skysight-inc/HackerNews huggingface dataset:
> €300 knives to cut apples in slices

Oh, I really enjoy prep-work. I have to admit, I like using a nice, sharp knife (plus, it's much safer).

I hate doing prep-work at other peoples houses. The knives are just so dull.

So, I spend more money on knives than I should because I enjoy good knives and get lots of good use out of them.
That sounds both very frustrating, and quite bizarre. I can't imagine why ambient light sensing would need to peg the CPU ever.

If you haven't done so already, I strongly encourage you to file a bug report with Apple at https://bugreport.apple.com
Heck, even scheduling on single core machines can be hard. I don't want to even try to imagine what hell multicore adds to the mix.

In the late '80s I worked at Interactive System Corporation, the company that AT&T contracted with to do the official System V Release 3 port from the 3B2 to Intel processors. I was initially working on the port to the 286.

The 3B2 was a paging system, which did not really fit well with the 286, so it has kind of hacky. We never were able to get the scheduling to behave reasonably. Running 10 CPU bound tasks, for example, would result in one getting about 85% of the CPU, another getting about 10%, and the other 8 splitting pretty evenly the rest. It would do this for a while and then would start massively thrashing swap for a couple minutes, and then would settle back down to the 85/10/* but with different tasks getting the 85 and 10.

We were still stuck on figuring that out when AT&T came to their senses and realized that no one actually wanted System V Release 3 on a 286 and we dropped it. At most what they wanted was to run their 286 Xenix and 286 System III binaries on their 386 System V Release 3 systems, and I got moved over to working on the emulators for those, which was much more pleasant.

(Besides multicore, another thing that I would guess makes it all much harder for today's kernel people is caching. Caching on the 286, and even 386, was a lot simpler than it is today. We were still in the days when systems were primarily getting faster because clock speeds were going up, not because they were being smarter. Now I think they get a lot of performance from very good use of resources, such as cache, and it is a lot easier in kernel software therefore to blow performance).
I'm not a lawyer, but the Canadian copyright act is actually quite readable: http://laws-lois.justice.gc.ca/eng/acts/c-42/ As a programmer, I'm someone who depends on copyright for my living, so I always thought it was a good idea to understand what it says.

While, the advice to get a lawyer is a good one, I think it's actually pretty clear that it is not legal. It falls pretty clearly under "(f) in the case of any literary, dramatic, musical or artistic work, to communicate the work to the public by telecommunication". You would have to get a license -- and that's the difficult-to-the-point-of-impossible bit.
Completely agreed. It is hilarious because we all preach "don't reinvent the wheel" at the same time that our interviews are basically "can you implement this ridiculously low level wheel" on top of "come here where we are simply using the latest rims!" :)
I like reading comments, you never know what you'll learn. Guido is taking a break and I learn a bill about food donation.
Sustainable Development Goals Index and Dashboards 2018
Ask HN: Where can I sell the software of a failed startup?
I was involved in a startup that failed. The startup was supposed to be a solution to ridesharing, let's say similar to Uber. We never launched but we developed a lot of code that represented at least a solid portion of the product.

Is there any marketplace where we can sell this code, and/or can anyone provide a ballpark range of what it might be worth?
I don't think imaginary internet points serve entirely or even mostly to punish.

It served to highlight valuable content and in some venues to weed out low value content entirely. This is more significant in large bodies of comments. Example highlighting the most useful 20 comments out of 700.

Interestingly sometimes wrong information can lead to good threads where people provide helpful corrections. In this case the thread is valuable for stirring up discussion even if the information may be wrong.
The main difference is the container is focused on an application and a VM is focused on a machine.

Generally the patching problem can be solved with image scanning, of which there are tools out there to deal with this, both FLOSS and pay for.
Scaling up molecular pattern recognition with DNA-based winner-take-all NN
OSS and Community. The Story
Technical execution is the easy part, but legally speaking, you might fare much better by just offering to physically deliver movies on demand.
Detexify
I don't think it's valid to discount the individual's power by the number of voters. If the low impact of any single vote had the sort of effect you're suggesting, people would be much more likely not to vote at all.

When a voter is just one of millions, their share of power is necessarily low. Yet the total power obviously rises linearly. (or even super-linearly, considering the outsize influence the US has in the world). Your comment also suggests that you believe people are fundamentally open to altruistic decisions. It should therefore not matter if the power they have is over themselves, or their compatriots.

I also doubt widespread agreement with the policies you mention. Answers to such survey questions depend on the phrasing more than anything. And to use one recent datapoint: we all know a recent candidate who embodied those policies more than anyone before him. Yet they actually got fewer votes than their free trade / pro-immigration opponent.
All I can say is that I've watched movies that I got from Blockbuster which were missing scenes (often graphic or explicit scenes) that I'd seen in other versions of the film.

