skysight-inc/HackerNews huggingface dataset:
> The democratization of reading tastes has gone hand in hand with the demise of the critic, and with that, the idea of reading a novel because certain people with discernibly good judgment think that the book is worth reading.

This seemed wrong to me on a glance, and I wasn't sure why at first.

I think it's the phrase "discernibly good judgment." When I look to see if I should follow any recommendation, whether from someone who is formally a critic or not, one of the first things I do is try to figure out if the person is admirable, accomplished, and — yes, if they have good judgment.

To be frank, most professional critics fail that test.

The best critics are typically those who are also accomplished, interesting people with a wide variety of interests and life experiences to draw on.

Take George Orwell. Most people would agree he was an excellent writer and lived a very interesting life. He fought in the Spanish Civil War and was wounded by a fascist sniper. He turned out a number of classic works — 1984 spawned a whole set of metaphors and words that entered the English language.

He's also an excellent critic of both literature and society. "Politics and the English Language" and "What is Fascism?" are both extremely astute reads that make you smarter.

But when I look at most critics, they don't measure up at all to Orwell. They're often very privileged people, for whom political connections and politicking were of primary importance in getting their role as a professional critic — not anything like an objective standard of merit or accomplishment.

Most of them seem, frankly, unaccomplished.

So I'll listen to Orwell on literature and culture — an accomplished person with many insights — and I'll read carefully the reflections of Edward O. Thorpe when he talks about corruption in finance, or Peter Norvig when he writes on experiment design and critiques sloppy thought in the sciences.

But the average critic? The author of the piece thinks they have "discernibly good judgment"? Why would he think that? It seems to be... well, frankly, false.
Alt-text: The universe is probably littered with the one-planet graves of cultures which made the sensible economic decision that there's no good reason to go into space--each discovered, studied, and remembered by the ones who made the irrational decision
And yet yarn's changes directly led to npm making significant improvements of their own...

Do you also insist that Chrome and Firefox shouldn't exist because IE does the job adequately?
Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

I think the (short) answer is "node, npm, and javascript".

The longer answer has something to do with the automatic installation of dependencies, and the common use of shell scripts downloaded directly off the internet and executed using the developer's or sysadmin's user account.

I used to use CPAN all the time. CPAN would check dependencies for you, but if you didn't have them already you'd get a warning and you'd have to install them yourself. It forced you to be aware of what you're installing, and it applied some pressure on CPAN authors to not go too crazy with dependencies (since they were just as annoyed by the installation process as everyone else.)

These days I use NuGet a lot. It does the dependency installation for you, but it asks for permission first. The dialogs could be better about letting you learn about the dependencies before saying they're ok. (In general, NuGet's dialogs could be a lot better about package details.)
https://kubernetes.io/docs/setup/independent/create-cluster-...
> yarn, typescript, react; say what you want about js fatigue, these are rock-solid, well-tested projects that are really good at what they do.

I wish webpack was on that list.
Search index is created by adding a automatically populated search vector column to each searchable table in Postgres and appropriate SQLAlchemy models. Left Algolia partly because our old implementation was poorly done, overly complicated, and becoming difficult to maintain, but also because Postgres FTS could give us equivalent search capabilities (we didn't need all the features Algolia had to offer) for free.
I made a half-joking comment on that thread that "'Bout time NPM goes blockchain." Either someone deleted it, or GitHub lost it among all the traffic to that issue.

