skysight-inc/HackerNews huggingface dataset:
If you're used to MacBooks, check out the Surface Laptop or Surface Book.

I’ve also switched from MBP to Surface, couldn’t be happier. Great keyboard, great 3:2 screen (since you can’t buy 4:3 anymore), nice trackpad, WSL is great too. Rather than complain, vote with your wallet.
It’s funny because I’ve always noticed that coworkers seem way more depressed and zombie-like in open plan offices, because they cannot get any relief from the constant stream of distractions and focus distuptors.
PG’s argument is a meaningless non sequitur. The question isn’t about what new technologies people adopt; it’s about what product designs they go for. The former of course will start in CS departments and research labs, because that’s where they’re developed. That’s really not saying anything, and has no bearing on the latter.
-1 to this. while 2FA is a no-brainer for most of us, publicly listing (or showing status) not only encroaches individual liberty to make a choice, it would open such users to be targets of an attack. Enforcing 2FA in an organization seems more appropriate. Perhaps npmjs.com has implemented that since last I looked, but I know in the past that enforcement was not available.

I also greatly dislike the trend of public "shaming" that's so prevalent today. The internet has made us cruel.
“Too unreliable “

“Faster to type”

You’re doing that thing where you take the current implementation that isn’t very good and ignore that it will greatly improve.

For example, people say electric vehicles don’t work for them because they only go 300 miles on a charge with today’s battery technology.

Anyway, at some point, someone will get it right then you’ll wonder how you lived without it.
> IMHO, at some point, the software development industry is going to have to come together and find a way to collectively audit the most widely used packages

That will never work. Widespread auditing practices will never solve such problems. What the software development industry should do is move towards capability-secure languages where such attacks are virtually impossible.
Here's what I posted three years ago on the topic:

https://news.ycombinator.com/item?id=9760414

Is it time to get depressed yet? This has been a topic for such a long time. It was in peopleware in 1987. I thought I discovered the topic when Joel (On Sofware) wrote about it in 2000. While a few people seem to enjoy open offices, the overwhelming majority of developers I know, or who chime in on HN, value a quiet place to work and dislike open offices.

And yet, not only has nothing changed, it seems to be getting worse. It couldn't be more clear to me that developers, at least on this issue, simply have no clout as a profession. There may be a few individuals who can make demands, but on the balance, these are decisions imposed on us, as a group, and we are apparently unable to do anything about it.

The really sad thing is, this isn't a situation where we're asking to fly first class, or for more vacation. We're talking about asking for something that will make us more productive and increase the value we largely hand over to our employers, simply because it's depressing to not be able to do a good job due to distractions.
So yeah, I'm depressed about it.

There was a time when I read these essays and felt a bit more charged up, like people were starting to understand something important and that things would change. Well, now we have open offices.

I'll finish with another variant on my broken record: the industry talks constant about the critical shortage of software engineers, but it won't give them a quiet place to work. Actually, that last sentence is too optimistic - it won't allow them a quiet place to work. Those places exist, but companies often demand that their programmers spend 8 hours a day in places that are too noisy for focus.
> Trump won the vote, putin won the vote.

Not sure how you could be convinced that these elections are even remotely similar in terms of legitimacy, I suggest diversifying your news sources.
I'm no Tesla fanboy but I'd wager that those 30k sedans don't include the cost of complying with US and European regulation and customer expectations.
$1.8B for Crypto at Lightspeed: Firms Raising Large Funds for Crypto and AI
Because 99.99% of laptop users have no need for ECC.
The book I have re-read the most is The Hobbit. It is comfort food to me. I have had to purchase a new copy because my old one is becoming fragile, and it has a lot of personal meaning to me. That old copy was given to me as a child by my grandfather. He was given that copy by C.S. Lewis while he and my grandmother were staying with him at the Kilns. I can only imagine one place where C.S. Lewis would have obtained a copy of The Hobbit.