Now, this was decades ago, so I don't remember which films they were, much less which scenes were cut. But I have talked to other people who've echoed my experience. I've also read articles in the past which admit this censorship happened.

A cursory web search just now came up with some mentions of said censorship:

"As mentioned before the movie opened with an NC-17 rating but Verhoeven himself edited an R-Rated version for rental chains like Blockbuster Video."[1]

"As is often the case in the USA that besides the usual Unrated releases of DTV productions there are also Restricted versions especially for rental purposes (Blockbuster Video) or being used in supermarket chains (Walmart)."[2]

"Portuguese rental video version seems to be the one made for Blockbuster video. For retail the alleged mistake was corrected, though some censored tapes were still seen on sale. The cut scenes are as follows:..."[3]

[1] - https://www.movie-censorship.com/report.php?ID=1932233

[2] - https://www.movie-censorship.com/report.php?ID=5899077

[3] - https://www.imdb.com/title/tt0115964/alternateversions
https://flippa.com/ is in that space.

P.S. prefixing the title with 'Ask HN:' gets you more exposure, the question will then go to https://news.ycombinator.com/ask
The cost of an helicopter seems like an obvious reason.
s/boku/beaucoup/

Interesting eggcorn; where'd you learn it that way?
I'm not convinced the legislature explicitly killing or dramatically reconstituting agencies is a significantly rarer event than large companies going bankrupt. More to the point, the executive is seldom shy about embarking upon restructuring or adjusting funding and objectives of its administrative bureaucracies, not least because it faces its own acute existential threat from not being seen to give its taxpayers value for money and the operations and future direction of its bureaucracies is the subject of open public debate; obviously more for pensions and prisons than vehicle registrations or waste transfer licensing

Ruthless efficiency for maximising long run profit is only useful in cases that particular metric happens to align closely with the goal of society. For film distribution this might be a reasonable assumption. For promoting health or learning outcomes or facilitating retirement, it almost certainly usually isn't.
the attacker used generic sites (pastebin, stat counter sites) and there is no reason they did not access them through tor. Why would it be possible to track them down?
Because UNIX security model ¯\_(ツ)_/¯ Pretty much every modern programming environment involves running arbitrary third party code as "you", with access to all of ~/ and whatnot.

How would you solve that on a package manager level? Static analysis? It's really difficult to make an analyzer that wouldn't be trivially defeated by obfuscation, and wouldn't at the same time have false positives all the time.

Sandboxing at the language runtime (in this case node) level? Theoretically a nice idea, but difficult to implement securely. Java has been trying. Besides the fact that practically no one uses it to isolate third party libraries in server/desktop apps, there were some serious vulnerabilities: https://www.thezdi.com/blog/2018/4/25/when-java-throws-you-a...

An OS level capability-based security model like Capsicum/CloudABI is a better solution, but again — doesn't fit that well with libraries. In Capsicum, you need a process boundary to isolate code, and that implies IPC, which is a thing developers absolutely love to use all the time… (not).

Here's an awesome research idea that I sadly do not have the time to work on: make a programming environment where all shared libraries are actually servers built as CloudABI executables, library calls are actually some super-fast RPC (with e.g. Cap'n Proto to avoid spending time on serialization, and of course fd passing for capabilities), and everything is handled as transparently as possible.

As a bonus, CloudABI solves the OS portability problem. Extra research idea: merge CloudABI with WebAssembly to solve the CPU portability problem as well. End result: same application runs on Linux/amd64 and NetBSD/toaster128, with secure sandboxing for every third party left-pad module.
I'm saying it happened and Python 3 is the language I want to use. If you don't do Python 3, you either keep the error prone str/unicode string model or you dream up some way to evolve to a better model. Would some mythical version of an evolved Python 2.x be better than what we have? I mean, how to argue against that? I haven't seen anyone propose a workable migration plan. Python 3.7 is better than 2.7.15 and better than 'tauthon'.
It's unlikely because the existing staff incentives are from the previous business line, not the new one.

Just try and get your sales staff to sell a new product line when all their commission comes from the old one.
Not having done an npm install today _probably_ is grounds for confidence.

It does though, assume that this discovery is the first time this has ever happened. If _I'd_ been considering doing this attack, I'd almost certainly have trialled it on a less popular and hence less likely to have malicious updates noticed package before hitting something like eslint.