Wonder if npm, Inc. would view a decentralized registry as a threat to their business model?
Reminds me of Writing Worms for Fun and Profit by lcamtuf:

https://www.darknet.org.uk/2006/12/writing-worms-for-fun-or-...
Ask HN: Has anyone noticed pages being filtered/not responding to requests?
This has been happening to me recently. I use primewire.ag quite a bit and I am able to get access to the site but after an hour the website stops responding. CURL requests and regular requests in browser return nothing. Not code, no html, no response AT ALL. I have noticed this with other streaming sites as well. My friend has reported similar behaviour with streaming sites for sports games. These pages respond when behind a proxy. I believe these sites are being artificially dropped by my ISP, but if that is too conspiratorial I would like another technical explanation; or if anyone has experienced similar.
Arctic Blast Heating Up Battle Between Energy Lobbying Groups
Good point about how to abort. Maybe it would be possible to short-circuit the fd somehow, so that the reader got an EOF, and that would in turn cause failure in the program reading the stream. At the same time, any success code from the program should be turned into an error exit code so the script could detect the failure. Not perfect, but arguably better than no failure at all.
At my job we do native C and C++, some Java, some C#, scripting in Shell, Python, and Perl. When the left-pad incident happened someone said something to the room about it, we all looked it up, and spent a good 15 minutes mind-boggled, laughing and being grateful we weren't web devs. "Wait, you're telling me these people need NPM and GitHub to deploy? Seriously?"
Same problem here. Seems to be a font rendering issue, the strange artefacts disappear at certain zoom levels. My platform is Fedora 27 with Firefox 57.0.1.
Velvet Reverend Al – The State of Meditation Address
This may be a stupid question - I'm not that familiar with NPM or modern javascript development so forgive me, but does it not allow storing your dependencies locally? Is that not considered best practice? Just download your entire dependency tree and don't touch it unless you have to.

It seems to me that if packages "disappear" from upstream, it shouldn't have any effect other than preventing an update due to the missing dependency.
Surely there must be some traits we could improve by selective breeding. Strength, intelligence, better digestion. Applying that study to anything other than schizophrenia is a faulty generalization. My post was not meant to promote any violent resolution. Your comment was fascinating and I'll take a deeper look at that paper.
but that has nothing to do with npm.

that's the same for any javascript package manager - yarn or bower would be the same.
Not really, also while Tesla does work on batteries it’s more Panasonic which makes he batteries for Tesla, LG chem and the likes that actually work on that.
You could sign packages and record their signatures along with the version. Which, coincidentally, is basically what https://teapot.nz does, e.g.: https://github.com/kurocha/geometry/blob/master/development-...

Although, I've never considered this in the case of an actual attack. It would make sense to actually fingerprint the entire source tree and record this too somewhere, so when you build it you know you are getting the right thing. Teapot basically defers this to git.
>moves about one diameter in two minutes

Not in its own reference frame.
> Why?

Because the fallout will cost billions over the next years. Intel as a company due to class-action lawsuits, recalls, rebates, and the shareholders because the drop in stock value after the announcement will cost them quite a chunk of money.

In addition, more long-term, I sincerely hope that the cloud vendors (and maybe even Apple!) recognize that their total dependence on Intel (and NVIDIA in deep learning...) is bad and they need to diversify their base.
Another good quote by him from "In the Shadow of the Moon" (a quite amazing film/documentary of Apollo featuring interviews with the actual astronauts):

[about driving the Lunar Rover] "What really saves you up there is there's nobody coming down the road from the other way."
Thank you Eric.
exactly.

I question all these comments by people singling out npm as the root of the problem. doesn't sound to me like they fully understand the issue.
I found Remi https://github.com/dddomodossola/remi to be excellent for creating HTML frontends to python apps
Perilous Promenade
PayPal faces boycott call over lack of services in Palestine
Kubernetes ConfigMaps Compared to Docker Swarm Configs
I’d agree with the example if it also adjusted to fit mobile correctly. As it is now, it just looks like a website stuck in the past.
And neither Solomon nor the Byrds said anything about "A time to make use of duplexer3, and a time to be without duplexer3."
Does anyone know what happened to the author? It seems he was still on Twitter as of yesterday (Jan. 5), responding to someone about a merge request:

http://archive.is/JEG90
That's not their argument, their issue is intel didn't bother informing them so they had adequate time to work on patches (you know like they did for linux and windows kernel devs).
Hydrogen fuel cells would solve another problem and that is when you expand the hydrogen you reduce the weight of the aircraft.

