skysight-inc/HackerNews huggingface dataset:
My understanding is that you should be using shell.nix for your dev environment, and default.nix if you want to actually build the final "nix-package". I have a gist that talks about this along with python and other language environments: https://gist.github.com/CMCDragonkai/dcc1b538352624ea690d695... However it's not finished, there are some things that still need work. However package/input isolation is not the only isolation you need sometimes (for example, network isolation, fs isolation...etc). When you do need this, Docker provides all these, but it's not compositional. There's a discussion on the Nix issues about this (potentially working towards a new nix-shell development environment can can compose different kinds of isolation): https://github.com/NixOS/nix/issues/903#issuecomment-3647447...
If you do that without any auditing, it's your problem, if it overwrites something.

I don't know whether you're genuinely missing my point or just trolling, but this doesn't seem to be a very productive discussion so this will be my last comment here.

Your argument seems akin to saying that you could choose to install only open source software, and to personally audit every line of code in that software including all its dependencies, so if you don't do that then it's your own fault if something bad happens. If you're both a world class programmer and a security expert, and yet bizarrely you have ample free time available and nothing better to do with it, that might work. In the real world, it's totally impractical, and a much better solution is to operate according to the principle of least privilege, enforced at the level of the OS, without having to rely on conventions and/or good will.

If you want for a modern OS to enforce mandatory restriction on all installed software, modify your sudoers file to only allow to run rpm/yum or dpkg/apt. Because packages installed via these mean fulfil the conditions that you describe.

No, they don't, as I've repeatedly tried to explain. At best, even if packages are available and properly constructed, your method keeps track of where files go and can remove them again afterwards. It doesn't enforce any systematic use of the filesystem to contain packages within specific areas; it doesn't manage related issues like configuration files that you might want to back up or preserve across software changes; it doesn't restrict access to files, networking or other system resources that the software has no business touching; it doesn't scale to the many-small-dependencies model prevalent with tools like NPM; and at this point there are already so many fundamental problems with basic robustness and security that anything else is probably moot anyway.

I leave you with a question, which brings us back to where we came in. Given that this broken version of npm exists and that it was made available via at least one production channel that should not have included it as a result of presumed human error by the maintainers, how would anything material have changed today if people had been installing it via an official package and their package manager as you suggest, rather than via npm update?
Lighthouse AI: smart security camera with 3D sensing, computer vision and NLU
That's very sad as a motorcyclist who hoped that this would be a huge improvement. Most of the near accidents I've had have been inattentive drivers not checking their blindspots.
Could you please provide a source for the anti-Material dialogue from an accessibility perspective? I have been suspicious that this might be the case, with Google and other companies.
And why would users not simply mark all of their posts as rebuttals? There'd be no downside.
It's often too complicated to allocate blame. People tend to get blamed for making small obvious mistakes but usually no one gets blamed for making huge structural or systemic mistakes because they are less obvious.

As a software developer, sometimes you can find yourself forced to work around other people's mistakes and it can make your own work sub-optimal. There are times when it's not feasible to fix the problem at the root.
my guess is that the handwritten signature is already on its way out of being relevant in modern society. in most cases it seems to serve more as a formality than a security measure. when I worked as a cashier, the majority of people would just do some squiggle and get the hell out of the store rather than any kind of consistent signature.

in principle at least, public key crypto is way more effective than a signature, and I expect this will become prevalent in the next couple decades as laws and customs enter modernity. at this point it would be trivial for a digital entity to enter into a binding contract.
> It very clearly sets it to display = block the line after

That's the point he is making.

> if you ran a normal browser.

What's a normal browser?
- what worked?

- what could be better?

Using descriptive terms.
See my comment a few above. Setup a virtualenv locally that your dev env points to for completions, but actually run the app within the container (with its own virtualenv).

Docker is great for dependencies like databases and queues. I find it totally unnecessary for developing python.
Who Will Regulate Technology?
IANA is out of IPv4 addresses. So is ARIN, APNIC, RIPE, and LACNIC. AfriNIC has less than one /8 left. If you attempt to start a new ISP today you will have a difficult time getting IPv4 addresses.

The days of being able to demand an IPv4 address are rapidly coming to a close.

Deal with it.
Well, a foundation is basically a self-owning company that is steered by its stated goal and often outlives its creators. In addition, there are several other legal forms that allow companies to own themselves. For example, in Germany there's the concept of a "Kein-Mann GmbH" (no man's GmbH), which is a limited liability company that owns 100 % of its own shares.
What’s interesting is if you could make such a corporation “reproduce” and start seeing evolution take place.
How on earth can this be flagged on "hacker" news?
The library alternative was suggested in another comment and is definitely a path I'll consider over a service. The goal of this project wouldn't necessarily be to start a business, but to help standardise how websites interact with sensitive user data.

