linux; for Linux, one of the most important distributors is Red Hat. That gives two of the groups which were notified in advance: hardware (Intel, AMD, ARM) and operating systems (Microsoft, Apple, Red Hat, a few others).
Yup. The best answer I can come up with given their constraints (some self-imposed) is to force all new packages to be scoped.
Would it be possible to have an 'open' command that opens any file in their respective app? Maybe even configurable aliases like 'vim' to open files in a specific app (iVim) -- hence my other comment about support for a .bashrc
That's categorically false.

https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree
Already done https://github.com/diasdavid/npm-on-ipfs tough it doesn't seem to be mantained anymore.
HttpLive – HTTP Mock tool written natively in Go
> democratization is not intrinsically a good thing

Isn't that heretical, and deserving of - what's the word nowadays ... oh, yeah - "consequences"?
Seems great! Any plans to include ssh and/or mosh?
Isn't that what chef and Capistrano are at some level?
Can you link me to the incident where a person deleted their packages and broke Babel? I'd love to read about it.

Edit: grammar
There is this trade-off between usability and security. For example being able to load data from other domains, now with origin policy we have do fetch the data server side. One nice thing about web apps is that they do not require a server to work. But due to xxs injections we cant have nice things.
> I think the 10 line limit seems a little harsh.

I think it's a fine guide. If I'm writing something that starts approaching a program rather than a few lines of utility-throw-away, it's time to at least immediately start co-developing in something more sane. My exception is for Makefiles, if one considers them "shell".
Which case are you referring to?

Also, I can't tell if you're nitpicking my summary or if you actually do believe there's a 100-mile-wide Constitution-free zone hugging the US border.
I'm not proposing the following as a solution to your problem, which I'm sure is on a much larger scale, affording many opportunities for failure. I'm curious how it breaks in that context, though.

I regularly use a script like this, and it's never failed me unless it runs out of disk space: https://github.com/coventry/InformationDropout/blob/master/p...
> it's nearly miraculous efficacy at stopping cluster headaches.

Relevant talk from Horizons:

https://vimeo.com/10918637
>"I think the guy was just priced out."

Indeed and I think this happens all the time. Recruiters play lots of games. They will reach out to candidates and get them into the interview pipeline in order to demonstrate to the company that are actually doing something meaningful.

I think that often times the recruiters are not forthcoming with others about the candidates salary expectations. I believe this results in lots of late stage rejections after many rounds of successful interviews. This costs recruiters nothing but candidates lots of time.
This is insane. This is like Google changing their v1 APIs, except worse since ANYONE could come in and put new malicious APIs up in its place. I say this as a firm supporter of Node and the ecosystem - this should NEVER EVER be allowed to occur. This completely erodes the trust model based around "popular packages" even further - the only saving grace is that hopefully most devs are shrinkwrapping their modules.
Fire and Fury by Michael Wolff Audiobook #1 [YouTube]
I’ll have to check this out on my computer later, since it’s unreadable on my iPhone 7 (left half of screen is solid grey). Looks cool though.
The primary discussion seems to be here:

https://news.ycombinator.com/item?id=16087024
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine. Hmm.

Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring, the first thing I'd do would be, get a bunch of thugs together and knock on the front door of a developer of a widely-used package; "help us launch [the sort of attack we're seeing here] or we'll [be very upset with you] with this wrench." Is there a valid defense for a platform whose security relies on the unanimous cooperation of a widely-scattered developer base?
Thankfully we now have package-lock.json
Dougong
Relativistic systems still behave causally; What observers can't agree on is how much time passes between events. The database is just another observer, so it would commit the transactions in the order that light-rays arrive. The requirement to preserve causality is why there is an upper bound on the speed of information, so that all observers can still agree on the order of events.
The fact that Intel is rumored to have know about this since June lends credence to your belief, however if that week would have let OS vendors have updates ready, and cloud providers already patched, then it would be less of a disaster. There's a certain amount of flailing about when details are released earlier than expected, and vendors don't have a answers or instructions prepared.
Oh. The setting works in Windows on my XPS 13, but I have the 3200x1800 display. I disabled adaptive brightness the day I bought it, because it annoyed me for the same reasons.
This in particular is a huge trust failure - working with mutable/replaceable libraries is like working with mutable/replaceable APIs.
The Empathy Gap in Tech: Interview with a Software Engineer
I finally found the changelog for the patch that Red Hat applied to their kernel: https://git.centos.org/patch/rpms!kernel.git/6202b1a49906b21... (scroll to mid)