Also, the postmortem leaves out any details of whether or how they've audited the rest of the repo - sure they've cleaned up the two packages they know about and revoked some tokens, but I'm not confident they've done the work required to allow confidence that other packages haven't been targeted in this or previous attacks, meaning they might still be leaking new post-revocation tokens.
Honestly, most of the introduction I've seen has been bottom up or from new hires. I think there is a major point in having happy development environments. Happiness with tools is a very important point that is hard to quantify. https://www.johndcook.com/blog/2011/07/31/enjoyment-of-ones-... has a fun exploration of two great quotes on this vein.

That said, if you can, I'd be ridiculously interested in a retrospective when you have a chance on your transition. Good luck with it!
I actually prefer to read the philosophy of a language, before diving deeper into the language itself. It gives you an idea of the author's motivations for creating the language. I feel like a code sample would make it too easy to judge its syntax, and not tell you enough/much about its semantics.
Thanks. The eventual goal is to make finding and gov services delightful & this is just a step towards that direction.
> is it a good idea to have a single point of failure for your logins?

Just like logging into to 2 SaaSes from the same computer... at which point a keylogger/camera/microphone on/near that computer becomes the single point of failure.

There is a point at which too much paranoia paralyzes a person into inaction. Criticizing people for not defending against nation-state level attacks (eg. Password Manager attacks) when we can't even defend ourselves against the neighbor's son (credential stuffing without 2FA) seems like putting the cart before the horse.
You make good points about package signing. It's not a trivial problem. Fortunately it's a solved one. There are package managers (pacman, nuget, rpm, etc) that do this. Yes, maintaining a web of trust is required. Nobody said otherwise. You don't need to put words in the mouths of people who want NPM to be a bit more secure. Point is, it's probably worth the hassle for a fairly critical piece of infrastructure.

At the very least they could just do what Ruby gems do and allow packages to be signed but leave who to trust up to the user. Frankly, it wouldn't be that hard for ESlint to publish a key on their site and users to run a command like `npm trust /path/to/eslint.pem`. I don't generally think security should be opt-in, but it's still better than no option at all like current NPM.

Also, you didn't touch on the fact that NPM allows executing unsandboxed code on package install. I'm actually curious if you think there's a decent reason for this. It seems like a _really_ serious issue for questionable benefit. As far as I can tell, PyPI doesn't allow this.

> I eagerly await your next set of soundbites that have come up, and been rebutted, in every single discussion of npm and PyPI that's come up on HN in the past five years.

I'll ignore this blanket dismissal of my points. I think given NPM's history of issues (including particularly absurd highlights like left-pad and this eslint incident) maybe the NPM community should stop turning a blind eye to this and consider that they could be doing better.
Weird ISAs are exactly why you cannot compare pointers. Segmented memory for one. Or imagine an OS and compiler that implemented automatic overlay switching. With that and PAE on 32-bit x86 systems you could have special "far overlay" pointers returned from malloc calls which would map in different 1 GB overlay sections when accessed.

Aliasing rules are important in some ISAs too. Like weird DSPs. Imagine a system where 32-bit objects can't even share the same memory space as 8-bit objects. Casting a pointer to a different sized type is completely meaningless there. Of course programming such a weird thing is usually done in assembly, but there are C compilers.
Seconding consulting. I'm in marketing but I went from 100k - $400k a year with the same hours.
> For new projects does it make more sense to leave this framework behind, even though it was brilliant in its day?

No. It doesn't make sense. Bootstrap has turned into a utility library. What I do is import the SCSS utilities and make my own stylesheet based on boostrap. I usually include the form styles, disable animations, and then use the grid utilities to make more meaningful grids. It's a great foundation for building out your own framework.

Not to mention it's one of the only frameworks I've seen that actually gives a shit about accessibility.
So... still no USB-A or SD card port, still with the Touch Bar no one needs, even THINNER than before so likely the keyboard is shit, and the touchpad probably as oversized as on the current model. And I don't want to know the battery life of a 6-core CPU with so little space left for an actual battery.

Jeez, Apple.
Note that you are still living in the best times humanity has ever seen. That's true in the US, but also world-wide, with few exceptions such as Syria.

There's less war, life expectancies are generally rising (the opioid epidemic being a temporary, and local, blip), the possibility of achieving one's true potential is less dependent on class/gender/race than it has ever been.

It's not perfect, but it's far away from life as it was even 100 years ago: nasty, brutish, and short.
This sounds like useful updates and I'm glad they kept it small and simple.

I use Notepad many times a day, frequently on end-user machines as a quicky binary file viewer.

Enter shell:sendto in the address bar or run dialog, then add a new shortcut in there for Notepad. Then right-click a mysterious misbehaving file (like a PDF with a DOCX extension) and Send To, Notepad.