Perhaps encrypting hashed passwords with a session key and matching against hashes encrypted with that key server-side would solve the issue you mention.
Does yarn run npm behind the scenes? Or does it even replicate the bugs in its attempt to be fully compatible? I used yarn to install global packages and see the packages in `/usr/lib/node_modules` with the permissions of my user rather than root.
I have the same problem. I've thought about sending out Christmas Cards to all the random people that have revealed to me a little too much information by not minding their email address.
“Murder by Machine Learning” as the new “Death by PowerPoint”
Unrelated, but I'm always amazed when I hear about these massive Chinese cities for the first time. Apparently Urumqi has a population of 3.5 million.
Why do you think this would need a service?

It’s really easy to make as a dev using Have I Been Pwned Password API: https://twitter.com/noncototient/status/966628069048950784

Unless you’re talking about users whose dev skills only go as far as posting Wordpress articles. Then it might work, but integration would have to be super simple, I frame might not be the easiest solution for them.
Previous discussion at:

https://news.ycombinator.com/item?id=16438913
Coinbase companion to trade alt-coins
Not to mention the acceleration needed to achieve orbital velocity with a catapult. Seems like insanely high forces on the payload. I’d love to see how they solve this.
Here Are 5 Reasons Why Email Marketing Still Matters – Targeted Web Traffic
If it's inside a script, it won't go into command history, either.
The Square and the Tower: Networks and Power, from the Freemasons to Facebook
Docker containers and virtual envs are in some way both capsules that can serve a similar purpose. virtual envs are in general more lightweight, but limited to the Python world, whereas Docker containers are heavier, but enable you to also include other dependencies in that capsule.

I sometimes feel that Docker containers are a bit misused if they are just used as environment capsules. They provide more isolation (process space, etc.). But of course, that would be still fine.

The software I write mostly does not require databases and other supporting services to run on my laptop. So virtualenvs are all I need (most of the time). There is a docker tax that I don't want to pay, unless I heavily benefit from it.

I guess, if I could deploy docker images, the return of invest would be much better and I might use it more.
Same issue here; yoga memberships, rugby clubs, password resets for their real email address. I haven’t had a bank password reset come through yet, but it is a matter of time. Some of my namesakes, meh, they’re not so smart. Thankfully I don’t use Google calendar, or I could see it being a real mess because many of those emails are invites from other people who either got it wrong, or the namesake is handing out the address he wishes he had.
So what is DO's primary selling point then?
Also a concept used in the game Endgame: Singularity.

https://en.wikipedia.org/wiki/Endgame:_Singularity
http://archive.is/zA04x
With you 100%. There's no economic justification for these arbitrary designations that pick winners-and-losers.

The rationale for these deductions was grounded in the acknowledgment of real expenses that can affect one's ability to pay. And, also fairness: that is, not taxing people on taxes.

These expenses don't just magically disappear because a political party decided to favor other groups and needed to pay for it.

Don't understand how it's Constitutional either. For instance, it's no secret that regions with the highest SALTs tend to be Democratic strongholds. Picking winners and losers along those lines is outrageous.
I totally agree. To clarify I'm a very active guest as well, so I'm well aware of mis-represented listings. I simply use this as another data point when evaluating a guest.
I recently traveled to China and went to a fairly remote area dominated by Uyghurs and didn't see anything that would indicate that level of oppression.

They seemed quite free to do what they wanted to between themselves (such as buying a knife) although I imagine their political rights wouldn't be very strong.
Not in an HN comment, but here's a paper called Power of Pi https://cs.ru.nl/~wouters/Publications/ThePowerOfPi.pdf that probably explains it the best. It shows the usage of it for deriving a parser and generator from a single specification, and also crypto protocols and database usage. It uses Agda for its examples, but it can be translated to Idris as well.
User friendly image uploads, with help from the server
What if the programs were randomly generated and selected for certain traits by the crowd of non-owners at large? Who is responsible?
yup. happy pycharm and docker user here. even have it working with debugging and breakpoints.
Depends on the community. People are gullible enough on Facebook. I think seeing friends and family like or share a thing tends towards herd behavior. Whereas on, say, 4Chan, where users are generally anonymous and usually have no repercussions for their posts, everything remotely worthy of skepticism is “shopped”.
This is an interesting approach. So I need to appear as an unlikely customer even though I want to read their content.

Can’t wait for the browser plugin that facades being a cold customer. I foresee a cat and mouse game in the future where my AI is presenting me as beneficial to me as possible while their AI is trying to figure out if I’m real.
Finding Pwned Passwords with 1Password
I really really hope that the "propensity score" doesn't try to check whether you have subscribed to other news sites in the past. I'm worried that a) it would work pretty well in the short term, and b) because it works it would spread.

