skysight-inc/HackerNews huggingface dataset:
How many years would you have to live in Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuaki to consider yourself a true Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakian? I've known Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakians who don't consider anyone who's lived in Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuaki less than ten years a Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakian, but I think that's ridiculous. Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuaki is a cool place but it doesn't take that long to become a Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakian.
True story: The other day I was in the living room and I hear this crunch crunch crunch sound from the kitchen. I call over to my SO "what are you eating?" Her response was "I'm not eating, I'm typing." I use a 2013 MBP and she uses a 2017 MB.
I used to post rants about how I wanted a laptop that only focused about battery life, crispy graphics and Linux friendliness. Now I find myself wishing I could buy a laptop without CPU vulnerabilities. The hardware market is definitely at it's lowest point ever right now.
This is really awesome. I just killed about an hour playing it part way through.

I was saddened by the fact that I lost progress when I left the page. It would be nice if progress could be save via cookies or something.

One other thing that would be nice is the ability to offer hints. These could even be just an external link to relevant material on wikipedia or equivalent.
You don’t shop Azure.

Microsoft is repeating what they did with NT — owning identity. They reel you in with Office 365 and when you need controls convert you to Azure AD. Once that happens, Azure is a no-brainer.

Also, every company with an EA has a contract vehicle for Azure... just add water!
DFINITY Is the Cloud 3.0 That Marries Crypto Valley with Silicon Valley
A kernel bug, that systemd exposes by attempting to utilize more of the kernel's newer features.
What happens when you apply this author’s standard to this work?
The next time someone asks me why I'm choosing a proprietary solution, rather than one of the many fine open-source options available, I'm just going to point them to this comment.
A Macbook for Machine Learning: Tweaks to Make Ubuntu Work on Razer Blade
Abdominal Asbestos Mesothelioma
Research: The Average Age of a Successful Startup Founder Is 45
Jeff Bezos plans to charge at least $200,000 for space rides
We're lucky this issue was detected because of an error. I would bet this has happened or is happing now without anyone knowing. Javascript is particularly difficult to find malicious code as code can be executed in many forms. As long as eval exists and npm allows for pre/post-install functions and require executes code there's not much we can do except be ignorant to what's actually running every time we use node.
our company integrates with some other companies and we do this using simple TCP connections to a single host+port. most of the companies for some reason use IPSEC and it is always a massive frustration to get stuff working.

if you have a failure before phase 1 is negotiated you generally have no idea what is wrong. generally it is either because a) the other side has not configured their firewall or b) there is some kind of mismatch in the phase 1 parameters. however, it is generally impossible to tell which one it is because either IPSEC protocol doesn't support status messages or it is not configured because of 'security' to generate status messages. also, in the case where there is a mismatch apparently it is very difficult for the operators at the other end to extract the information from the logs about what is wrong :/

you get a similar problem with phase 2. if there is something wrong the setup will just fail and you will only know there is a problem with phase 2 but not the reason why.

compare this with TLS and I can generally identify what the problem with a failed handshake is from either the status messages or by looking at the client/server hello.

IPSEC is also more a pain to deploy than TLS. for TLS protected connections we just whitelist 2 IPs and run our integration on two boxes for high availability. really simple. for IPSEC now we either have two buy two pieces of expensive CISCO hardware to give us a HA VPN connection or we need to duct-tape up two strongswan boxes with automated failover to give us HA. not fun.

i understand why people might want to use IPSEC if they want to encrypt all the traffic between two networks transparently. but for encrypting individual point-to-point connections it is massively overkill. i suspect people end up using IPSEC for point-to-point encryption because they see it as difficult to add TLS support to existing software but don't know about options like stunnel (https://www.stunnel.org/).
> Then I support legislation to regulate you.

As opposed to simply not using those services? What gives you the right to determine what comments people are allowed to have on their posts?
XPS is great. Runs Linux very well.
I don't think it aligns with the philosophy of the language either, to essential chunk ideas into large discrete blocks of particular categorical intents. It seems like the intent is to distribute programming concepts on a finer granularity than most languages tend to retain flexibility for, as structure builds.
We diverged from apes around 7 million years ago, so assuming a way higher than reasonable average generation time of 50 years gives you 140k generations. If we assume a more reasonable turn around (based on 15 being a marriage worthy age in Romeo and Juliet) we easily get around 300k generations. That’s actually quite a lot for evolution to play with.
What's been interesting to watch from the Cloud Foundry POV is the circular migration of the boundary between development and operations.

CF built container technology before Docker or Kubernetes -- two generations of it -- because it was seen as the right primitive by people with experience of Borg. But containers were not touted as ends in themselves.

So the contract boundary given was: sourcecode. Buildpacks.