I think we can say that Red Hat does have its own implementation for now.

edit : formatting
have you done them? i would say its a pretty accurate description of my experience. every time ive done them, ive found aspects extremely uncomfortable, but by the end i almost feel a sense of accomplishment. i know people read comments like this and imagine an idiot who is easily swayed by bullshit, so ill offer what i thought of as the most tangible interesting things that comes from taking mushrooms: many things that happen automatically in your brain seem to stop when you take mushrooms. for instance, it was no longer obvious to me what time of day it was, or what day of the week. it was very interesting to experience this, because it had never been something id been without, and it had never even occurred to me as a thing that could not be obvious. so seeing that it was a process like anything else is very eye opening.
Did NPM not learn from the leftpad incident?
I remember cross-compiling a very stripped down linux for a 486 25 mhz laptop with 20 mb ram around 2000. I had tried a standard debian first but it was dogslow. The trick was stripping everything down so it fit into 20 mb ram without swapping, then it ran fine. Tweaked the compilation options of everything on there to squeeze every last bit of ram out of it. I wrote most of a C++ web app on that machine, with an older opera version to test with. That was a super fun project.

Maybe the slow startup times from the article are swap-related. Shutdown taking five minutes is a dead give away.
Remember to freeze your packages after installing them as a project dependency. You should have the packages in your source tree or your own internal package manager (local nuget, for example).
Completely agree. Tried them both and found Docker Swarm to be much simpler to setup and maintain.
shellcheck is amazing. I write enough shell scripts that I remember most of the syntax and tricks, but am far from an expert. shellcheck has taught me so many things and makes me feel more safe writing scripts in the event I forget one of the million gotchas.
Another idea: would it be possible to mount cloud providers (Dropbox, iCloud, etc)?
That would probably get removed from the walled garden.
The more I know about how Intel has managed the information, the less I trust them. What a disaster. CEO and all the Press and Communication team of Intel should be fired
How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package name from being claimed by someone else?
module.exports = typeof Promise === 'function' ? Promise : require('pinkie');

I can't even install webpack-dev-server. Because this package is missing.

EDIT: it's back

[1]: https://stackoverflow.com/questions/48131550/nodemon-install...

[2]: https://github.com/npm/registry/issues/255
On the other hand, if you aren't affected by what a successful attacker can do, you're in a good place.
Reminds me of this genius talk: https://www.destroyallsoftware.com/talks/the-birth-and-death...
This is neat and I have some older systems (like the Transmeta based Gateway Connected Touch Pad) that I'd like to get back up and running and there are some good ideas in there. However, calling a 486sx "ancient" is a bit of a stretch... (my oldest working computer is from 1981 and that's far from ancient).
We really need to hear from NPM why this happened.

There is currently no way for a user to remove their own packages or unpublish packages anymore from the public NPM API ( a change following the `left-pad` incident ).

This leads me to believe this was an internal NPM error. My guess is employee error.
Annotating Web Audio
How U.S. Intelligence Agencies Underestimated North Korea
Can't see how. Like all iOS apps, it's sandboxed.
Great arguments. Add one: bash is a more lightweight dependency, frequently available even on windows, weird *nix versions and minimalistic environments (e.g busybox linux, fresh arch install, ...).
> Ceph tough to setup

Try ProxMox. They have it built-in.
Isn't that how RubyGems works?
Only if you have a file system that automatically deduplicates everything, or lots of hard drives...
How Piracy Changed the Lives of the Nicobarese
Thought I'd share our graph too: https://www.jitbit.com/alexblog/270-cpu-usage-stats-after-pa...

Seeing almost 40% increase in CPU load
I'm not sure to be honest, I think it would probably work - you could just bundle all the dependencies (apart from the browser) using 'pip download eel' - that seems to be about 750KB of stuff.

I'm personally not a fan of the "bundle a browser every time" model of Electron but you could maybe do that as well to be completely self contained.

As I mentioned in the README, I think the main use of the library is either prototyping, or internal tools for your own (or your team's) use.
You should read your own link. Parallel reconstruction is an explicit exception to that rule. I would be thrilled if you can debunk parallel reconstruction, but that doctrine is the very reason for it.

From your link:

“The doctrine is subject to four main exceptions. The tainted evidence is admissible if:

- it was discovered in part as a result of an independent, untainted source”