Today though I was doing a bunch of RegEdit work with several remote registries and was really wishing for a multi-tab Registry editor. Hope that app gets an update some day.
> "The market" took over after a long period of "design by committee" that had "strong design principles"[1]

Yes, but a committee (or a community if that term has too many bad connotations) can at least argue about the design principles and on occasion decide to change them using a well-defined process (e.g. rough consensus or voting).

> When the market did take over, the problem was that those poor foundations weren't thrown out completely.

The original plan of the W3C TAG was to pull the foundations and make a fresh start with XHTML2. The browser vendors objected to that and chose to instead evolve the original HTML into what we have today.

> The other part of the mess is caused by the ever-growing amount of trend-hopping junior developers that want to try out new things...

But that's the point. Those trend-hopping junior developers and their bosses are the market: If you view programming languages as products, those are the early-adopters, one of the generally most sought-after part of the customer base. If you want to be 100% market-driven, you have to listen to them.

> ...because the market rewards stability

The market apparently didn't bother much that HTML is now a "living standard", browser release cycles are measured in weeks and generally a software is considered dead if it doesn't receive any more updates.
Back Bay itself is landfill and it still shifts a little here and there. I was told during a tour once that parts of Fenway had sunk over time.
The wording is pretty vague, I guess intentionally, but saying "we found no evidence..." isn't as confidence-inspiring as if they'd said "we determined that no...".
I'm helping build an Openshift platform with 2-3 redhat consultants. I do not work for Redhat, I'm a Linux/Devops admin. It's been very simple to install and fully automate everything. It also is allowing developers to focus on writing code and not infrastructure as AWS does. Most of it is bare metal for now, but we will be able to spin up AWS and Azure in a few hours with the same code.

The instructions are accurate, it's been easy to learn, and does not require an army of consultants. We will be moving 1000's of apps to multiple data centers globally with a team of around 6 people. It took 100s of employees years to build and maintain infrastructure for those apps.

Note - Consultants are not needed at all, they simply help speed up the process with expert knowledge.
On interactive uses, sure. But it's not clear cut, some code paths are lower level and bypass that.
I wouldn't say I'm so fixated on the escape key that nothing else matters. The base OS matters a great deal! I pursued three lines at this particular fork in the road, I considered buying a 2016 MBP, a refurb or whatever, I considered switching to unix on whatever hardware (leant toward dell XPS), and I considered a windows box, with unix living underneath, somehow. The first option just seemed crazy to me, perhaps irrationally, but making my new machine a two year old machine just felt wrong, the second option could have mostly worked, except that I really need excel, and I really want ableton. I decided to give the third option a try, thanks to the money back guarantee, and I'm amazed at the improvement.

I suffered the temporary pain of switching to OSX in '06 because I'm not religious about these things, and at that time macbooks running OSX were providing an exceptional environment for devs like me. It was a hard transition, but after a couple of months I was (mostly) fine. A fair amount has changed in the world in 12 years, and I'm no longer convinced that OSX inherently provides the best environment for a dev. I figured give windows a shot and see how it goes. It took me 24 hours to get the machine in a state where I could work as before (this would have been impossible on a windows box in 2006), and the question now becomes, why would I go back? It's only been a week, so perhaps windows will show me why very soon, but my gut feeling is it won't.

Also worth considering, is that from about 2000 onwards, apple was catering to open source focussed devs, at the exact moment that microsoft was making their lives impossible. I think that trend may have been reversed. Every upgrade to OSX for the past six years or so has represented more pain than pleasure for me. YMMV, but microsoft's offerings, even when flawed seem to be headed in the right direction.

As far as the comment, yeah, I was a little snarky I suppose, but a common response to complaints about the lack of an escape key is "you don't actually need one". I'm sorry, but I do. Ok, I don't need one. but I really want one, and this is a laptop we're talking about, and I use it as a laptop most of the time. I also want ports, a headphone jack, etc. But the escape key is for me the last straw, and enough of an incentive to actually look on the other side of the fence, which I've avoided doing for 12 years. I like what I see there.
The Chicago Express Loop
People mention most of these steps every time npm fucks up (which is often).

Package management is a mostly solved problem, but npm refuses to learn from the 30+ years of experience that Linux and other communities have had.
uhhhhh

CRUD has been around forever. Like literally, since the mainframes.
DevOps is more like System Administrators doing the work of Software Engineers for half of the money.
I just use i3.
Guido's glasses are much cooler, IMHO.
https://github.com/twbs/bootstrap/tree/v4-without-jquery

Maybe try to see if this is complete enough to work.
Implying that systemd is somehow the root-cause for this performance disparity strikes me as ridiculous.

I've noticed a pattern over the years with anyone spelling systemd as SystemD: They tend to not really know what the hell they're talking about with regards to systemd, while possessing significant bias against the project, actively searching for reasons to disparage it.