Docker comes along, then Kubernetes, and the container goes from being a hidden detail to a central concept around which a lot of other stuff orbits. And containers are a step forward on a lot of axes. Developers begin to want to use containers as their shipping unit.

So the contract boundary became: images.

Later ops realises that while opaque running containers are awesome for reducing their management complexity, it doesn't reduce all categories of risk. After all: what's in the damn containers? And so various tools have emerged from the container-oriented ecosystem to take sourcecode and turn it into a container image, so that developers and operators have a consistent handoff point.

So the contract boundary becomes: sourcecode.

It sounds like a nice story, and it might seem like we'll go in circles hereafter. But we're not doomed to do poetic laps: what's happened in the middle has been the rise of CI/CD tools, sitting between the container boundary and the sourecode boundary. Good fences make good neighbours and it turns out that fences made of helpful robots make even better neighbours.

As a Pivot with a long association with Cloud Foundry, I have enjoyed in the past few months getting to compare notes with Red Hatters and others in the k8s community.
I mention the same trick, without the theoretical underpinnings, in https://branchfree.org/2018/05/25/say-hello-to-my-little-fri... in my notes, although the parallelism here serves no practical purpose on modern hardware at this time.

I do this stuff with permutes and of course permutes are associative.

The limitation is that you can do this only on DFAs that are the size of your biggest usable permute (currently 16, but will be 64 once AVX512VBMI comes out - looking dicey now with the logjam on 10nm Cannonlake :-( ).

The idea also appears in Guy Blelloch's parallel prefix paper https://www.cs.cmu.edu/~guyb/papers/Ble93.pdf. To my knowledge actual practical regex matching using this technique is thin on the ground. For a start, detecting not just the fact that something accepts but that it accepts at a particular state at a particular offset (not part of the formal regular expression definition, but very useful) is less straightforward in these parallel formulations.
Clearly more could have been done. It's suspicious that they'd only grab npm tokens. Perhaps the responsible party just wanted to prove a point?
Can someone instead, make a utility that assuming that my project's packages only get upgraded, not downgraded, could have been compromised or included compromised code? We could then check on each of our projects. If you do downgrade packages then you'd have to run it on prior commits as well.
Step 1: Move to Seattle and find a job there. Purchasing power there is 38% higher than NYC. We'll say that your salary stays at 150k, but you'll realistically feel like you have 38% more. (Source: https://www.numbeo.com/cost-of-living/compare_cities.jsp?cou...)

Step 2: Buy a house in Tacoma. Don't buy in Seattle; the market there is in a bubble. Tacoma is an up-and-coming suburb. Cost will be ~300k for a livable house, or 400k if you want a nicer one. (Example: https://www.zillow.com/homes/for_sale/Tacoma-WA/49299981_zpi...).

You'll have an hour commute but that's not too bad if you're used to east coast commutes and traffic. If you buy a house close to one of the train stations, you can take the commuter train to downtown Seattle so you won't have to drive.

Step 3: Save as much as you can for kids' college/retirement/whatever.

Sounds pretty livable to me.
IKEA hacks: A microwave interface for the Duktig kids kitchen
It's a helicopter, not an helicopter.
Not sure I agree with the lenovo equals RIM comparison. By the way, lenovos had an oled bar on top of their keyboards but removed theirs when people said they didn't like it.
> I can understand you are providing an example, and perhaps you feel the documentation has many such examples. From personal experience reading extensive documentation, I think you are being slightly unfair in this instance.

I kind of agree with the other poster. Getting up and running with .NET on flexible instances has been challenging to say the least. The datastore documentation does not give a good overview or introduction to how interact with this system.
By side effects of the assignment, what specific side effects are you referring to exactly? Or just the fact that assignment is happening inside of an expression?

I saw an edge case in scope around lambdas in the PEP, but not sure if that's what you're getting at.
Surely if they need to ask, they should be able to do it themselves?
If 2fa is enforced, having your password doesn't get you anything. Publishing an npm package isn't having a Twitter account, it's one of those things where enforcing 2fa shouldn't even be a usability question.
There's probably an app for that.
OMG, you need to run away from that place!

Until I read that, the worst I’d ever heard was a friend who worked next to a slamming fire door. He had to wear hearing protection/ear muffs. Get this: he was the PhD physisist that did all the hard math coding for the company.

He has a private office where he works now thank goodness.
Ah the road.. the best place to have the McGurgles :)
>> I wish we could have a peek inside the patient as if we had opened it up but this is not yet that.

Surgery rarely looks like that. We are messy creatures. Our parts all overlap and fold among each other. It never looks as open as in the scan, short of dissecting the patient well beyond what is ever needed for any actual procedure.

