skysight-inc/HackerNews huggingface dataset:
Slow down, I don't think I've done a single thing about "trust."

That's still a social problem.

What I want is that the mechanical process of doing code reviews, accepting pull requests, and orchestrating the Access Control Lists, and the membership of them, can be implemented by the code repo.

Rather than giving unfettered power to a small list of owners, who could literally do anything to the repo. And if they all get hit by the same bus, then we're SOL.

Heck, I want a Deadman Switch, too. If Github doesn't hear from me in 90 days, even after emailing me to get my attention, then ownership of this repo should be assigned to this other person. If that fails, on to this other person, etc.

"only a fool would believe a bunch of codified rules spread across a couple of software functions could ever perfectly mediate the complexities of a community of people in every possible scenario."

Or someone who has experienced such a system at a company, and wishes the rest of the world had similar functions.

Note that I'm happy to allow for escape hatches... Such as we could always Fork the repo.

"What if 51%"

Then I fork the repo.

What do you do if the 1 single owner of a repo turns out to be a fanatic?

You and twenty other people all fork the repo, and then debate ensues about who is the One True Repo.

I'm suggesting that there's a smarter way to handle the problem of a small number of people having absolute power over our repos.

And if you're smart, you leave in a provision for completely changing the governance, in case you screw it up. Or you just fork. Like we do today.
It's also a regulatory body to ensure that certain functions and services are provided equally to every citizen. E.g. everyone has the same basic human right of access to health care and education for example. Who else should guarantee that access for a whole population if not the government?
RPM and .deb packages have GPG signatures and lists of trusted maintainers. NPM doesn't have that; https://medium.com/redpoint/introducing-pkgsign-package-sign... looks like a very early start on a big project that could fix this if it catches on.
Considering how you pretty much need 1,000+ node modules just to run most framework hello worlds, yeah this is terrifying. But it's a well known problem, too, that no one seems to want to do anything about and with npm being a business that wants / needs people to download modules through them, I don't see this changing any time soon.

Maybe Deno can help give a new, security focused life into JavaScript development.
Or more simply, if he wants to return to this employer in the future and they have the same or similar office space, they will surely ask him why he thinks that he will now, somehow, be able to work well in in that environment that was so problematic for him in the past.

Not criticizing this person, I despise my open office environment too. I also wouldn't (and didn't) tell tell my employer about this when I left for a few years in the past for the same reason.
Can you give some more information on this? Is this part of the npm-audit feature?
When you take the joy of programming from somebody, you cannot expect them to stick around. At some point, we all have enough.

Excited to see what Guido wants to do next, enjoy it!
This can work, but stacking framework on top of the framework is what made the classic application servers undesirable and a horrible mess to begin with.

Observing similar patterns creeping in the Kubernetes culture and ecosystem does not inspire optimism in a side observer like myself.
I think client easter eggs are different from OS easter eggs.

> the OS division has a "no Easter Eggs" policy.
I only learned about Turicreate after watching the CreateML video from WWDC. It's on my list to play around with, but no comparisons so far.

Any feedback on using it?
> go out of their way to fix third party programs not working correctly by adapting their platform, it was a very efficient process

This kind of thing probably doesn't even scale with itself, since there are only so many acrobatics your code can go through before no one can even understand why it's doing something, let alone add new workarounds. So the first K broken programs get special treatment, and the others face a much higher bar to get the same treatment.
Yes I wouldn't be so impressed with a colorized image if the source was just a regular x-ray. But my impression was that they were capturing multiple frequencies, so it was a lot of extra information to the image. I don't know anything about radiology but I'm always excited to see some progress.
Our civilization has attained its complexity by encompassing such knowledge that it would take a million lifetimes to learn all of it. I have made my career learning about technology and learning about science is a great hobby of mine. But I have only the dimmest understanding of even how much there is to know.
Snap Story: Flat Tire
Eh... Slack is entrenched at this point.

