skysight-inc/HackerNews huggingface dataset:
Hence why NPM exists in the first place.
The reason is that many people don't know how to write a proper isArray. Forgetting about security momentarily (and I promise we'll come back to it), rewriting code repeatedly is a path towards bugs and mistakes. Array.isArray didn't even exist until pretty recently, and was non-trivial to understand before then (x => x && Object.prototype.toString.apply(x) === "[object Array]", of course!). There's an entire separate discussion of why JavaScript doesn't build this stuff in to begin with, but now we're in historical land and not practical solution land.

Ultimately though, the goal needs to be to build tools where its hard to do something insecure regardless of how we otherwise feel about that programming practice. It can't be that the reason we shouldn't install is-array is because it can lead to catastrophic exploits -- that says something about the ecosystem not the validity of where we choose to draw the line of what merits a library.

Node is cursed in part by its success. In a lot of ways its like the early days of the web, it grew faster than we had time to figure stuff out in. That's OK if we learn quickly and adjust accordingly. We don't have to run node program's with access to everything -- but again, we don't have to run any kind of program with access to everything. Go to Homebrew's website (https://brew.sh). This is a developer tool and what they tell you to do is to blindingly copy a bash line that downloads a file from THE MASTER BRANCH on GitHub and runs it on your system:

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Get access to this guy's password and you can compromise tons of systems too. As much as I hate the Mac App Store as a distribution mechanism, there's something to the "sandbox first" programming mentality it incidentally forces its apps into. Maybe we should be thinking more along those lines too.
The problem is more complicated and more interesting than this. You can have many innocent comments, none objectionable in its own right, that add up to a situation no one wants or enjoys. The issue isn't that the individual comments are bad; in principle they could add fun to an otherwise good and substantial site. But in practice you can't have a stable equilibrium that way: if you allow it, you end up with a snowball effect in which such comments take over and it's all downhill from there. Therefore we can't allow it. It isn't about being killjoys, but about protecting the viability of the site.
No mention of security, apparently this just lets the whole internet to connect to your USB devices anonymously, through a flaky C-implemented daemon running as root. Outstanding.
There’s this https://en.m.wikipedia.org/wiki/DNA_damage_theory_of_aging

Damage happens all the time, and unrepaired damage accumulated over the lifetime, hence aging.

You have an interesting point with prevalence of senescent cells can interfere with natural immune response to cancer.
I can't second the recommendation of Bad Blood enough. I couldn't put it down. Every chapter I thought "surely I've reached the bottom of the rabbit hole now. It CANT get any crazier than this", but then it always did.

Aside from being a really enthralling and interesting story about one of SV's darling unicorns, it was also really eye opening into the absurdity of the amount of money that gets thrown around willy-nilly in SV, and how the bandwagon/FOMO effect just makes it worse. I won't say anything more because it's better to just read the book, but this is one of those stories that is almost endlessly fascinating.
I worked at a company that had a very similar tool for internal bug reports, but AFAIK they never released it publicly. It reduced greatly the friction in filing bugs, so probably increased the quantity as well as quality of bug reports.

So glad to see Outclip. Usability looks great.
US cheese supply hits record
Somehow people in the ESlint thread were defending the fact that NPM seems totally uninterested in this.

Yes, it doesn't solve all the problems and yes you still have to determine who to trust, but at least it makes it POSSIBLE to trust anything. Currently it's impossible to trust anything that you install—and packages can run arbitrary, unsandboxed code with access to the full filesystem when they are installed. That just seems insane to me.
Research on Cannabis Experiences – Participants Wanted
Hello,

Have you ever had a mind-bending experience when high on cannabis (marijuana, weed, pot), or a “bad trip” where you went through anxiety, distress, and felt disconnected from reality? We are researchers at the University of Wollongong (NSW, Australia; School of Psychology) investigating the psychological factors (such as personality, motives, and mood) involved in shaping the subjective experiences people have when they use cannabis. We sincerely apologise if this message comes across as spam and hope it will not deter you from taking a moment to consider our research.