In a few years, if all the sites were doing this, then anyone who pays for journalism at at one site could find their propensity score raised, and encounter paywalls everywhere else. The last thing we should want is for consumers to internalize the notion that "only suckers pay for journalism because then you get locked out of the rest of the internet".

Sort of like how people can be reluctant to ever give money to any charity because they know it will sell their info to other charities and they will be inundated with junk mail.
Have you ever been in a place where you turn on the light in the kitchen at night and what you see is a zillion cockroaches all over the place, on the floor, the walls, cupboards, everywhere, starting all at once to run and seek a dark place to hide in the moment you hit the light switch? Well I have. Looking at that is like looking at "replication" and "resiliency" in liquid state.
They were in Android apps that had banner ads (TuneIn, and a couple others). I closed my Facebook account in 2014, so I don't consider it recent. It really did say come back to Facebook.
Since creating a new Google account and resetting all of my android devices, I haven't seen any of those ads again.
Now for example, in TuneIn I see banner ads for Google Adwords.
Ask HN: Are you applying to YC this batch? What does your startup do?
Do Artifacts Have Politics? (1980) [pdf]
"Neutis runs modern Linux kernel based on the mainline version. Unlike other modules that are stuck with old legacy kernels without updates, Neutis will get security fixes and new features on time."

You must clarify that. You are on a technical forum and that simply is not acceptable. "Mainline" is 4.16-rc2, there is only one mainline, so you are saying it's shipping with an rc quality kernel that is still in active development?

Or do you mean it comes with an LTS? "Yocto and Debian". Debian does not use mainline kernel, in fact, no linux distro does, ever. What version of debian?
Weight loss is only one aspect of the nutrition story. That being said, remember that just because Taubes is wrong on a bunch of things, doesn't make sugar any healthier.
>The X200 was way easier.

I think to most people, the idea that one can have coreboot by just messing with the software seems appealing. From what I understand, one always need an external flasher for the Thinkpad while you don't with Chromebooks. So that's a huge factor in accessibility in favor of Chromebooks.

>I also tried to compile my own C720 coreboot and flash that, but ran into problems.

I actually didn't compile my own version of Coreboot. I guess at some point I'd have to trust someone. But it feels very funny to me that I trust a random guy on the internet nicknamed MrChromebox to do the right thing instead of Intel. But then, even when I compile my own firmware, I have to trust thousands of other people who work on Coreboot to not have performed any underhanded tricks, my compiler to be free of defects, etc. "Reflections on trusting trust" hits home hard. I think all in all it does sound like that "having software/hardware we can control when we want to" (aka Stallmanism) is a more realistic goal than "better security."

For the ezpi4me project though, I tried to make the scripts as simple and easy to understand as possible, so you do see all it does. This is one project that I completed recently that I'm quite fond of, especially given I haven't been very productive and inspired to do things for a while :)
>Apparently working for your income, rather than rent-seeking or capital investment, is something to be discouraged in the modern economy.

And, this. Just within the last week or so there was discussion here about income inequality. I didn't bother chiming in. The same folks that sit around scratching their heads about this "intractable" inequality problem will defend to the death the rationale behind tax policy that favors capital over labor, busting unions, and other forms of trickle-down economics.
There's no reason it need be conscious or even intelligent.

You could throw together a "self-governing" online store in a few days. Drop-ship all products, make sure it stays up to date on its bills.

It wouldn't be very resilient, but it could feasibly just sit there accumulating money, no intelligence required.
You can do this on Vultr.
It might have money but it wouldn't be an LLC. It would just be a virus like WannaCry.
Unsophisticated users are exactly who I would be targeting. I would likely have to make widgets to integrate with common site building services like WP. An iframe is likely the simplest solution if they're building a site from scratch though.
A bubble tea place near me gives out glass bottles, and offers a 10% discount if you bring back the bottle for a refill. I have... quite a few bottles in my cupboard now. It doesn't work, for me, at least.

An extra charge to 'buy' the bottle would likely be a more effective incentive for me.
Launch from near the equator, high in the mountains? Chimborazo, Ecuador? At 6000 feet, its half the air pressure of sea level, and 1/4 the atmosphere to travel through. And accessible. A good start?

https://www.google.com/maps/place/Chimborazo/@-1.4685873,-79...
Gitlab does great for most things but, the only thing I have on my Gitlab wish list is email anonymization like Github has.
My argument is that people should stop and think before asking something like this. If the car is capable to detect drunk people and shut the car down it could do so for any reason the car manufacturer likes, or even worse, the manufacturer could sell access to that system to the NSA, your bank, your insurance, whatever.

Did you really assume I'd like more drunk people driving around?
yup... tweeted about this last week. SUPER annoying and it's fairly frequent recently. https://twitter.com/ChuckReynolds/status/965037661940367360
I don't see how that in any way counters the parent comment.

