skysight-inc/HackerNews huggingface dataset:
I don’t have any horse in the PEP 572 race, but it is bang obvious that the debate has absolutely nothing to do with mere syntax preferences (a minor part at best). Rather it is about whether permitting expressions to have assignment as a side-effect is ever a good idea or a useful feature. I think people make very solid arguments that in Python, at least, it really is not ever a useful idea, and the downside about reasoning about side-effect assignment is a serious consideration, meanwhile the examples that supposedly motivate the PEP, like re.match or iter.chunk, are borderline comically bad examples because they make it seem like “one-liner-ness” is the priority for such a drastic, side-effect-based language feature.

I’m sure there are good arguments in favor of assignment expressions, but I think it’s totally wrong to characterize the people who are disagreeing as if they are bikeshedding about mere syntax.

The core debate over PEP 572 is not at all bikeshedding, and the people who vehemently disagree that it is ever possibly useful in Python actually have very substantive, serious points worth extended debate.

I wish it did not devolve into vitriol, sure. But it seems really irritating that the arguments against this PEP are so wildly mischaracterized as if it’s just something trivial. It’s really not trivial. This will make a lot of Python code much, much harder to read and reason about because of side-effectful assignment statements, and it’s really fair to demand a great deal of evidence that the feature provides equal compensating benefits that cannot be achieved with existing straightforward approaches.
"Security by punishment" is a terrible paradigm that's not Web Scale. The internet is not the physical world — the attackers are probably accessing your stuff via Tor from a public wifi in a country far away.

If someone couldn't do basic things to secure their account, they should take the blame.
I'm also really sad to see him go. I sincerely hope Guido enjoys his well earned time off. I'm extremely grateful for the amazing community he has fostered around his excellent language.

Though as an avid Python user (~10 years), this does fill me with concern. Not only for Guido's health, but for the health of the language. Guido leaves awfully big shoes to fill, and I'm hoping the community is up for the challenge.
I have filed a bug report. But yeah, it’s crazy that one part of the machine makes all the rest of it slow down! There was a time before I figured out it was the Touch Bar when I thought it was _moving fast_ that was making it lag (because it didn’t happen when the train stopped at stations). I was paranoid that it was trying to keep tabs on my location... so it could be worse, I guess.
I think it's worse here because every damn node project installs 100s if not 1000s of npm packages.
FWIW: I used Smalltalk a bit in college and then for about a year professionally, about four years into a now twenty year career. I've shipped software in about five languages over my career and have never again come anywhere close to as productive as I was during that time using Smalltalk. Ironically, the work environment at that time was perhaps the worst of my career but Smalltalk just makes it so darn easy to crank out functionality and test it at the same time. So, sure it is old but there's a lot we could still learn from it.
I'm not with GCP but I'm fairly closely connected to its technical staff and user community and a heavy consumer and have been so for about 4 years.

It gives me a somewhat unique perspective where I'm happy to give them lip when they need it and they have at times and they also ask for my input fairly frequently. In my opinion they are all in on GCP and it's definitely going nowhere but up. They've been on massive hiring sprees and it's to the point that when I visited them at the Googleplex a few months ago a bunch of their campus buildings were now labeled as Google Cloud buildings.

Obviously logos can be removed and maybe it will say Android/Allo/whatever in 3 years but the team is incredible and they seem laser focused on growing the platform. You can go through their blog https://cloudplatform.googleblog.com/ and the improvements they're making and the pace at which they're making them is pretty great.

I've used them for ~4 years so I've definitely had frustrations, especially prior to them reorganizing their Support/Account Management structure about 6-12 mo ago (I do k8s so I interact with this side of things as infrequently as possible).

This is a huge money maker for them and I think they're doing a great job albeit they still need to focus on their soft skills (support, billing pains, etc).

I have migrated a few companies from AWS to GCP and they've all been happy. If the day ever comes to leave GCP I have no problem making that call; I'm not handcuffed to them. Hopefully they just continue to improve.
In your analogy you're citing a business. Then if you open source something you wrote, are you claiming you are a business? No matter how un/business-like the open source claim may be: has any money changed ownership between the parties in the course of the person writing and maintaining software vs the person using that software?

If no business transaction has been formalized then why should either party be liable? Indeed, if a person is not permitted to simply say "this is the software I am using" without also becoming liable for problems caused when other people use or look at that software? I don't think it is right to allow a person to be liable just for the speech of their software.

Fortunately, a lot of open source software is known to be open source because of a license file. Many open source licenses declare no liability or warranty of any kind. In that case, would not any liability claimed would be forfeit? Otherwise they would have been using the software in breach of its declared intended purpose at the point of time being talked about.
In the scenario you describe there sounds like no consensus for A or B.