We are seeking voluntary responses for our online study, which may be accessed along with more details at http://www.mws396.tk (For mobile users: http://www.mws396mobile.tk). It will take about 40-45 minutes to complete. Your input and sincere responses will be invaluable to our research. Among other things, your responses will contribute to a more objective understanding of cannabis’ effects beyond how it has thus far been portrayed in the media. Thank you very much for taking the time to consider and/or circulate our study.
As a Mac user it seems crazy that it's an app feature. On the Mac, any app using the system text field automatically gets features like that (spellcheck, dictionary, google, text-to-speech, etc), and as I understand it, Notepad is just a basic wrapper around the Windows text control (hence the 32K limit etc)
Don’t know why you are being downvoted. Linus’s tirades and diatribes are famous for how brutally personal they get. I still maintain that they are a waste of time and he would be a more effective leader if he limited his responses to “this is a bad idea” or “this isn’t done right” instead of writing pages long personal attacks on other members of the project.
As far as I cannot tell neither are really the driving factor, rather it’s a desire to believe. People who want to believe in X look for stories which confirm X. X can be UFO’s, or Muslim rape gangs, the blood libel, or FEMA detention camps... it doesn’t matter. What matters is that the story reinforces the desired beliefs, then many people won’t think too hard about it, they’ll spread it to like-minded people, and reinforce the belief. The thinking looks lazy, and the person may look partisan, but that isn’t the active ingredient. You see this pattern in everyone from free energy cranks, through anti-vaxxers and hyper-partisan ideologues, to people who simultaneously believe that Princess Diana was murdered, and that she faked her own death and is still alive. Likewise people who believed that Osama Bin Laden was dead before the SEAL raid that killed him, were most likely to believe that he wasn’t killed and is still alive!

https://www.livescience.com/18171-contradicting-conspiracy-t...

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5724570/

https://www.researchgate.net/publication/235449075_Dead_and_...

It’s a breakdown in how humans think and believe, it’s just that. It doesn’t dominate everyone’s thinking, but it dominates enough people to skew elections and online conversations.
Most of the time, skimming through, picking out the parts that are different from others in the field.

For physics: "Okay, this paper is from so and so, yup, same facility and equipment as the previous one. Theory section, same basic overview, skip to the end for what makes this experiment worthwhile? Anything interesting in their analysis, and how good are their statistics? Did they show the usual set of diagnostics plots for the type of analysis they did, and if not, what are they trying to downplay?"
Anker Wireless Charger Charging Pad for iPhone 8 / 8 Plus, iPhone X, Galaxy Note 5, S7/S7 Edge/S6/S6 Edge/S6 Edge Plus, Nexus 4/5/6/7, LG G3 and Other Devices

$9.99 on Amazon. So I spent $30.
The objections raised there are all legitimate. Generally usable public key infrastructure is, sadly, vaporware.

Yegge's security vs accessibility rant/monograph should be required reading. The NPM team's choice to favor accessibility is a reasonable choice. The trade-offs are significant.
So each thread might have to do up to m times the work, where m is the number of states? That sounds like it might be a pretty bad hit on the number of processors you need just to break even.
Here's an example.

You stumble on a bunch of psychology papers in which psychologists noticed that whenever 6+ kids get together, there are either three mutual friends, or three mutual non-friends.

The psychologists think this has something to do with child psychology and have written 10,000 pages on it.

You immediately recognize it has nothing to do with psychology and is just basic Ramsey Theory [1]. Should you have to review thousands of pages before being allowed to chip in?

[1] https://en.wikipedia.org/wiki/Ramsey%27s_theorem#Example:_R(...

A less hypothetical example: You're Bertrand Russel and you discover Russel's paradox, a one-liner which negates thousands of pages of Frege's not-yet-published logic textbook. Do you have to wait for him to publish it, and then you read it, before raising your voice?
https://en.wikipedia.org/wiki/List_of_software_package_manag...