If you’re not a MS shop you’re not going to even look at this thing.
Funny enough last time I used one of these I still screwed it up and ended up having to talk to a cashier anyway.
Thanks, this point of view always seems to get lost when these open office threads pop up. I had a job with an office (with a door) shared with one other person. The loneliest, most depressing time at that job was when the guy left for a different company and I was by myself there. It was horrible. I basically moved my workspace to the break room so I could regularly encounter people and left the office empty.
Sure, it's a great book, but it only covers a few of these topics (maybe 4, 6a, 5, and 9) and covers a lot that goes beyond them. It's a book I would heartily recommend, but not for someone whose primary goal was to learn about web architecture.
I'm a big fan of DDIA (I have a copy in front of me right now), but the topics covered in DDIA are much more around distributed systems and databases, in short "data architecture", i.e. batch, streaming, derived data, transactions, consistency, etc.

The article above is more about "web architecture".

There is some overlap but DDIA largely doesn't really cover the same topics.
To pile on, I used to work in an office where a coworker's spouse sometimes showed up with their dog and newborn baby, in the middle of the day. Then I got to enjoy 20-40 minutes of high-pitched screeching in the office as the Slack channel was littered with things like, "WHERE IS THE LITTLE HUMAN. I MUST SEE THE LITTLE HUMAN" and "LOOK AT THE FLUFFER!"

Sartre was right. Hell is other people.
Building HTML GUI Interactively in Python
The majority of my use of my MBPr is in clamshell mode, with a large external monitor, and a mechanical keyboard. Even for people who use theirs open, beside a large monitor, it's usually on a stand. So a Touch Bar is either pointless, or so unwieldy as to be useless, in these situations, respectively.
Sorry meat lovers Processed meat gives you Cancer
Shall you need a UUID scalar type for GraphQL.js, here is one
One of my PHP bug submissions is already in high school. The other is in kindergarten. Thankfully both of them won't see light of day in most applications.

But focusing on PHP is rubbish - you can look at any language and find questionable choices. The moment where we need frameworks to make the warts go away - that's worrying. Same thing with JS really
I am starting to find your repeat posts a bit irritating.

You've posted this one 5 times over the last 2-3 years (see https://hn.algolia.com/?query=Gender%20is%20not%20a%20spectr... ).

Looking at your recent history, you've posted "Hacking chemical plants" 8 times over the past 2-3 years (see https://hn.algolia.com/?query=Hacking%20chemical%20plants%20... )

The sqlite one 4 times over the past 1-2 years (see https://hn.algolia.com/?query=Prefix%20for%20sqlite%20tmpfil... )

The "What Black Jack Pershing" again about every 6 months (https://hn.algolia.com/?query=What%20Black%20Jack%20Pershing... ).

Is there a reason for the reposts?

For example, I thought the SQLite link would be something new, rather than a re-link to a comment written in 2006-10-31.
Maybe I'm a backwards person but I barely use escape at all. I do however use the function keys, all day, every day. I have them mapped to various apps for screengrabbing, batch copy and paste of files, rename etc. Apps like keymaestro let me add extra functionality to these "spare" keys and I don't want then replaced by any damn touchbar
Wonder how many "NSA eggs" have been planted in MS products over the years? All it takes is one NSL.
Chan Zuckerberg Initiative Biology Repositories
I used it for several months. I closed cards and they let transactions through anyway. When I disputed them, they first ignored, claimed disputes wasn't working when I asked for status updates, denied disputes, then closed my accounts, and refused to refund the invalid charges.

I would not recommend them. Their marketing is dishonest, claiming that transactions cannot go through if the card is closed, while in truth merchants are able to "force post" debit transactions even when closed.
+1. I spent my youth starting at 15 reading sci-fi books from the 50s onward, and the number of dystopian futures depicted as pure fantasy then but not that far from becoming reality now is disturbing. I'd dare to say that reading that genre is likely the best possible way to educate kids minds to see current events coming years before they actually do.
It's one popular way, that's all. There are plenty of others that could make sense.