The example image certainly looks cool, but it is too 2d. It doesn't have the 3d structure visible in traditional x-rays. An expert can look at an old photographic x-ray and see the layers of tissue and bone atop each other. It is a rather good 2d visualization of a complex 3d shape. Giving tissues more solid color take away from the translucence and, imho as a non-doctor, removes much of the information.
As others have said, key at this point is going to be to prioritize in relation to business needs. As hard as that all will be, the process will only get more difficult the longer you wait. I'd also suggest one thing you prioritize personally for yourself whatever happens is eight hours of sleep every night. :-)

As other have also said, you're also going to have to tailor the way you present the message about the facts (i.e. the "alarm") to your current organization's culture and your specific situation in it. You'll need to keep in mind your own talents/resources and current limitations in developing a message or plan (see also "Dunning–Kruger effect" for risks on that). Talents/resources and limitations include your own ability to present a message and what help you can rely on from the rest of the organization to develop a message and present it based on what your coworkers, manager, and management chain value.

If you eventually want to reflect on the larger issues that may have gotten you to this unfortunate situation and what your company can do better in the mid-term and long-term, here is a reading list I put together that includes multiple books on software engineering management as well as broader surrounding issues -- including a great book by Matthew Walker on the importance of adequate good sleep for everyone in an organization:
https://github.com/pdfernhout/High-Performance-Organizations...

One item from there:

"Why Deadlines Need to Drop Dead"
by Eric Elliott
https://medium.com/javascript-scene/why-deadlines-need-to-dr...

"Deadlines are incredibly destructive to team productivity and morale. The #1 challenge software developers face is unrealistic expectations. Can we motivate & push without arbitrary deadlines? You can lead teams without deadlines. You can still deliver code quickly. You can still ship in time for Christmas. But you’ll be dealing with a different management framework. One that puts the deadline pressure on product managers rather than developers. ... The point here is that instead of trying to build out the CEO’s ideal vision of the product you’re bringing to market, you build out a beautiful stepping stone on the way towards that vision. In place of arbitrary deadlines, you deliver consistent, steady progress."

Eric Elliott advocates for the Marketing department creating each hype cycle for what is already finished and tested.
No, it is actionable - create an alternative.
I'm mid-transition. Nintendo Switch is USB-C, which joins the Macbook in new connector land.

USB-C to X cables solve most of the problems, but I have a 3-port USB-C to USB-A dongle for legacy stuff ...
I couldn't use it without a lot of typos, but ymmv. It looks nice though.
If you're a science fiction fan you need to watch The Expanse on SciFi/Amazon.
Robots do have a lot of benefits in space. Lots of them weren't obvious in 1950-s, but robots came a long, long way since then.

So apparently did manned spaceflight. Tito, Shuttleworth, Olsen, Ansari, Simonyi, Garriot, Laliberte flights demonstrate it's much more within reach now than before. Same could be said regarding private makers of rockets, spacecrafts and even space stations. Not only we see the push to increase the new industry, with new services to humanity and new taxes to governments - we're actually learning to do things in the environment (the learning itself happens there) which is quite different from where we evolved in.

And when we talk about actually living in space - including doing really complex things, like unexpected actions across the specter of what might be needed when you're actually trying to be successful for long periods of time - many robotics specialists, last time I've checked, admit that human flights are actually less costly than robotic ones. In other words, if you want to have a big enough exploration program for space, you ought to include people into that.

Fortunately flying to space becomes easier as we learn more.
There are other aliasing rules that have big performance impacts on certain architectures. The Xbox 360 and PS3 Power cores for example had a severe load-hit-store performance penalty that tended to be triggered by code that moved data between floating point and integer registers via memory. Strict aliasing rules that allow the compiler to assume float and int pointers don't alias could make a huge performance difference but those rules are also the source of much troublesome undefined behavior for code that does intentional type punning.

The ISA in this case requires going via memory to move data between fp and integer registers and certain implementations of that ISA had major performance impacts associated with that. In this case UB rules really did allow for valuable optimizations but really did cause trouble elsewhere.
Most open-source licenses explicitly say that the software is provided as-is, and there is no warranty, express or implied, nor any obligation to continue to provide support or for it even to work.

https://www.apache.org/licenses/LICENSE-2.0

https://opensource.org/licenses/MIT

https://opensource.org/licenses/BSD-3-Clause

https://www.gnu.org/licenses/gpl-3.0.en.html

The user is indeed choosing to use it over other alternatives; they are choosing to use it, and should make that choice on the basis of their own evaluation of the functionality and stability of the library.
The node development environment is bananas.

On the web, executing third-party controlled JS code is considered a profound (XSS) vulnerability, despite browsers being equipped with the strongest sandboxing. Tiny cracks are leveraged into click fraud, cryptocurrency mining, and other nefarious activities.