There are usually two different reasons why one might re-read a book. Sometimes it is to see the book again through older eyes which have seen and known more. Other times it is to try to re-capture the emotional experience of living in that story. I find that I tend to come back to certain books much more often for the second reason than for the first one. I might feel the desire to re-read Quantum Computing without Magic or Theory of Internal Combustion Engines once a decade at most. But when I'm feeling that the world is a confusing place and I need some simplicity in my life, I'm ready to take a journey to the Lonely Mountain.
Scientists assessed the options for growing nuclear power. They are grim
So I use a lot of different keyboards - my main ones are a whitefox with blue switches and a CODE with greens. I actually like the MBP keyboard - key stability and clickiness are the parameters I like, and the MBP has both.

My problem with the keyboard is just reliability - I now keep a can of compressed air at my desk just because a key is going to get screwed up at least once a month. And I have one key that is particularly bad, so I assume some piece of dust is just trapped under the key and the compressed air pushes it somewhere until it eventually falls back into place. I'm waiting a little longer to bring it in for repair in hopes that they start using this new v3 keyboard as a replacement - maybe it secretly fixes the dust issue (And they don't want to say it because that would be admitting that there was a problem.)
The Nordic Model: Embracing globalization and sharing risks
Yeah I agree with that. Maybe they'll need a more sophisticated solution that can check for visual similarity. But It just feels like they haven't even acknowledged this as a problem, so I would be happy with any countermeasures right now.
Fair enough. In any case, the MacBook Pro hasn't been Apple's laptop for the masses in a long time, unlike what r0fl implied. We can't infer from its design what 90% of customers want.
It's not like they are pointing guns at people, are they?
Not just network permissions, opting into what local directories it can see. Allow it to see absolutely nothing but its own directory and temp. I don't have a good answer on a good method to override this when necessary. Ideally never, but realistically some form of whitelist.

npm-audit is good for post-disaster cleanup, but it's too late to prevent anything.
Reminds me of Dan Luu's take:

> This book seemed convincing when I read it in college. It even had all sorts of studies backing up what they said. No deadlines is better than having deadlines. Offices are better than cubicles. Basically all devs I talk to agree with this stuff.

> But virtually every successful company is run the opposite way. Even Microsoft is remodeling buildings from individual offices to open plan layouts. Could it be that all of this stuff just doesn't matter that much? If it really is that important, how come companies that are true believers, like Fog Creek, aren't running roughshod over their competitors?
Abstract of the referenced (and paywalled) PNAS article:

"Nuclear power holds the potential to make a significant contribution to decarbonizing the US energy system. Whether it could do so in its current form is a critical question: Existing large light water reactors in the United States are under economic pressure from low natural gas prices, and some have already closed. Moreover, because of their great cost and complexity, it appears most unlikely that any new large plants will be built over the next several decades. While advanced reactor designs are sometimes held up as a potential solution to nuclear power’s challenges, our assessment of the advanced fission enterprise suggests that no US design will be commercialized before midcentury. That leaves factory-manufactured, light water small modular reactors (SMRs) as the only option that might be deployed at significant scale in the climate-critical period of the next several decades. We have systematically investigated how a domestic market could develop to support that industry over the next several decades and, in the absence of a dramatic change in the policy environment, have been unable to make a convincing case. Achieving deep decarbonization of the energy system will require a portfolio of every available technology and strategy we can muster. It should be a source of profound concern for all who care about climate change that, for entirely predictable and resolvable reasons, the United States appears set to virtually lose nuclear power, and thus a wedge of reliable and low-carbon energy, over the next few decades."
Its great for scrubbing through video. Tap and hold for fast, fine grained control.

My only complaint with the touchbar is its too easy to accidentally engage Siri.

Other than that it’s a good idea IMO.
I'm aware of one filesystem implemented on top of S3 using FUSE that makes a serious effort to be fully POSIX-compliant: ObjectiveFS [1]. It doesn't map files directly to S3 objects, so you can't access your ObjectiveFS data directly using other tools. As I understand it, it treats S3 objects more like the blocks in a log-structured filesystem. I've successfully used it to run applications that aren't "cloud-native" in an environment where VMs are (at least theoretically) ephemeral.