Maybe, after they explain how great A is the core committers can bring the language users around on the idea of doing A. Maybe after spending more time considering why B is beloved of language users the core committers come around to B.

Perhaps most likely if the two conflict is that C is developed as both sides look for the best of both, what an excellent outcome.

And if not, then do neither A nor B

We regret our bad ideas at leisure. No need to bake those bad ideas into a programming language just because of a vague feeling that "we must do something" (and as the saying goes "this is something, so we must do this").
I don't think that's their logic at all.

The logic is that, compared to the salaries of software engineers and revenues of many tech companies, desks and keyboards are extremely cheap.

The cost of a ~$100k engineer spending 10m per day looking for a desk, with 8h day and 200k total employee cost to employer, is ~4k/yr. Paired with the cost the company pays in developer annoyance potentially causing higher turnover or lower productivity , buying more desks and office space is likely the cheaper option. One helicopter per student is obviously not so...
It's something I would get excited about - not something I absolutely need. In the past decades so much effort has gone into optimizing rendering speeds for computer games or page rendering on browsers while text editors appear to have pretty much stayed the same (rendering wise).
Without committing to an entire book, perhaps more detail on load-balancing and proxies?

https://blog.envoyproxy.io/introduction-to-modern-network-lo...
Thank for the link!
I've updated the title but it doesn't seem to be getting picked up by /ask. I guess it has to say "Ask HN:" from the outset
> You are practically bound to lose money to institutional investors when playing with options.

Source? Explanation?
int success = NULL;

if(success = malloc(...)) {
}
if(success = malloc(...)) {
}
if(success = malloc(...)) {
}
>it's hard to cool servers there because the air is really dry

Not sure how this could be the case. Dry air has higher thermal conductivity than moist air.
I'm even more cynical than your are here.

I think the likelihood of this being the first time a credential-stuffing attack has worked against an npm account is vanishingly small.

While the timeline given makes the response time sound good - it still took a user notification 90 minutes after the first signs they've found so far of the attack to start kicking in the response.

I wonder how many npm packages are widely used but under _way_ less scrutiny than eslint?

Memories of the leftpad.js debacle make me suspect the attacker was not nearly as evil as possible - if they'd chosen a package that lives way down in the dependancy tree of a bunch of popular stuff, but which itself is unlikely to get much scrutiny, this attack might have slid under the radar for a lot longer. (And I've no confidence that this hasn't already happened, possibly multiple times, and this was just a copycat attacker who got "greedy" and foolishly dropped his attack payload onto a popular and heavily scrutinised package...)
On the cloud providers it is fully managed so nothing really to troubleshoot from the core platform perspective. The applications e.g. ingress will likely do but that's the same as if you were running on bare metal without Kubernetes.

And again the monitoring and auditing on Kubernetes is significantly better than trying to roll your own. There is detailed logs and metrics up and down the stack.
There's much fuss about having a default text editor on Windows that can edit \n line endings, but WordPad already ships with all versions and can do just that.
Well, this is pretty interesting. I’ve been wondering when someone would finally put optimisation semantics into the code.
RGB > ECC

Prove me wrong.
The most important "program" that reads your source code is probably in your brain. You probably have some "tooling" in their that is on the watch for "if (x = y)" and other patterns, but I'm sure you'd prefer to not have to run it.

As another counterexample let me give you "language tooling". For example, write a tool that generates a FFI from $LANGUAGE to C. Is it really so unimportant that $LANGUAGE is clean and simple and easy to parse?
Just use WordPad.
> namely the prevelance of ads

There are ads... baked into the OS?
Vallco was doomed as soon as Valley Fair opened for business 4.5 miles away and cornered the market for upscale anchor tenants.
Excellent! Thanks for posting ;)

The bibliography at the end is highly recommended for anyone wishing to build an AI bookshelf.
I can't speak to how you build your apps.

But application level metrics for example on the JVM behaves exactly the same whether it's in a container or not. You can still pull JMX metrics.
The state is defined in yaml manifests file which are trivial to store in Git and create templates with in Ansible.
They're also making quite a bit of money with exchange listing fees and in house marketing. It's common for larger exchanges to charge a token project hundreds of thousands of USD (sometimes substantially more) to get listed and "marketed" on the exchange.
My ears pricked up at "The culprit for this is the heap allocation by default dogma.."

https://mastodon.social/@akkartik/100357841646414633 (Mastodon doesn't have in-page anchors, but search for 'memory allocator'.)
The source code is at https://github.com/sonatype/nexus-public.

Not sure if Maven Central is running on the closed-source version, though.

> If someone has a contact at Sonatype, I'd love to talk to them about fixing this.