There are many, most are open source, several have or could be ported to windows. What does npm offer that couldn't have been handled with an apt or rpm repository?

The obsessions of reinventing everything in every language is a giant waste of time.
Oscar the A.I. trash can sorts your garbage and recyclables
I assume the parent is being facetious (NPM doesn't support that somewhat useful feature) and node people are a bit butthurt about that currently.
Not op, but I'm a big fan of both authors. I enjoy Vinge more, but I wouldn't say his science is any more plausible than Liu Cixin's (with the exception of "A Deepness in the Sky"). I actually enjoyed "The Dark Forest" and "Death's End" more than the Three Body Problem. All three books have some fun, novel ideas. While the plot arc is not very traditional, it is complex and interesting -- lots of characters with vastly different motivations interacting in interesting ways. The main plot driver over all three books (that the universe is a dark forest) is highly plausible.
File Upload in Node.js Server
I know it feels that way, quite convincingly, but I think you're just empirically wrong about this. I post such replies with boring consistency, and you can't conclude anything from them about what I disagree with. That feeling isn't reliable. It's called the Hostile Media Effect and both sides of every controversy experience it.

https://en.wikipedia.org/wiki/Hostile_media_effect

https://hn.algolia.com/?query=%22hostile%20media%20effect%22...
Interesting take. In my job, the idea that cross project connections would be rare or that it’s good for all resources in a project to have access to all others seem a little crazy. I agree it’s a far safer default that AWS’s, but it’s not _good_.

The biggest wall for me in setting up GCP is that the resources and accounts are all so tightly tied to personal Google identities. This is unworkable for me, but I don’t see any clear way around it. We’ve set up our billing account on a shared account but it becomes hard to work with around personal Google accounts (even moreso when they are corporate Google Apps accounts). The AWS IAM identity model makes much more sense to me, but perhaps I just need a new paradigm for thinking about it. Are there any good resources for relearning how to think about resource ownership in the GCP model for AWS heads?
I think an important point is that trustworthiness and trust carry an element of relativity as compared to honesty. Honesty is pretty binary, but different groups can have wildly varying levels of trust.

Microsoft probably has a very high level of trust with a senior corporate IT buyer (CIO) but low levels of trust with a hardcore GNU/Linux believer.
I'm using RAIDZ2 with 8 drives. It's even more fault tolerant than traditional RAID1 (when you lose <= 2 drives at once) and still only eats 2/n x capacity (n=8) for parity.
So if I know the source but you don't, its local to me but non-local to you?
Number Gossip
This was well written. NPM is basically run like Github. I had always thought it was some non-profit org, but that's not the case.

It is possible NPM could take the Github route with ssh tokens and only limit NPM publishes to certain authorized computers; a minor step, but you'd have to compromise the computer as well. That could probably be an option in the NPM settings as an extra step.
It’s not just an issue with fake news. People believe things, both true and false without applying critical thinking.

I recently saw someone objecting to climate change being characterized as a “belief” [1] as it’s a scientific fact. Unfortunately, even with this being the case a large number of people believe in climate change because of their own inherent biases. It’s absolutely possible to hold a belief that is true for the wrong reasons. And in the long term, unless the root causes are addressed equally harmful.

[1] the context was 60% or Americans believing in climate change.
Yes - you just shipped the whole image. At the time I was building desktop apps, but that made install super easy - you just dropped it onto the user's desktop. A guy a few cubes over was building server apps and that was equally easy - a self-contained deal with the vm, all the dependencies, etc that just needed to be dropped into /opt or wherever and was ready to run.
What’s the monetize model for these guys? I’d normally think it was mining the data but with the name privacy I’m hoping not.