[1]: https://objectivefs.com/
Slow??? Are you kidding?
They could probably do it with the iPhone if they didn't insist on also making the phone inexpensive. After all, the SE is significantly thicker than the current generation phones.

And they could probably do the same with a variant of the 13" MBP if they were willing to sacrifice a bit of battery life or just go back to the thickness of the 2015 models.
I find video chat to be as productive or even moreso than face-to-face meetings for small groups of people.

In face to face meetings, many companies (like ones I have worked for) have limited meeting spaces and it's quite hard to book a conference room for more than an hour. Often times, we'd shuffle from one conference room to another.

So even in-person isn't quite as effecient and productive as it could be.
I did too, but the fact that they limit it to touchbar models means I'm out.
Webkiller – Tool Information Gathering Write by Python
That's next year complaint.
Yeah, except if you're too stupid to even notice how hard life really is.
„It is amazing to consider that despite the tens of millions of dollars spent and years of effort by a team of trained scientists, nobody even noticed the release of thousands of gallons of liquid botulinum toxin and anthrax in and around Tokyo in what what was perhaps the largest deployment of biological agents in history.“
You would need to bypass connect-src in order to exfiltrate data. Even if you are able to call fetch() on your endpoint through XSS, CSP would block the network request. So the iframe and webrtc methods in the article are geared towards bypassing that since connect-src would fallback to default-src in this case.
> (namely the prevelance of ads)

Where are all these ads that people complain about? Is it the half pre-installed apps that come with your computer that you can promptly uninstall?
XFCE looks a lot better with a different window theme installed, the defaults are absolutely terrible. There's as many options for XFCE as KDE, but it definitely takes tweaking before it looks good.

i3 is generally used for its productivity benefits, not for appearance. You can still spruce it up with a new bar (see Lemonbar or Polybar), but overall people choose it because it feels nice to use. The people on /r/unixporn have done a pretty good job of making it look good though.
I recommend Lenovo T480 for Linux. Supports 32GB ram as well.
If your npm is up-to-date it would have provided a critical warning about the use of eval in that code.
Do they really? I don't think the dead have any expectations at all let alone the expectation of privacy. But also, she was a minor and therefore no real privacy rights with respect to her parents.
I wish I could get the non-Touch Bar 13" with the maxed out processor and RAM
I don't know, it seems like your SSH key could've been compromised the same way the npm publish token was obtained. So that would only protect those that do not use SSH (or GitHub, which luckily isn't required to publish an npm package) to push.
America didn't really have an aristocracy. It had something that if left unchecked would probably become an aristocracy, but it didn't exist in that form yet.
Start taking long lunches.
Correct me if I'm wrong, but I feel like the fact they sell cars makes Tesla a real car company already.
Thaler has written a couple of books. Nudge (with Cass Sunstein) focuses on how the "right" decisions can be "nudged" by setting up appropriate decision frameworks.

Misbehaving is more of a personal history of how he got to behavioral decision theory. I particularly enjoyed that because I had a couple classes with him when he was working on these ideas early on.
Sure you can. The first public mirror list I know offhand is https://github.com/amio/npm-mirrors/blob/master/index.js.

You can also make your own mirror. See https://eatpeppershothot.blogspot.com/2016/12/how-to-create-... for a quick overview.

Come to think about it, if you're not a fan of the paucity of public mirrors evinced by the first link, you could use the second one to do something significant toward improving that situation. But I grant it's easier merely to criticize.
More UCL and Stanford but okay
I absolutely agree with this, I see such a loss in moral and productivity where I work. What is funny though, is that the management has walled offices. I wonder why.
Just an aside ... I set my lower-right "hot corner" to "sleep screen" on all macs I use - including desktop imacs ...