Contact them by email, they're quite responsive.
I have ordered a 15" 2.6Ghz/32GB/1TB model, I am just hoping they have improved the keyboard reliability.
I actually have a few devices now that are usb-c now. Pixel phone, Mavic Air and GoPro Fusion are top of mind.

Though to be fair the Mavic Air controller charges with micro USB
It was listed in the first few paragraphs, Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz
Yes. Firebase is so awesome! It really mis fun to work with and works so well with Angular. This guy has some awesome tutorials to get started.

https://angularfirebase.com/
He explains that it was a "triumph of Greek mathematics" to prove that multiplying the top and bottom of a fraction is how you multiply two fractions. That is, we accept as true that you can multiply fractions this way, but we kind of just got lucky that it does work that way. Proving that it always works is non-trivial, but that is totally glossed over in math classes, doing a disservice to students.

This is in context of dividing two fractions where kids are taught an arbitrary rule too early in their studies and it turns them off to math overall because it's become a class of memorizing arbitrary procedures instead of learning concepts.

(That's all my summary of that segment with a little reading between the lines, not my personal view of it. Or it might be later, but have to consider it more.)
If its gone to HR its already gone pear-shaped. Lay down the facts as you see them, let them know exactly what happened, tell the truth.

If they take it out on you, you know its time to go, but maybe this guy has been pissing other people off and you have no idea about it. Maybe its HR doing due diligence to fire.

Don't make accusations or shit on anyone, you don't know the whole story. Play to your strengths, which is knowing the tech and what it takes to get it to where it needs to be. Make sure you point out your attempts to communicate this fact. Provide any evidence of this- emails, etc. where you're communicating the state of the project and your projections for it. Let them know you've been frustrated with the miscommunication, but make sure that the miscommunication has started with you.

Again, don't shit on anyone. Stick the facts, so that if it blows up in your face it says more about them than it did about you. Its also the kind of resolution I'd I want to see on the interviewer side of "How did you resolve a difficult situation".
I worked on this project in college and went down to the south pole after graduation to help install some of the detectors. Neat to see the results! ~10 years later.
I don't take Wikipedia as sacrilege, but I don't see anywhere where it says developers do ops: https://en.wikipedia.org/wiki/DevOps
for those in this thread excusing the touch bar how would you feel if apple replaced the entire keyboard with a large touch surface like typing on an iPad. Great idea? Can't wait? Or Ugh?
Years ago I purchased a motherboard with a built in Raid controller. There were no drivers for it in mainline Linux kernel but there was code for a kernel module on the chipset vendor (Via's) website. The provided code wouldn't compile because there was a bug.

People from Fedora IRC channel helped me live debug the code over irc and we found the bug and were able to get code to compile and my raid controller working. Was an awesome experience.
I didn't plan on it but I always considered LS an option.

I have a Computer Engineering degree and programmed for 10+ years, mainly at startups that didn't pan out with some contracting thrown in there too. During that time some of my friends went into IP law and were doing well.

I eventually reached my last straw with startups and bit the bullet and went to LS at night while doing programming.

IMO industry experience is more important than LS rank/performance for patent attorneys. (I went to a local third tier LS school and had no problem.) It is your understanding of the technical subject matter that will set you apart from other patent attorneys especially from those w/o much industry experience. That said, I only work on computer/software patents, never gadgets or circuits.

Downsides include: drafting good patents is more exhausting for me than programming; the job can get grindy at times; and it also kind of sucks being in the service industry, dealing with those pesky clients can sometimes be a hassle. Being a diva programmer was more fun in that aspect.

Also, LS is expensive, my school charges about 2X what it did when I went. I went at night and worked at programming jobs during the day. This reduced my opportunity cost by at least $400K.

Upsides include: meeting a lot of smart people; learning about what they are building; flexible hours; nice office; decent pay; not having to build the inventions -- we just talk about cool parts and don't have to spend n-months or years getting them work; and not having to program for work.
I would assume their logs would possibly tell them which tokens were associated with the users that downloaded v3.7.2. npm probably doesn't need credentials to download a package so the number of downloads is likely higher. Determining other packages affected are another matter entirely and no one can say this attack vector is only bound by this specific date window. This could've been way more widespread unless they're unpacking payloads and grepping for key pieces of this specific attack.

I think it would be helpful if they could expose some of those logs but considering the meat of what matters would be the IP addresses to verify if your machine was compromised (or your CI server) that GPDR effectively wiped that possibility off the table. It would almost behoove them to setup a kind of haveibeenpwned service where you can check against stuff like this in the future. It's not like this can't happen again as the hole hasn't been closed completely, only this one set of compromised packages appears clean for now.
Best of the Best: The Top-Rated Workplaces in 2018
If I'm reading this right, it's a very cute trick. If not, maybe someone will correct my summary:

You can parse regular languages with a DFA -- think of a set of states and a transition function saying "if I'm in state x and we see letter c, go to state y".