Meanwhile website build processes indiscriminately pull in random modules and their transitive dependencies. Modules may inadvertently stumble into a core role, like left-pad.

Popular Chrome web extensions get large monetary offers, and npm modules are surely next in line (if it's not already happening).
Statistical analysis of Bitcoin price manipulation by Tether issuance in 2017
Go modules have landed
I'd love to see the initial diagram grown step by step. You don't start out this way and it can be extremely informative to see which bits get added when.
I'm not sure I understand what you mean, but does this help: https://cloud.google.com/storage/docs/hosting-static-website
Denizens... please. I was clearly facetious.

Too deadpan.
By technical incerto you mean Silent Risk right?
If it’s so great, why isn’t it used in industry? Cranking out functionality is what everyone wants. As someone who has never seen or used it, I always hear about how all these languages are inspired by smalltalk but just don’t get it right or whatever. Why doesn’t somebody do a straight up port of it if it’s that great?
gpm FTFW!
Sure, you'll make money 99.9% of the time but the time you don't, you'll be losing your money and then some.
"...because the worst that will happen is..."

... your credentials, development environment, and anything you can access are compromised.
Allow me to disagree. Chris Okasaki's thesis, "Purely Functional Data Structures" is That Good for the field of functional programming. There are other exemplary papers, like Godel's incompleteness theorem, Cantor's diagonal argument, or Einstein's statement of special relativity. Or Satoshi's paper on Bitcoin.

These papers are not exhaustive summaries of a field. But a reader comes away understanding the type of problems a field is devoted to solving and many of the existing ideas. And I believe that each is a paragon of their field.
Has it gotten any better since? I feel like mine has on a given day but it actually feels worse than ever before when I wear earplugs.
Probably the most mind bending idea I've had the pleasure of being exposed to via wayward link clicking in quite some time. I didn't burn through the entire thing but I went pretty far and the syntax primitives and the inlining by default type guarantees seem like a natural extension of language design in the history of programming languages.

My apologies for getting a bit philosophical here at the end, but this kind of treatment is among my favorite things to encounter having had the privilege of being born at the cusp of the information age. During the first 50 years of the internet we get to casually encounter foundational new ways of expressing software with increasingly more guarantees and expressability from the languages themselves and reap the benefits of the plumbing and infrastructure that inevitably arises from such. Rust's compile time memory tracking borrow system comes to mind as another such set of compiler based guarantees that we have now that we just didn't have when I was a kid.

tldr: Exciting times to be alive and clicking links on the internet.
It does even better, it has a table of contents right at the top, so you can skip directly to whatever you want. "Intro" and "Design Philosophy" sound like manifestos, so pass over those and click on "Tutorials."
From TFA:

npm has revoked all access tokens issued before 2018-07-12 12:30 UTC.

If credentials were configuration, we'd be screwed now, because the data we have stored is no longer valid. Fortunately, all we have to do is this:

$ npm adduser

Now the data we have stored is correct again! This is textbook ephemeral data. We can cache it, and that might save some time, but it really doesn't matter. We could flush cache every half hour and it wouldn't hurt a thing.

Another way to see that credentials aren't configuration is what I suggested above: we would never want to back up or publish them, so they are different from and belong in a different place than configuration that we definitely want to back up and often want to publish.

[EDIT:] If one had only considered this from a "12-factor" perspective, in which creds and config are both called config and are both stored in envvars, I could understand the confusion. Note however that the config we're talking about for npm is e.g. "init-author-email". That doesn't change from environment to environment, so it's more like what 12-factor would call code...
> I order items without cheese,

The kiosk app makes you go through a screen to customize items. The first time I wanted to order a hamburger I was stuck because there were only cheeseburgers. Later a screen offered the option of removing the cheese.
Jesus Christ, why was my comment flagged?
None of the criticisms of package signing here apply in this case. Package signing does cover this exact issue, which we should describe to be specific:

(1) someone has published a package.
(2) that package has become well known and used enough that the community as a whole trusts that the entity publishing that package is not there for malicious purposes
(3) the maintainer of that package has their account compromised, either by credential leak or by a vulnerability in the package management system itself (in this case, the former and not the latter)

If the package were signed, then the attacker could not have published this fake package that lead to issues today. Does this solve the root chain of trust issue for whose packages you should trust? No, but nothing other than thoroughly reviewing every line can do that. Does it prevent you from having a random unknown person masquerade as the maintainer and publish a malicious package? Yes.

There are real additional trust issues to solve, but let's not let those detract from the fact that package signing would have prevented the exact issue which we saw today. Defense in depth, always.
It’s very good. This guy was about 150 years ahead of the AI job loss/ singularity crowd. In Capital he doesn’t even really get into the politics that much, it’s more an analysis of automated manufacturing.