Do they somehow get part of the merchant fee?
I usually close blocks with "#end <whatever>". It doesn't automatically format, but it at least makes it clear to me should the formatting get messed up. I keep thinking about changing the emacs mode to respect this, but it never causes enough of an issue to make me do it.
Americanah by Chimamanda Ngozi Adichie is very good. It's fiction, but semi-autobiographical. It's as much about living as a Nigerian immigrant in America as it is about Nigeria, but it's really well-written and gives a ton of insight into Nigerian culture (from a very specific perspective some might find grating.)
>The fares are not finalized but will be less than half the typical price of taxi/ride-share services, though higher than the Blue Line.

I hope so but man i'm skeptical... but awesome if they can do that.
Dealing with cold energy(coolth) storage whether it's in ice or chilled water is tricky mostly because of the capital cost involved with adding a storage system that can only do one thing, namely store cold. They're great for specific regions where you'll be using them on a daily basis. Chilling water outside of the peak times for use during peak cooling has been studied a lot in litterature there's a recent article here about storing excess solar energy in cooling energy:https://www.sciencedirect.com/science/article/pii/S221067071... , the main problem with the system is one of practicality. In order to effectively use the cold storage you need to use liquid cooling like the ones used in commercial buildings, that or switch to a water source chiller with a cooling tower. You can build it, but whether the total cost of that system is less than buying a bigger AC unit and paying more for power depends entirely on local conditions(seasonality,diurnal temperature changes, whether you pay for demand as well as power and whether you're on time of day metering).

------------
Using it for winter and summer does increase the utilization and would be best practice but places with winter/summer seasonality have a golden zone where you don't need active heating or cooling. If you're below 24c and above 18c you don't need much energy to maintain thermal comfort, provided you're not in a high humidity environment. During the winter it's better to use solar collectors with a thermal syphon for heat collection instead of stocking up heat since peak thermal demand occurs at night.

------------
They're known as earthpipes or earth hear exchangers and they come with their own problems, namely proximity to surface and thermal load imbalance over seasons. The earth is a really shitty thermal reservoir because it bleeds heat out the side and the top, the really big thing that it has going for it is that it's free. When you use the system in an environment thats either mostly hot or mostly cold you change the ground temperature in the long run, either increasing it or decreasing it over time. This in turn affects the ability of the system to condition air, there's also the problem that it can only bring the air temperature up to that of the ground during winter so you still need a heating system to supplement it; works great for cooling though. Basically the system gives you thermal energy at no operational cost(other than the fan) but you have to either accept whatever temperature it gives you or have a way to further condition it. Earthships generally use the sun in the winter to bring the temperature up during the day and have a thermal mass inside the house that maintains the temperature at night.
This is about a sought-after white mushroom, prized in Japan for infusing dishes with nuances flavors, but it hijacks a term that's been used since antiquity to refer to cotton fiber... Interesting none the less.
Not yet hit by a friendly update reboot in the middle of an important compilation are we?
As someone not particularly familiar with F#, could someone go into what the author means by "first-class types"? Do they mean that data types themselves can be treated as values (first-class citizens)?
As with IOT, apparently the "S" in NPM stands for security.
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?
If I say, 'this action is reminiscent of a ruthlessly capitalistic ethos, trying to make a profit wherever one is to be made' that doesn't mean you're endorsing for instance the holocaust even though seizing the possessions of the victims there probably showed a net profit.

There's a reasonable argument to be made for restricting the nations to some minimum population. The typical figure is 250k-300k which is also likely conservatively high. The reason your article wants to restrict the data to populations of 10 million is precisely to cherry pick. For instance this [1] is the murder rate for Jamaica, a country of some 2.8 million, over the past 5 years. The numbers themselves have some variance, but the rate's magnitude is relatively unchanged because of how high that scale is. It ranges from something like 600% to 900% higher than the US over those numbers. It's the same thing domestically within the US. Places like Detroit have obscenely high and consistent murder rates. The population? 672k. Guess we can just discount it as variance?

