skysight-inc/HackerNews huggingface dataset:
Whaaa...? I swear I used `npm unpublish` several times in the past year.

Yeah, it definitely exists: https://docs.npmjs.com/cli/unpublish
Yeah, my point exactly! If Pythonista can be on the app store, then why not a full shell?
Nerfing (gaming) ... In video gaming, a nerf is a change to a game that reduces the power of a weapon or skill in order to maintain game balance. The term is also used as a verb for the act of making such a change. The opposite of nerf is buff (in either of that term's two usages).
Ubuntu and BSD still have no fixes. It indeed seems like a preferrential disclosure. Plus no 2nd-tier cloud providers like DO were notified.
I miss the days when everyone predicted and solved technical bugs with ease and didn’t have time to do eye—rollingly simple things like say “don’t be an idiot”. Remind me when that social climate was in place, again?
In the past, it was against App Store Guidelines to have interpreters in an app. Is that no longer the case?

Could there be an app that has a Python interpreter built into it, so that the logic of the app used Python, with just a Swift/ObjC UI on top of it?
US senator says no evidence of ‘sonic attacks’ in Cuba
Yeah, there have been multiple typo-squatting incidents.

http://blog.npmjs.org/post/163723642530/crossenv-malware-on-...
So i am seeing a lot of sites that compare some brokers but i dont really trust these...

I am looking for a broker with minimum acc of 1000 or 2000 euro.

And i wish to do algo trading and i am in Europe.

thx
(Note of course that in the mousetrap example it's not just your buying power that changes, but everyone's. Everyone gets the ability to buy the new mousetrap, something of value that just didn't exist before (and the value of that new thing exceeds the value people pay for it, after all that's why they're paying for it). So despite people paying you their buying power actually increases, and so does yours. That is why the economy works. Perhaps it's easier to imagine this happening if it's a computer rather than a mousetrap)
Yes, you absolutely have me about the stdin part

But, the multiple case example highlights that if (for argument's sake) `make-input` and `make-more-stuff` had run _prior_ to that line, writing their (possibly empty) output to a (file|FIFO), how then would you want bash to behave? It would still open file descriptors to those (file|FIFO)s, which would still be just as blank.

It seems to me that if one wishes more fine grained control over the error handling in a multi-subshell-fd-trickery situation, then creating the FIFO(s) and managing the sender's exit status is the supervising script's responsibility.

a file descriptor device which is closed at the end of the script

I checked, and it's actually not even at the end of the script; those fds only exist for that one child, as `process-stuff` is exec-ed by bash.

whether the output is written in its entirety to a hidden tempfile

It's not a temp-file, it's an actual file descriptor, which bash `dup2`s for the subprocess, then cheekily uses the `/dev/fd/63` syntax to make appear as a file; you can peer into its brain a little:

$ showme() {
echo "showme.args=$@" >&2
the_fd="${1##/dev/fd/}"
cat <&${the_fd}
}
$ showme <(date -u)
showme.args=/dev/fd/63
Sat Jan 6 21:31:25 UTC 2018

Thanks so much for highlighting this scenario; I learned a ton about how that works researching this answer. That's why I like answering stuff on S.O., too: win-win
All that these mitigations did was disable all obvious precise timers. All you need for a new attack is a novel way to create a precise timer. And since it’s now known how valueable such a timer would be, I’m certain that minds more clever than me will take a shot at this.
I think they are imagining people trying to pronounce the acronyms ngr and fgt and getting offensive words out of them. I don’t think that would have occurred to me.
The secret ingredient in Switched on Bach is that it is an outrageously good musical performance.

Lots of other synth albums are technology demos, collections of cool sounds. Switched On Bach stands out because Carlos adapted Bach for the medium of the Moog synth, clearly understanding the compositions' underlying gestures, and ensured that those gestures all come through. In some cases, they come through more clearly than on the original instrumentation, especially bass lines where the synth speaks more clearly than acoustic instruments can.