The problem with batteries is that a full battery and a discharged one weigh the same.
I consider it an unacceptable form of code deployment. It's unsafe in the computing sense, and leads to a ecosystem where users are less and less in control of the software they use.
Computer Networks by Tanenbaum

Entertaining and insightful.
There are feats of engineering in orbit that make the Apollo program look like a bunch of rocks in slingshots. One of them has had humans on board for close to 20 years.

I like to think people who've set foot on the moon are able to see all we've done in space, all we're doing, all we're about to do, and see the moon landings as just one small but significant thing in context of the beadth of human achievement.
The other languages have the same problem. It's only spread over different places.

For example, JS doesn't have a standard library. Many languages do. So when JS downloads loads of transitive dependencies, many are there because there's no stdlib.

Have you audited your C++, or Java, or Ruby, or... stdlib lately? Especially those that come preinstalled with your OS of choice?

Same goes for anything that you download via Maven, or gems, or easy_install, or include as direct GitHub references in your Go code.
The CEO should probably spend some time in the pokey for all the stock he sold between when he knew about this problem, and when it was publicly known. I'm curious how many other Intel employees sold stock in the same period.
"The system was simple and cheap" ... $10-$40 per sqft without labor assuming you are "handy" is not exactly cheap. Presuming most homeowners wont want to do this work themselves it sounds like something that would cost $50-100k for a midsize home. At that cost I'd imagine it would only be installed for more expensive homes where flooding is expected to occur frequently.
It does store them locally. I think the problems here are:

- The missing packages can be replaced by someone who wasn't the original package author (e.g. a malicious hacker)
- It's not easy to catch this ^^^ because NPM doesn't have support for signing versions in your project's dependency configuration... (I bet it will after this.)
- Almost every modern website has a dependency on NPM somewhere in their build chain
- NPM being down means loads of sites can't deploy properly

So yeah. This may be a really big deal.
Nope, the OS or hypervisor (but not a guest) can freely update whenever they like, as long as all the updates are to newer versions. For updates that modify visible CPU features, like these, it's helpful to apply them before boot. Linux has a mechanism to apply "early" updates from initramfs that effectively function before the kernel boots. I don't think other OSes can do that.
Exactly the same project was mentioned in the article. Maybe next time read it before posting ;-)
React component to draw SVG Guitar chords
I was lucky enough to get _Beauty in the Beast_ when it came out on Larry Fast's short-lived Audion label. It is well worth your time (and ever since I've wished that Wendy Carlos and Terry Riley would collaborate on a piece or an album).
The facts behind Meltdown and Spectre are not new. We all knew not all side effects of speculative execution were reversed and some could even be impossible to (even if you clear a cache, if a read went to the bus, the CPU already disclosed to an external observer an execution path that was later discarded).

What happened is that someone insanely clever figured out a way to exploit those side effects we all thought were innocuous.

In the future, when someone looks at an open CPU design and spots an out of order core that leaks side effects of instructions that were on branches not taken, they'll hopefully remember this mess and proceed with care.

Processor erratas are always a worthy, even if sometimes terrifying, read.

And even if we consider the eyeballs are not optimally distributed, the more eyeballs we have, the shallower the bugs will be. Like I mentioned, we all knew (and I'm not even actively working in chip design - I'm just someone who reads research papers when I can) some speculative execution side-effects remain after the CPU rewrites the past and discards the primary effects.
Oh, right. That seems like not a property you want in software releases - there shouldn't be a possibility of getting spoofed data (or metadata), either you get a signed release or no release at all. Bitcoin needs that because there's no signing authority.