A game could grant you the ability to edit its source code, after you complete the game. That's just a for-instance.

> Will there also be an option for pure democracy?

Sure, why not?

> Can I fork your socialist utopia and form an authoritarian dictatorship?

Mechanically, sure. There may be licensing problems, but that's true today.

> I don’t see why this system would ever be beneficial to a real world government.

If the real world government stores its web pages in GitHub, then the real world government can use this governance to handle changes to that web page.

Rather than letting a lone IT admin have root.

> What’s the benefit?

If you're comfortable with needing to fork a repo when the BDFL goes rogue and starts making changes you hate, then there's no benefit at all.
>1) If it works for some of the most successful tech companies on the planet (Google / Facebook / Amazon,) why can't it work for us?

The open floor plans hurt their expensive worker's productivity, but they have the money to hire more people. A small company has to be more worried about worker productivity than a large mega corp.

>...2) Prove to me that the loss in productivity is higher than the cost / investment necessary to build everyone an office (or a semi-isolated cube) + value gained from collaboration.

There is pretty much overwhelming research that people are more productive and healthy at work when they have some privacy and don't have distractions. One example - a study published in the Journal of Environmental Psychology of more than 40,000 workers in 300 US office buildings:
"...Enclosed private offices clearly outperformed open-plan layouts in most aspects of IEQ (Indoor Environmental Quality), particularly in acoustics, privacy and the proxemics issues. Benefits of enhanced 'ease of interaction' were smaller than the penalties of increased noise level and decreased privacy resulting from open-plan office configuration."

https://www.inc.com/geoffrey-james/science-just-proved-that-...

This article talks about some of the other research on the negative health effects and other effects on productivity:

https://www.newyorker.com/business/currency/the-open-office-...

Even the idea that there is any actual "value gained from collaboration" in an open floor plan is questionable and anyone claiming it should show some evidence for it. In a large company, the issues always seem to be between teams, not inside the individual teams. An open floor plan lets you hear every random conversations in your own team, but it really discourages people from going to another teams area to ask a casual question or have an impromptu discussion of what they are working on since they know they would be disrupting several people.

The best environments I have seen are when there are individual offices with plenty of open areas and conference rooms for people to meet.
https://stocktracker1.herokuapp.com/ - That's the actual running application.

Any feedback is welcome.
In a way, it is sunk cost all the way down. Those companies' entire existance - supply chain, manufacturing, down to identity of what they do was so etched into everything it was hard to change.
but economists invented the term "externalities" and the analysis of such..
It Just Got Easier for the FCC to Ignore Your Complaints
Maybe we need a 3rd party hosted solution that is public and transparent with semi anonymous posting. Maybe with a pgp proof of authorship.
Welcome to the galaxy stranger, this is our ray-gun- its big- and constantly firing.. so if you are not up to something good here- your home planet better be good at dodge ball.
If I recall, Steve Jobs attempted holistic methods for treating his cancer instead of undergoing what his doctor recommended and ended up dying as a result.
>Yes, you lose tactile feedback

That's the only part I really can't lose.

I like the volume slider fwiw but the regular ones worked fine too.. it is a small bonus with a massive drawback .. of course I don't like it.

Not to mention that I don't ever look at my keyboard when typing, so touchbar is just a annoying glow at the periphery of my vision.
I think the general consensus is that the ineffectiveness of long sentences is mostly about hyperbolic discounting. Hawaii has recently had a lot of success with a program providing small, immediate penalties to people who break their parole conditions. This seems to work far better than large penalties that will only be applied after a large number of offences.
Django went through this years ago; Jacob and Adrian, who were the "BDFLs" of the project at the start, stepped down.