Such details in another performer's hands could be distracting, messing up the relationship between foreground and background elements and drawing attention to the wrong things -- but Carlos's arrangement and performance are exquisitely balanced. This could only have been achieved by someone with a deep and sophisticated understanding of the source material, combined with incredible patience to wrestle with difficult and immature technology until the recordings were perfected.
Meltdown PoC for Reading Passwords from Google Chrome
Curl exists, so you could run bash if you can figure out some way to give it an executable bit (chmod doesn't exist), unless iOS refuses to run executables at all unless they're signed?
> If we can't notice the malicious code at all until due to really really smart activation mechanisms... well then we're in NSA conspiracy land again.

What about really dumb activation methods? I.e., a condition that only triggers malicious behavior several months after the date the package was subverted. You don’t have to be the NSA to write that.

What’s scary here is that there are simpleminded attacks that, AFAIK, we don’t know how to defend against.
"In a study spanning two decades, a team of researchers led by Colorado State University found declining numbers of..."

20 years, is but a blink of an eye. It takes us back to 1997 only. What was the longer term trend ? How would they know if we started in a local maximum, or how often populations rebound ?

I complain that we barely have enough arctic and antarctic satellite samples and we have those from 1979.

So any decline of anything is linked to climate change automatically ?? That doesn't follow at all.
By definition "good" has to be rare, otherwise it wouldn't be good ...
The latest Manifest.fm podcast episode is about typosquatting:

https://manifest.fm/9
I suspected that someone would mention this, but the fact of the matter is both systems are mostly interoperable. The switch from npm
to yarn would be nothing like migrating from Gulp + Browserify to Webpack.

To switch to yarn, I printed out a one-page cheat sheet and taped it to my wall. I’ve had one blunder in the time I’ve used it (misunderstanding what `yarn upgrade` did x_x), but it was easily reverted.
Three developers on my team spent the last 4 years pushing for angular. Four years ago, I was 50/50 on it vs react, so whatever, but if my team's really for it, let's do it.

Fast forward to angular 2, and we're down to two developers who are still for it.

Fast forward to today, I'm down to one angular dev who's still for it, and two of the original three have left for react jobs. Meanwhile, I'm left with a bunch of angular 1 code that needs to be upgraded to angular 2, and a few testing-out-angular-2 projects that are dependency hell.

The only reason I ultimately embraced angular 1 to begin with (above reasons aside), was because it was so opinionated about everything, I could throw it at my weaker developers and say: "just learn the angular way to do it", and there was very little left they could meaningfully screw up. Angular proponents on the team would see it as a point of expertise to teach the "angular way" to more junior devs, and everyone left the day feeling good.

When it comes to Javascript 95% difficulty with writing good maintainable code is ensuring that your team is all writing to a very exact, and consistent quality and style, since there are so many different ways you can write js, and so many potential pitfalls. And if the team all wants to embrace Google's Angular standard, that works for me. Its far easier to be able to point to an ecosystem with an explicit, opinionated way of writing code, than it is to continuously train people on how to write maintainable code otherwise.

But with angular 2, if you haven't been drinking to cool-aid for a while now, it requires so much knowledge just to get running, I can't even have junior devs work on it, without a senior dev who's also an angular fanboy there to make sure everything is set up to begin with. Its absurd. And I'm supposed to sell to the business that we need to migrate all my Angular 1 code to this monstrosity? And then spend time again every 6 months making the necessary upgrades to stay up to date? Get real.
They are affected but there is no fix yet.

64-bit PV is unaffected and won't suffer a performance penalty (more precisely, it was already suffering it!!!), hence my original question, but a 64-bit PV guest can use Meltdown to attack the hypervisor. The fix is to update Xen, though I am not sure if fixes are already publicly available.
So this is an NPM.js issue, I thought this was a broader issue on github according to the headline.
Stupid question from non-pro here: everyone's always like "never commit libraries into source control." But, um, this kinda thing?
Thanks, I'm going to give that one a try too!
I don’t think we really need a few guinea pigs to teach us about surface water. Most of us have learnt everything we need to know from three decades of TV adverts begging us to send £2 a week to help dig wells in Africa.