The key thing here is that there is an obvious central authority for software releases (the NPM registry, or GitHub, or Debian, or whatever), so proof-of-work-style systems are overkill because you don't fundamentally need decentralization. You could imagine some sort of decentralized first-come-first-serve software registry, but that doesn't seem obviously better than a central one.
OK, we've changed to the project page on Github. Submitted URL was https://itunes.apple.com/app/terminal/id1323205755?mt=8&at=1....
Clickable: http://www.blink.sh/ - interesting as it's designed for mobile responsiveness and uses it's own protocol.
Prgmr.com has been participating on the Slack channel this article mentions. Being able to share notes gleaned from reaching out to vendors and sort through the information and mitigations for Spectre and Meltdown has been a huge help.
The source code is thankfully pretty tiny and you're welcome to inspect what yarn pulls down to make sure I haven't trojaned it!
They don't allow removal of packages. This is likely a cascading storage failure or something along those lines (or else a major hack).
iPhone X problems
Well, if you are in other languages that have an actual standard library (so you don't need 500 packages to make up for it) and only a few dependent libraries that are well package and you don't need to update frequently.

Just commit them, don't make things a mess.
They are needlessly rude and mean at #bash. A bunch of scumbags, actually.
Agreed, it needs momentum to keep going and that's where I could use some help right now. But it also becomes less of a struggle since I don't have to constantly invent the ground I'm walking on, and since it's now getting to the point where interesting programs are becoming possible. As an example, adding symbol support (https://github.com/basic-gongfu/cixl#symbols) took about 30mins.
How do you explain the boom of the scientist/inventor/businessman profile in that period? Are there any references on the subject?
How do you feel about the use of bash for AWS userdata and the like?

You pretty much have to put all the init stuff in a bash script. I can't think of any real-world examples of userdata scripts being less than 10 lines.

The alternative of course would be a three line script that downloads a file and executes it. But what language would that file be in? Probably bash. And it would make the infrastructure-as-code tracking and deployment process much more complicated.
Neutrinos might be a better bet ... https://motherboard.vice.com/en_us/article/9akwb7/how-neutri...
I get your point.
I love his jump-salute photo in that article. I forgot he was the one who did that on the moon.
We are talking about tools here. Standards are a different beast.

For example it is cool to have multiple tools doing the same thing is cool because you have the choice to use what fits your need (e.g. different Web Servers).

On the other hand, having multiple competing standards for the same job is just technological cancer and mostly the result of some commercial competition (or the attempt to fix a standard by replacing it).
I don't get why not just use git repo registry (e.g. github) for package management. If you work in a "strict" environment you can basically fork all your dependencies and use your own git repo registry.

NPM already allows using git repos, but needs some tweaks to allow better support:

* allow versioning via git tags

* store git commit in `package-lock.json`.

* maybe something else...
And it's SO MUCH MORE expensive to fork all those processes. Just use a real language, please.
I mean, there's plenty more that could be on that list, it's not exhaustive.

Webpack though I'm really not sure should be. It's certainly improving, but it's nowhere near the same league as the other ones.

Edit: Ah, I see what you meant :)
The difference you premised your rant on is superficial. The point is that humans create things that become important to their societies. Sorry if you're upset that Mario and Link were integral cultural touchstones in my life and many others'. I assure you, these "consumer products" had a large effect on my path.
True, but you don't have to write a scientific paper for peer-review here - you can just mention the proof in accessible language, and then refer people that do know what p-values are to place where they can see the data and verify it. Otherwise, the article essentially boils down to "some person is claiming something is wrong with elections, be worried" with no tools to evaluate the claim or make any useful conclusion from it. TBH, that's not a unique occurrence - most of the reporting done in a way that prevents the reader from independently evaluating the information, since the goal of the modern reporting is to get the reader to prearranged conclusion (or prearranged feeling of righteous anger/fear/hate/etc.) and not to give information. This is just another brick in the wall.
I think you're making TeMPOraL's point, though.

Even in this relatively close case, it's not a zero-overhead transition. There are some changes. There are some new behaviours. You still need to know which things really work exactly the same and where the differences come from even if those differences are only minor. You always need due diligence about whether a new tool is reliable, future-proof, trustworthy, etc. And that's all after finding out about the new tool and deciding this one is actually worth looking into.