That way you can just drag the mouse to the lower-right corner and black the screen anytime you like ...
Analyzing potential bounds check bypass vulnerabilities [pdf]
If they didn't have to the fit the pointless Touch Bar and its extra co-processor in there...
They build them themselves, and vet holders of signing keys. They have _much_ better opsec than the NPM ecosystem.
Ohhh, that's cool, thanks for sharing!
A rent agreement or a gym membership are also non-physical, yet are being inherited.
The signature of `;` where it an operator is more like

(;) : unit -> 'a -> 'a

And you can see it as a kind of sequencing operator, since it returns the value of the right hand side unchanged.
I've had the Touch Bar model twice now (long story). Each time I switched back to a 2015 model after about two weeks.

The missing Escape key is annoying. The lack of tactile feedback makes it awkward for touch typists who expect some kind of feedback to sense that their press reached the right place. Remapping to Caps Lock requires a long muscle memory retraining period that is not helped by the fact that external keyboards still have an Esc key, moving your training progress backwards (unless you pry it off or something).

The new keyboard is not very nice to type on, but the worst aspect of it is that it is extremely loud. I didn't experience any key failures myself, but I have a colleague who did. (And of course he encountered the classic problem: What do you do when the laptop you absolutely rely on for work is in the shop for 7+ day's to fix a single key?)

Also, the new arrow key layout is very bad for touch typists like myself. I frequently had to look down at the keyboard and see that my fingers weren't finding the right arrow key. The old pyramid layout of the four arrow keys was much more friendly.

The Touch Bar is literally useless to me as a touch typist who is used to not looking at the keyboard. One of the first things that annoyed me was that the contents of the Touch Bar changes depending on the app, so in order to use it without glancing down you have to remember the exact widget placement for each app. So I pretty quickly switched to the "extended" control bar that always has the same layout. But that basically just gives you the functionality of a pre-Touch-Bar Mac.

I frequently found myself accidentally touching the Touch Bar, often because I rest my hands in a splayed position across the keyboard. My fingertips would end up resting on the Touch Bar and cause surprising things to happen.

Another annoyance is the fact that if you do want to invest in using the Touch Bar efficiently, you can't use the Mac with an external keyboard. In my home office I have an external screen and "dock" my MacBook there and run it with a closed lid and a wireless Apple keyboard. No Touch Bar there.

I don't mind all the other problems so much -- USB-C, no MagSafe, trackpad that is too big (yet another case of accidental touches), etc. -- but I'd pay a lot of money to get rid of the Touch Bar.
I agree, and often times is several engineering teams that have their own budgets for labor, verses an entirely different department (facilities) using a different pool of money. Each department has incentives to cut costs independently and often at the expense of other departments.

I would happily buy my own sodas (I don't drink them anyway), chips/snacks (I don't eat them at work), coffee (I do drink coffee!) if it meant I never had to sit in an open office environment again.
Just set up Wireshark in their fungal network system and capture the packets being sent around.
> build a world-class image classifier in three lines of Python

How is that learning how to build something, as opposed to simply using a system someone else built?
Maybe a crappier keyboard is cheaper to produce?
1. Sandbox file access

2. Limit network calls without additional permissions

3. Warn when the dependency tree goes too deep (8 or 9 levels of deps)

4. Better auditing of suspicious patterns (accessing .npmrc should throw a flag)
Do you want such a  rainbow progress bar? [vue-ins-progress-bar]
> If you have npm credentials and did npm install the last few hours you should probably revoke your tokens.

You might have to do that anyway - it's not yet clear what other packages, if any, have been affected.
That's a great point. The top companies are succeeding in spite of a practice developers say they despise. So isn't that evidence they're right, and the devs are wrong?

Here's the thing - how many industries rely so deeply on controlling their workforce's right to live and work in the United States? How many industries lobby congress so ferociously and constantly about a shortage of highly skilled workers?