The current governance model is mostly around consensus on the dev list. There's a "technical board" elected every release cycle from among the committers, to act as a tie-breaker when needed, and with veto power over DEPs (Django's equivalent of PEPs) and adding new committers. I don't know of a case where that veto power has ever been exercised, FWIW.
I come in at 10-11am and leave at 4-5pm (including an hour of lunch). The rest of my work I complete from home. There's no need to be in the office for all of your "workday".
When I'm wearing my cynic hat, the touch bar is the beginning of a plot to replace our physical keys with another screen with an image of keys. The 2030 MacBook will basically be two iPads taped together
So.... what's new this time around from when we had this same discussion a week or two ago? I agree these are bad, but what are we actually gonna do about them?
No. SV has gone through many a boom-bust cycle.

From chip companies to dot-coms, from infrastructure software (Cisco etc) to the app economy. If there's one thing going for SV, it's the constant reinvention of itself and the markets
This is said about every industry standard product before another replaces it. What makes this different?
MNT Reform – Open Source DIY Laptop for Hacking, Customization and Privacy
I wonder if the workaround will end up being to order at the drive through window with a person and bring your meal into the store to eat.
I like how Adobe Lightroom [classic] displays names of dev and QA (and other?) team members in a splash screen on startup. Apparently at least Photoshop does the same[0]. I've always thought this is a nice way of giving little kudos to people behind SW.

It works the other way too - a long time a go I was brought into a particularly challenged SW project (e.g. when we still shipped desktop apps with splash screens), and among other things, I put forward a proposal that we will do exactly the same: let the whole world see who is behind the code. Unsurprisingly, motion was shot down, but I think the mere thought that we might still do it made everyone contribute better code. Maybe. Maybe not.

[0] https://www.hongkiat.com/blog/heroes-of-photoshop/
You should contact them[1]. TrustInSoft has a document that matches the classes of defects that its analyzer can guarantee the absence of to the vocabulary and recommendations of EN 50128. If you are preoccupied by this standard in particular, I'm sure that this document would make things clearer.

N.B.: You had drifted away from the description of tis-interpreter at some point before you arrived to https://trust-in-soft.com/industries/rail/ . While nothing prevents you from finding tis-interpreter useful in application of EN 50128, the page was written with TrustInSoft Analyzer in mind. TrustInSoft Analyzer is a static analyzer that propagates through the program sets of values (“abstract values” is the technical term[2]) instead of the concrete values corresponding to specific inputs that tis-interpreter propagates. As a result, TIS Analyzer can guarantee the absence of unwanted behaviors for all possible inputs. This is what makes it valuable from the point of view of software safety.

[1] disclosure: by “them”, I mean “us”, since I'm a co-founder and work there

[2] see https://en.wikipedia.org/wiki/Abstract_interpretation
I think part of the explanation might be the explosion of choice [1]. For better or for worse, the more choices there are, the better people expect them to be to stand out. If you make software that solves a critical problem nobody else's does, I doubt people will feel nearly as entitled about it as about a forum or a programming language or whatever.

[1] https://www.ted.com/talks/barry_schwartz_on_the_paradox_of_c...
Ed's focus here is not so much on automation - but on trashing the increase in minimum wage that is driving this with McDonalds. Because apparently earning a living wage is asking for too much - "think of the jobs" ed says. Disregarding that the people in those jobs, today, do not make enough to live.

> Pricing young job seekers out of the market and a weekly paycheck is just one immediate effect of an increasing minimum wage.

that's some impressive mental gymnastics. Obviously the logical alternative then is to remove the minimum wage, "let the market decide" and put in place some real slavery in this country. Then EVERYONE can have a weekly paycheck! Nevermind it won't be nearly enough.

In short, Fuck Ed.
> Are they able to hijack stuff all the way down the dependency chain?

Potentially.

Just because you have `eslint` installed as a dependency doesn't mean this exploit ran on your computer. You would have had to run `npm install` (or a similar command) during the infected time (NPM makes it sound like just a few hours).

Details:

This was in `eslint-scope`, an optional dependency of `eslint`.

For this to affect you, you would have needed to run an `npm install`-like command after the infected version of the module was published to `npm` and before it was unpublished.

It's not clear yet if any other modules were infected. Time may tell.