I’m fully in favour of people finding new and interesting ways to remove themselves from the genepool. But this is neither new nor interesting.
I said this back in the left pad days

Store all of your dependencies locally.

If something disappears then at least you can continue until you find a replacement.
I'm more of a back-end dev who doesn't know all the ins and outs of the actual software used - can someone explain to me why this is an npm problem, and not an excessive dependencies problem?

I thought npm was simply a package manager - I don't see anything in the article that is specific to npm, except he happens to say that word.
You can't fork() in App Store apps. Which is why all of the commands on the linked Terminal app are built-ins. So a bash-like of sorts could be made to work, but it would be very different and quite limited.
Or it could be that it's easy to do simple low-hanging-fruit things and harder to do more complicated things. The whole JS ecosystem has come together in a rather ad-hoc way, it's plain stupidity or moronic political gamesmanship to assume more motivation than "nobody thought it worth blocking the entire platform to build a fully-trusted base infrastructure so far."

It's funny how many people get easily pissed off about other people allegedly being oversensitive. And it's sad how many of them are part of my same bullied-as-young-nerds cohort, considering that it appears their reaction to getting some power for the first time in their lives was to jump into the bully camp themselves.
Groove.AI | REMOTE | Part Time

iOS / watchOS developer

Groove Technologies is a bootstrapped startup looking for a contract developer to help flush out our MVP for Groove.AI, our product targeting the fitness space.

Please get in touch by sending an email to groove@groove.ai
They don't allow packages to be deleted. A bug or server issue or mistake caused this. This type of problem has occurred only once before. In general npm has been extremely reliable and performant.
The LCD panel had cracked, digitizer was fine.

Long story short, the quickest, easiest fix is to replace the entire display + chassis.

In Singapore I was quoted $500sgd but I wasn't sure how long I was hanging around for so I didn't want to risk it.
People get the leaders they deserve. This holds true for nodejs users, too.
Sucessfully booted the demo image on VirtualBox after converting image, in a 32-bit machine and IDE. Resembles modern BSD a lot, as expected.

EDIT: The demo image contains these games: arithmetic, backgammon, fish, fortune, hangman, lib, quiz, words and wump.
Fewer key presses, but doesn't work if you're using vi bindings.
The basic explanation is that the dependencies for the angular app are much smaller, but I’m not sure which bit is confusing you. You don’t understand why an incorrectly written program required work to run when a bigger but correctly written program was easy?
Can't say anything about react, but yes: yarn and typescript are good.

This is coming from a long time Java programmer who still likes Java and Maven but now might have a new favourite language.

This is made even more impressive by the fact that it is built on the mess that is js. (Again: I'm impressed that it was made in three weeks I just wish a better language had been standardized.)
I like that the article starts with a sympathetic description of the use of morphology to define taxonomic structure (an understandable approach to take in a pre-DNA world). This predates Linnaeus: in German, for example, the word Falke means both hawk and falcon. Not sure what approach I would take to translate this article for a german lay audience.
No. It needs nothing but the .NET Framework (not .NET Core) because .NET is already providing everything we need.
There's probably a large overlap between the two communities.
I know it's just trendy to hate on node/npm, but these are really turning into bad products and services. You need usability before there's a trade-off. Reputation is still important.
The Network of Global Corporate Control
> Yet this is all very English-centric. I've often wondered whether foreign users ever get annoyed with some of our names that happen to acronym to something unfortunate in their native language. Do they just have to live with it, or does it never happen?