Multiply all of that by the absurd degree of over-dependence and over-engineering in the JS ecosystem, and it's entirely fair to question whether the constant nagging overheads are worthwhile.
In case anyone feels like listening to this masterpiece: https://soundcloud.com/mikekraze/bach-switched-on-full-album
If I am reading that right, somone threatened Popehat, and Popehat blogged about the threat. And you are calling that "doxing"???
comparing distro package managers is a ton different than free for all spaces like packagist, ruby gems, pypi, npm, etc.
aww i missed out
That's exactly my point. I wished it deserved to be on the list.
I've gotta post the obligatory Ken Thompson hacking the compiler story

http://wiki.c2.com/?TheKenThompsonHack
Seems like OP is using one of the Pelican themes, most of them last maintained 5 years ago.
Αποστολή στον Κάμπο για τον Ολυμπιακό
Even if what?
Women unhappy with their breast size are less likely to carry out regular self
Left-bad, I mean, the left-pad fiasco should have been the wake up call.
> it appears their reaction to getting some power for the first time in their lives was to jump into the bully camp themselves

Or maybe they see others using political correctness to bully people around them.
> I used to use CPAN all the time...

CPAN has a setting that force-feeds you dependencies without asking, but I don't think it's on by default. Also, CPAN runs tests by default, which usually takes forever, so users get immediate feedback when packages go dependency-crazy. The modern Perl ecosystem is often stupidly dependency-heavy, but nothing like Node.
how many typosquats on scope names will there be I wonder.
I always wanted to see people use wang tiles or Penrose tiles for texturing large arrays of polygons, so that you don’t get the annoyingly obvious repeats that most texturing gives you.
>these people need [their package manager] and [their source code management tool] to deploy? Seriously?

Not really sure I understand what you're implying there
> They could also buy any number of things around the world with US dollars earned from selling us stuff.

Yes, I said this ("dollar-denominated assets").

> China could just as easily export oil to any country inn the world in exchange for us dollars.

Let's think this through (ignoring the fact that China is a net importer of oil, so they wouldn't export any oil). China sells stuff to Europe for dollars. Whence those dollars? Europe probably had treasuries, sold them, and paid China... except that actually they'd just transfer the treasuries -- why pay extra fees? Whence those treasuries? Well, Europe sold... stuff for dollars and so on.

(Actually, Europe borrows in euros, so euros too are a reserve currency, but let's ignore this. So it's not right for me to use Europe in the example above, but let's pretend for the argument's sake.)

Few things in economics are zero-sum games, but one thing that is a zero-sum game is international trade. If China maintains a trade surplus with the rest of the world, then the rest of the world maintains a trade deficit in the same amount. The U.S. dollar is a reserve currency because there is nothing else now to use as gold used to be used, and the rest of the world insists on maintaining a trade surplus with the U.S., which means they... have to accumulate dollars or dollar-denominated assets.

Because of this, the rest of the world can also trade with each other in treasuries, and so you're absolutely right about that. But new lending of dollars to the U.S. most likely stems from exports to the U.S. Certainly that would be true for any sufficiently large sums: the creditor could not accumulate such sums without exporting to the U.S.

So I stand by the assertion that for China to lend $1trn to the U.S. means to export a similar amount to the U.S. as well.
It's like how companies still enforce their no masturbating at your desk social mores even when there is urgent business.
I don't understand. We've started a new Angular 2+ project and our junior developers managed to roll into quite easily. Our designers (who know jack about Javascript) got excited when they discovered that our project uses .scss and the results have been spectacular.

Seriously, I REALLY REALLY don't get this hate for Angular 2+
Could they do that if solar panels were 100% efficient?
Being told how to think by experts in literary professions has always been orthodoxy. The heresy is to contractict them.
There are also people requesting that this be changed: https://github.com/rubygems/rubygems.org/issues/1226