You can find the sort of same head-in-the-sand attitude when discussing matters with people on the opposite end of the spectrum. For instance, Scandinavia has done some great things. But wait... What about the population? Sweden? 9.9 million. Denmark? 5.7 million. Norway? 5.2 million. Finland? 5.5 million. Iceland? 0.3 million. Well I guess we can completely discount Scandinavia for any and all statistics. Since none of the nations reach that magic 10 million mark, they must be completely irrelevant. Right?

[1] - https://pbs.twimg.com/media/C2_nhWaXUAgKKfq.jpg
Your analogy is confusing me. On GCP, none of the tools have all the features you expect?
You're right on the facts, but that's not the way a forum like this works. Like it or not (and probably no one likes it), the way it works is that a minor irrelevant provocation in the title completely determines the discussion. The solution is to take out the minor provocation, even if in principle we shouldn't need to.
And this is a critical point. Gpg comes up constantly. It's a waste of everyone's time alive for this use case. If a developer with publish access is compromised, it doesn't help. If the infrastructure is compromised only hash history is required. Hashes are faster to compute in such an emergency, and more available on various mirroring/hosting solutions meaning more likely to have verification sets laying around.

A ledger of hashes of published packages that is run on separate infrastructure and consumed by the client would do just as well as signing for detection of both threats without a lot of complicated issues around third party key material handling, crypto library bugs, and the need for revocation processes.

Note: this is based on experience validating all gems after the yaml scare years ago.
It curls the install script, which is passed to ruby as a string which is run.
_Anathem_ by Neil Stevenson. Science Fiction. Takes place in a universe very much like ours. The most noticeable difference is the culture: intellectuals live inside monastery-like sanctuaries, while religious people live outside. The story is written from the point of view of one of the intellectuals. Very rich world building. The book also explores (high-level, slightly fictitious in some parts) some fascinating areas of quantum mechanics, topology, communication, diplomacy, and Zen.
Cancer cells engineered with CRISPR slay their own kin
What a great story. That article was inspiring and easy to understand. It makes me proud to be a human, really!
> But honestly, the amount of work we'd all need to put in to truly prevent this from happening again... it's just never going to happen.

To me this is the irresponsibility of the NPM maintainers. Require some kind of cryptographic proof you intended to change the code. Signing or TFA or we wont host your w̶o̶r̶m̶ code ...
How many times has this happened and not been caught?
Ah, duh, you're right. I forgot $() is bash syntax and not the Ruby syntax for running an external command. Thanks, and yikes.
It's a fair question, but the answer is no, because of the tragedy of the commons. That is, you may be right at the individual level, but it's unfortunately common for the sum total of individual effects to become something completely contrary to what any of the individuals would want. We have to manage the site at that sum-total level. This means telling people "don't do the things that produce lousy systemic effects", even though any one of those things might be fine when considered independently.
Google Compute Engine VM Live Migration
The data structure is called a piece table, if that ids your search.
considering that a thunderbolt hub alone is already very expensive and other enclosures are in the ~500 USD range, this is not too bad for a nice looking solution that is well engineered. Imo it lacks performance for the price though.
Watch the Idea, the First Animated Film to Grapple with Big, Philosophical Ideas
Because the install script is in ruby?
Four years ago I bought a desktop gaming PC (I'm normally a Mac user) with the idea that I could upgrade it over the years to keep it current but avoid replacing the whole thing.

Turns out in practice technology changes enough over that time to only leave the case, and perhaps the PSU. The motherboard, CPU, RAM and graphics card are all obsolete now. The SSD can be reused but newer technology is much faster.

I don't know what gets saved by upgrading parts rather than the machine. The same amount of electronics are disposed of (or sold on the second hand market)
I was in your situation a couple years ago and I doubled my salary. Identify an essential but unmet need in your organization. Satisfy it. This makes you essential, but also demonstrates you can manage yourself, execute and provide strategic value. Renegotiate compensation. Rinse and repeat.