Well we have to live with it, and funny things happen. In Turkish, which is my mother tongue, the English word Scheme sounds very similar to "sikim", which is a very vulgar way to say "my dick". About five years ago having lunch with colleagues (programmers), chattering about programming languages, when I said I liked Scheme, I had some weird looks :) Some more on this: https://news.ycombinator.com/item?id=7421315
A calendar page for January 2018
It's not specific to npm. It's a problem that generally applies to all of these package managers that introduce code that you have not personally reviewed into your site.
As far s I can tell, "Linux" (and MacOS) are especially vulnerable because each process maps in the entire kernel. This isn't true for more modern and microkernel OSs (Including Windows 10).
Same here, been getting lots of emails regarding issues I've supposedly followed for the past few hours. It's got me worried a bit as security audit log shows nothing. Something stinks so think I'll change my password to be safe.
> This means that all sorts of sandboxing methods for javascript interpreters, bytecode interpreters, plugin architectures, etc are insecure.

I just now understood the impact of Spectre. It is not just that all existing attempts to execute code in a sandbox are vulnerable. For CPUs with this problem, it is literally impossible to create a secure sandbox.

We certainly live in interesting times...
Yes, there are multiple apps built around a Python interpreter (Quik by GoPro is one that I know of).

I think that policy changed around 2011.
If you feel compelled to put a smiley face after a sentence to make it more agreeable, it's a sign that you were uncomfortable with the tone of the sentence. Adding a smiley just comes across as passive aggressive or condescending. Just rewrite the original sentence so that you're comfortable with the tone, and omit the smiley.
From http://help.rubygems.org/kb/gemcutter/removing-a-published-r...:

> Once you've yanked all versions of a gem, anyone can push onto that same gem namespace and effectively take it over. This way, we kind of automate the process of taking over old gem namespaces.
This kinda thing is dealt with by artifact storing and caching, not source control.
Apparently the restore is now complete:

https://github.com/npm/registry/issues/255#issuecomment-3557...
npm does pin versions by default (although originally they did not). The fact that you _need_ to have a local mirror for Maven isn't really a plus for Java. You can get a local mirror or similar setup for npm also.
I had the misfortune to be on the receiving end of their stupid AI recently.

I posted a ticket saying i was overcharged unfairly for a trip, and a bot resolved the issue and sent a reply apologising for the incovenience and hoping i use uber again soon.

I demanded to speak to a human, but got the same automated reply again!

Boooooo!
So I know rpms and debs are signed, as I've setup repos for both. Docker repositories require a valid SSL key (or you have to manually allow untrusted repos). But do Python packages and Ruby gems have signature verification? How does pypy/pip and gem deal with validating a package is what it claims to be?
This is just a very simple frontend to this library:
https://github.com/holzschu/ios_system

That library is just a simple implementation of some basic commands. It does not do any executable execution, it does not use the real system utilities. Nor does it has anything to do with Bash, or shell scripts. It’s just basically one big ‘switch’ for all commands, which are implemented in the app itself.
https://www.reddit.com/r/etymologymaps/comments/7oasca/inter...
He is the inventor of a low-cost sanitary pad making machine
I can't speak for the Gigabyte, but the Surface lacks Linux comparability, which is the main selling point of the XPS Developer edition.
Blink is awesome.

It's also open source and pretty easy to build yourself if you have Xcode around.
A good book that includes a lot about John is "Into the Black" about the shuttle program. He was commander of STS-1 and was heavily involved in the program.
Just to re-iterate, docker supports mirrors as my sibling poster suggested. :)
Only for a version less than 24 hours old. You can no longer remove established packages.

A quote from the documentation page you linked:

> With the default registry (registry.npmjs.org), unpublish is only allowed with versions published in the last 24 hours. If you are trying to unpublish a version published longer ago than that, contact support@npmjs.com.
Actually no, the inclusion criteria for this study were major (unipolar) depression and no improvement despite two courses of antidepressants (6 weeks minimum each), I think this is exactly what SSRI are used for.
This is why I will always use GNU/Linux on my computers, the freedom to use your own hardware for as long as you want outweighs anything Microsoft or Apple has to offer.
The Looming Digital Meltdown
I think there's a difference between committing to source control and having local copies. For example, we use Red Hat Satellite at work which you give a list of upstream repos and filters, and it download copies locally (to what it calls a 'capsule'). Then to get those packages to your machines you have to publish through the lifecycle process (Test > Staging > Live A > Live B - or whatever you choose).