The exploit ran arbitrary code (RCE) after an `npm install` / `npm update` type of command. The payload was a pastebin paste (since neutralized), so to the extent that it could be changed by the author, what the RCE did could have been changed.

NPM has announced that they have disabled the credential-tokens that were issued from a specific time interval, meaning that NPM publishers would have to re-authenticate in order to publish module updates.
Recovering astroparticle physics PhD here.

I read this news with great interest because I thought they might have finally detected the flux of neutrinos predicted by the GZK process[1]. But, this can't be the case because 1) 10^14 eV is probably on the low side for GZK neutrinos, and (more importantly!) 2) that flux would be fairly isotropic, and not from point source.

But still! Exciting results! IceCube is an ambitious and wonderful detector and I'm always pleased to see it in the news.

[1] https://en.wikipedia.org/wiki/Greisen%E2%80%93Zatsepin%E2%80...
Yep. This attitude isn't dead, assuming you approach the developer via the right/preferred venue, and are polite, and they are still actively maintaining the project. And it really helps if you give a thorough bug report!

I recently submitted a bug report to a fairly niche OSS package that I use, and within a few hours the author replied (on GitHub) something like "oh wow, yeah that's an edge case but I definitely want to fix it, can you send me the test data you used..." and once I gave him the test data, he had it fixed in two hours and now anybody who grabs the source won't have to deal with that bug.

It was great, and even though I didn't do anything except write up a bug ticket properly (the same way I'd expect anyone on my team at work to do it), the software is a little better now.
One other thing I believe is worth mentioning -- and to be honest I was a bit surprised with -- is the ecosystem around GCP vs AWS.

For example, we were looking for a solid redis hosting service in the EU, and latency is key obviously. There are virtually none with GCP, but quite a few with AWS. I'm pretty sure there are other similar examples with other services.
From 2015 to 2016 models the battery capacity dropped from 74 watt hours to 49 watt hours in the new 13" design. The gap was made up for by efficiency gains of the CPU and possibly the display. But the display can also be cranked way brighter now, running it at the full 500 nits will hurt your battery performance for sure. Also if you are running demanding loads it will be worse off as well.

The Touch Bar likely sips power, but the real issue with it is the lost battery capacity beneath it (The non-touchbar models have larger batteries at 54 watt hours)
Used to. My recent experience is that this has either been disabled, or is applied unevenly.
> (a := b) rather than a = b

That's not it at all. The PEP even acknowledges that while `(a := b)` would be valid, it would not be recommended.
Could you please not post shallow, inflammatory dismissals like this? The context for this discussion is a recent study (see also https://news.ycombinator.com/item?id=17448187) that ought to count as “running the numbers”.
I didn't mean to imply that the concerns were unfounded. I know there are real, legitimate complaints with the touchbar.

At the same time, I just wanted to point out that there are at least some developers who do prefer it, and that the dislike isn't universal.
Sure, but smart phones & social networks see far more user adoption and time spent than any newspaper during the era of yellow journalism. The scale is just incomparable, and potential consequences far greater.
Hi, we have a fair few US users of our accounting app (https://usebx.com) - would you consider providing early API access to our devs so that we can integrate with your service?
Very similar abstractions are being created over and over, if you are too close it is hard to see that the abstractions are largely the same, and the grand benefits being toted are actually quite small when comparing one to the other and the differences are just attitudes and a tiny bit of tooling that could be recreated for any of the abstractions.
> While some consumers may appreciate the novelty or added convenience, the conveniences come at the cost of entry-level jobs.

Added convenience? In the past, someone else would translate my spoken word into the inputs that the computer screen required. Now, I don't have to speak, but I do have to figure out how to use this interface. Any bets how long it takes me order my food? If Wawa is any indicator, at least 3 times as long.

(Insert secondary rant about the "convenience" of DIY grocery checkout. I cannot stand those things!)
I remember people saying that when they were raising the minimum wage in ontario. Really though those machines have been around for much longer.
Show HN: Automated secure tunneling for containers using Cloudflare Argo