Well, yeah, if an industry has the right to decide who is and isn't allowed to live in the United States, in a system where non-family based immigration is difficult and spots are hard to come by, then sure, they can be very successful imposing work conditions that people with personal and economic freedom of mobility would reject in favor of another profession. But if you really want to live in the US and Facebook controls whether you get and keep a work visa, then sure, you'll put up with an open office. And because of the way we allocate green cards (requiring a corporate sponsor, and greatly restricting how many are issued every year, with a long queue), you may have to put up with it for quite a while.

So another way to look at it is this: companies say they are in a desperate competition for key workers in critical shortage, and they can't recruit domestically no matter how good an offer they make. They also require working conditions that most developers say they despise. Uh, how about working conditions that most developers don't despise, have you tried that?
I wrote up some tips on how to make Windows 10 more palatable for a Linux user. https://github.com/chx/chx.github.io/wiki/How-I-set-up-my-Wi...
I'm old enough to remember when high-wall cubicles were standard fare, and they were mocked and derided as soul-crushing corporate cost-cutting measures. But they gave you a lot of privacy, relatively speaking. And you could still have spontaneous conversations with your neighbors.

And then when school-cafeteria-style open offices became de rigeur in the startup culture, people seemed hesitant to push back on the "but collaboration!" nonsense. It looks like the overton window for that is finally starting to shift.
Sprint Follows Rivals by Complicating Its Unlimited Mobile Data Plans
I don't want to take a way from the work done, it's indeed a lot of work to get websites to load fast nowadays, when the images are so hi-res and there are so many js libraries and requests, and then you have to take tablets and phones into account... it get's big fast. But the 7kb title is clickbait at best. I too can make a website load fast by extracting pretty much everything from it. When working in the real world with real clients, this wouldn't fly. It would be much more impressive to get a website such as css-tricks.com and show me how you have optimized it.
Out of curiosity, have you had a chance to explore the Windows Subsystem for Linux (WSL)? WSL allows you to run your favorite linux distro with access to most command-line tools, utilities, and so on[0]. I have been a .NET developer for about 5 years now and recently began working in Ruby. The WSL had allowed me to effortlessly set up my Ruby dev environment, while still maintaining Windows 10 as my main OS of choice. While the WSL might not be a full on replacement to a linux OS, it is definitely a neat addition to Windows 10.

[0] https://docs.microsoft.com/en-us/windows/wsl/install-win10
Here's the lecture he's gave for the Nobel: https://www.nobelprize.org/nobel_prizes/economic-sciences/la...

If you're looking for information on nudges, check this: http://economicspsychologypolicy.blogspot.com/2013/08/nudge-...

It looks like they've stopped updating it but it has all sorts of economic research on nudges in it. Beware that some of this research is debated though.
who really buy teslas but soyboys?
The HP Spectre x360 is a good example of bezel-shrinking in laptops. I have a 13" model and it's nice to have a more compact laptop.

I have no idea why this style isn't more popular. Maybe it seems too fragile to consumers?
Apparently I had twins in 2013, as I'm not giving up my 2013 MBP in the same way that I'm not giving up my son.

Can I please buy a 15" macbook without the touch bar? Thanks!
Finally we've up to data CPUs but now it's even more overpriced.

Guess Dell just won a new customer, the XPS line is really good in specs and price.

3.846,71 euros ~= 4500 USD for 4 Tb of SSD storage?
Long live Hackintosh, macOs is good but the price isn't just there.
The negation of the former is true but the latter is also true.
I actually often see the opposite less intelligent people are often carefree and more happy.
This. The timeline is a bit tight for a live interview. They have about 5 mins per task. I think you're probably filtering too hard on people with previous experience using jQuery and don't have interview jitters.

My suggestion would be offload some of those basic questions to an automated at home code test. It'll filter out candidates who can't FizzBuzz, so you're left with a more reasonable 1 hour technical interview with less pointless candidates.
It's not the most high bandwidth for all of us. More information doesn't always equal better.