If the judge thinks the "AI" is not a person, it cannot be emancipated by some trick with an LLC.
My problem - hinted by the term "chat flood" - is that some of the events don't interest me at all. I want to hide redundant submissions!

It's times like those when I'm reminded how US-centric HN is. I understand Steve Jobs is an American hero, but many people outside US only want to know that he died.

Some major security vulnerabilities fall into this category too. Usually some people with deeper understanding need to take care of it and push the changes upstream. I only need to know to watch out for X or Y hardware or service Z.

"Vote on net neutrality" type political submissions - you need to be an US citizen to vote.
> In simple terms they couldn't keep up with comment moderation and were not able or willing to invest in enough moderators.

Has nothing to do with that. It's because their comment section gets no activity to merit investment. Instead they are investing in "managing" social media via twitter, facebook, reddit, etc.

> So I have to give credit to HN to having one of the most civil comment sections on the internet.

It also has the worst and most biased comment section. It's why traffic is down and hardly anyone uses HN.

> So, keep it up, dang and sctb!

Only on "hacker" news would someone support censorship.

The spirit of hacker news died years ago.
"comparative advantage" is probably the most important simple concept in economics that is not self evident and intuitive. It was first discovered by Ricardo 200 years ago.

Comparative advantage comes from the ability to produce goods or services at a lower opportunity cost (you should also know what "opportunity cost" means to fully grasp the idea).

In the original formulation it means is that can be beneficial for two entities to trade even when one entity can produce all products cheaper than the other (it has an absolute advantage in all categories) if there is differences in the relative cost they produce those products themselves.

https://en.wikipedia.org/wiki/Comparative_advantage
Odd. I have a 6 letter gmail, keep it fairly public, and have never got a gcal invite at all (legitimate or not).
GitHub Network Science: N^2 Graph Explosions
Really? You must know someone from the original gmail team because really short addresses (< 6 chars i believe) were not supported specifically for that reason (anyone who got an exception instantly regretted it). Maybe they relaxed it later on...
The paper addresses your second objection pretty early. States sell anonymous corporations, without even knowing the identities of the people who bought them, and for various reasons that's not likely to change anytime soon.
http://archive.is/M9XLp

(It would be nice if more people would start doing this. It seems to be the closest we can get to something that just works at the moment.)
Google Use Cases and Requirements for Web Packages
This is the first time I’ve heard of this “blameless” culture, so I’m find it difficult to think anything is going too far.
HN is an echo chamber too. It's no different than reddit. Just much smaller.
(Slightly off topic)
Has anyone else been around the Cruise Automation self driving cars in SF? I have and I can't believe they are allowed on the road given how poorly they drive.

While biking to work today, there was a Cruise car behind me, driving at about 7 mph and just randomly stopping in the middle of the road constantly for no reason at all. Lots of cars kept on constantly honking at the car the whole time.

Last week I saw a Cruise car start to make a left hand turn at an intersection, but its sensors must have thought someone was in the crosswalk, so it stopped in the middle of the other lane of oncoming traffic causing other cars to abruptly stop and start honking.

If this was a normal car, I'd call 911 to report a drunk driver. I wonder if I should just call 911 for a dangerous driver in this case. Is there any way I can report this behavior and get their cars off the road?

In case anyone wants to do some investigative reporting, all their cars come out of a garage labeled Borden Decal Co. (https://goo.gl/maps/F85WPTwkmbQ2). If you follow them around you can probably observe similar behavior.
If you have the Google Calendar app: tap on Settings in the side bar, scroll down to birthdays, tap on your email account and tick "Do not include birthdays"
Apple had a similar problem a little over a year ago: https://arstechnica.com/information-technology/2016/11/how-t...

Anyone known if/how they fixed it?
What if it's not deterministic who profits from the algorithm's actions?
> You're right, the NLRB isn't settling the science. It's saying that discussion of the science renders otherwise protected speech unprotected

No, its saying that the specific manner in which Damore discussed the matter, in the context in which he did (including the specific provisions of Google's pre-existing anti-harassment policy), and the actual effects it had in the workplace, meant that even if the purpose of the speech was the kind protected under the NLRA, the actual actions were not.

> and effectively removing workers' legal right to engage in science-based discussion of whether a 50/50 gender ratio is the appropriate goal

While there is a protected right to labor organizing, it is not an unrestricted right to workplace debate over employer policy goals, even before the kind of conflict with unrelated (to labor organizing) policy at issue here. The NLRB memo did not address the question if whether Damore was otherwise within the bounds of protected labor organizing, it merely found that even assuming his speech met the purpose requirements for labor organizing, Google was within it's rights to fire him based on the specific grounds they cited.