There's multiple ways to solve to mitigate the risk, but committing libraries in to source control can cause way more headaches than it prevents IMO.
Why? Intel made billions last year. They will make billions this year. They will make billions next year.
According to their patch notes Apple's ARM cores are also vulnerable. And it's not just the latest ARM, the A15, A57, and A72 are vulnerable to a less severe variant of Meltdown.
In general we can establish causality for socioeconomic theories using natural studies. For instance your question can be answered by comparing the timing of introduction of technology into the home and the rise of women in the workplace. You can ask people how much time they spend doing housework and compare to what people with technical alternatives spend. This is a relatively easy natural study since so much of the data was well collected at the time. Harder ones that are more recent ask things like whether or not raising the minimum wage increases unemployment. You’ll be able to find studies that used Seattle’s minimum wage law to determine the answer to that question.

In the narrow case of women entering the work force, the biggest factor was the employers being willing (forced) to hire women because they were the only workers available quite suddenly. Women would have entered the work force in more substantial ways before that but they were perceived as taking jobs from men. WW2 changed all that. One reason they were able to keep working after the war is because they had money and the products were available to allow them to get the housework done in less time. It was a status symbol in the 50s (and probably still today) to have a very bored wife at home.
They certainly weren't the cores of other projects, ripped out and made into a standalone thing.
Wait, they both say username = floatdrop [1] for me. What did they say for you?

[1] https://twitter.com/floatdrop
Wow. I wouldn’t have guessed that basically strapping styrofoam to the bottom of a house would provide enough buoyancy. I assume this only works for single-story homes, e.g. in the New Orleans “shotgun” style?

Also, how does the plumbing work?
Hello from Water Street, Lititz. It is pretty cool to live here.
to be fair rust was completely different way early its start and changed dramatically for good when it dropped few things like gc and focused on borrow-checker/concurrency
If you like videos, I recommend the free EdX course. If you don't I recommend the Katacoda interactive sessions.

https://kubernetes.io/docs/tutorials/

(Disclosure: I run CNCF, which hosts Kubernetes and funded the EdX course.)
It's too bad that the Federal Emergency Management Agency (FEMA) is getting in the way of adopting this technology:

> she mentions the story of a developer who built an amphibious house in New Orleans, then found himself unable to acquire an N.F.I.P. [National Flood Insurance Program] policy; the building remained unsold until he replaced the amphibious foundation with a traditional one.
I find it hard to believe, but never say never, of course.
I was confused about the 11-minute bootup--my old 486/66 running Slackware took maybe 3-4 minutes to boot in 1994--but then I watched the video: it's everything that we've added to Linux systems since 1994 that makes the startup slow. It's mostly post-kernel services and tasks that are slowing things down on this old PC. I wonder if he could speed things up further by removing some of the modern conveniences and going back to a basic system that didn't run much beyond inetd, getty, and crond.
Name dropping the Amish for a click-bait title.

How droll.
As they are immigrants, I wonder what they think about white supremacists / neo-nazis ?
What makes npm particularly bad, is that JS has such a teribad stdlib. When you need to write your own lpad() at some point its easier to include a stupid little package that has dealt with all the edge cases you don't want to care about. So you end up with way more third party deps than a kitchen sink type language.

Otherwise, yes this is a fundamental dependency issue.
Git or similar?
Node was a very interesting thing back when it started. It was a hack, but a nice kind of hack. You could write some efficient servers with it. But then the community that formed around it, with it the project went berserk.
Tecno Camon CM specifications , release date and price #CMore
Digital Ocean Currents Trend Report [pdf]
Because when you’re on top, everyone loves seeing you fail.

A quick CVE search pulled up 18 vulnerabilities in RubyGems, including remote code execution.