Equivalently, for any letter you can ask "for each DFA state, where will this letter take me?" Like, "if we see an 'a', state 1 will go to state 5, state 2 will go to state 1, ...". You could represent this as a lookup table with an entry for each state, if you like.

These functions can be composed in the obvious way: just look up where the first one will take you, then look up where the second will go from there. So e.g. from the functions for 'c', 'a', and 't', you can get the function for 'cat', that tells what the DFA will do -- starting at any of its states -- if it next sees 'cat'.

(For a DFA with a constant number of states, composing two of these functions takes O(1) time.)

Composition is associative, of course. If you see 'ca' and then 't', this is the same as seeing 'c' then 'at', which is the same as seeing 'cat'.

To run a DFA on some string, you can think of it as equivalent to using the first letter's function to see where you go from the start state, then using the second letter's function on whatever state you end up in after that, and so on... which is the same as using the entire string's function to get to the final state in one jump.

How do you compute the whole string's function? Just compose the ones for its letters. This composition is associative, so you can do it in parallel as a tree-structured thing. For a string of length n, you can do this in O(log n) time as long as you can throw enough processors at it.

Boom, logarithmic-time parallel regular expression matching.

EDIT: I thought this sounded familiar, and sure enough: Danny Hillis and Guy Steele wrote essentially the same thing back in 1989, as one of the examples in "Data Parallel Algorithms". They also give a very clever explanation of how this can be extended to make a parallel lexer, also in logarithmic time:

http://cva.stanford.edu/classes/cs99s/papers/hillis-steele-d...
This should be in a spelling-bee tie-breaker question.
Here

https://github.com/dotnet/csharplang/issues/339
When we heard about this this morning at RunKit we immediately started writing a script to identify if any other packages had been possibly affected. We're in a pretty unique position since we install every version of every package in a sandbox environment as soon as it is published. The scan is pretty simple (just looking for a few key strings), and designed to catch any pre-discovery propagation. The scan is running as we speak and we've unfortunately found at least one unreported case. Luckily it seems to be a package not in too frequent use, and the way the virus propagated was also pretty bizarre (through `bundledDependencies`).

We've created a GitHub repo to track our progress that you can visit here: https://github.com/runkitdev/eslint-scope-scan

We will immediately file issues on any packages we find the exploit in. We are also open to suggestions to more sophisticated further approaches after this initial scan. Additionally, we are internally working on adding some sanity checks to the installation pipeline that might one day catch this sooner (such as monitoring network requests and file modifications during our sandbox install). Please let us know if you have any other ideas.
Both Azure and AWS have fantastic documentation. The bare-bones documentation and sparse tutorials of GCP are big reasons (other than market awareness) that larger enterprise customers are hesitant to adopt.
Frankly, to me the specifics of the syntax are not nearly as important as what the language does.

This:

> Abstraction by heap allocation is a dead end. It works moderately well on the current generation of computers where CPU is still the dominant driver of computation.

> It cannot work for devices like GPUs and the rest coming down the line.

tells me way more about the language (and gets me much more interested) than a "hello world" would.

I think syntax is by far the easiest part of a new language to learn, so it's ultimately not that important.

EDIT: Regardless, it turns out it actually gives code samples like a page or two down.
It's lisp without the curse. You have an arbitrarily dynamic runtime but enough structure and cultural idiom against abusing it that it has flourished. Compare for example type annotations in python versus those in clojure - clojure's expressivity and the culture's tendency to use it pervasively make meaningful annotations much more difficult than in python, even with python's crazy calling convention. Additionally a lot of my data processing python code winds up feeling very lispy - arbitrarily deeply nested iterator pipelines transforming dumb and often immutable data. We largely do this in python because smart objects are slow not out of any pursuit of purity, we have a thriving ecosystem of these kinds of libraries, but the end result feels vaguely similar either way.
While I really like 1Password - I do in my more paranoid moments wonder if it's become so well known and popular that it's probably a worthwhile target for attackers smaller than nation states?

It's pretty obvious some of the cryptocurrency thefts have been for amounts far in excess of what a seriously talented group would need to consider taking on a password manager...
I would not rely on it at all. At a certain point a bgp hijacker has to have some sort of physical interconnection to get to upstreams or an IX. Either equipment colocated at or near an IX, a transport circuit, something. Showing a forged LOA to somebody's colocation process is something that can be helpful in getting them to physically power off/disconnect a customer's equipment for abuse.
I watched a presentation on YouTube that Christopher Alexander did in 1996, talking about work he did in the 70s and it continued to amaze me at its relevance today. +1 to you for realizing there are still a lot of good, under appreciated ideas out there and that technology actually moves super slow.
Support for native Go versioning is now in tip