skysight-inc/HackerNews huggingface dataset:
I’ve got an issue with the Touch Bar that, as far as I can tell, only I am experiencing:

Take your MacBook Pro, put it in a room indoors, and flick the lights on and off in that room several times a second. You’ll notice high CPU usage on a process called “TouchBarServer”, as it tries to adjust itself to the changing light levels so it can display its screen. For some reason, as it does this, it lags the entire rest of the computer: scrolling will freeze every couple of seconds, clicks won’t register, the mouse will lag, and keystrokes will just be ignored.

Why would you do this, you might ask? I work on trains a lot, and I get this same flicker effect as the trees by the tracks go past. As they pass the windows of the train, it’s like a bright light source is being rapidly turned on and off.

I don’t ever use the Touch Bar — nor did I want one — but merely having one renders my laptop unusably slow for two hours every day. I hate this computer.
Not traffic imbalances at peering points. Rather a situation where data has to travel further, through more nodes from source to destination. Shouldn't a logical system allllow that data to cost more? Or for example through the same number of nodes but more expensive source nodes.

Beyond that, there is some "discrimination" I would be just fine with. For example why should the end consumer pay the cost of YouTube ad data?

The fear is of course discrimination on political or ideological grounds, not just economic. but it would be fairly obvious and nearly impossible technically for an isp to pull that off. And a net neutrality regulation or even ownership at the state or local level would be perfect. You only need net neutrality at the end points where there is no competition, not in the network at large
Here in Brazil you can fill a shopping cart with the stuff in ant Carrefour. For restaurants, specially the ones that serve feijoada or barbecue*, is not hard to find it in 50kg sacs.

Manioc flour is the main ingredient in farofa, an essential side dish for both feijoada and bbq.
Vgo support landed in main go repo
My armchair analysis of this today has exposed, to me, the serious risks of bikeshedding[0] taken to an extreme. So much contentious debate about 1-3 character syntax preferences. The consequences from the debate being deeply more impactful than any of the proposed options in the first place.

0: https://en.wikipedia.org/wiki/Law_of_triviality
iridium is available all the time but very slow and the scarce bandwidth is not prioritized for incidental ssh access. The problem is that there are a lot of people / experiments at Pole.
Your tip only works for _decreasing_ the volume. If it’s turned all the way down, and you want to turn it up, you can’t tap-and-drag it because the fingerprint sensor gets in the way.
Admittedly a pool table is probably on the extreme end of examples I could have given; been fortunate enough that in both places that actually did have a billiards table-they had dedicated game rooms so the clatter of a cue-ball breaking and scattering balls against each other was well contained.
I have a similar setup at work, albeit Ubuntu VM in a Mac OS host (I don't like Mac OS). A lot of these sound like VM issues. For example - the copy to clipboard if you select a string. That's how your VM is "sharing" the clipboard between the VM and the host. Try highlighting a string in the VM and then hitting paste in a text editor in the host and you'll see what I mean.
> Password managers and MFA, people!

You're preaching to the choir on HN.

This needs to be posted on LinkedIn, Facebook, the *Grams, Imgur, Pinterest, etc.
A fantastic result, and a nice story behind it. Per the abstract of Tang's paper, the current best results are linear in m and n.
>21MB of gifs on the readme

Why?
You've come to the wrong conclusion, he handed things off to the core developers. It's not like there are 45 million people with commit privileges over there.
How does an editor handle loading from disk and updating when someones inserts to the head of a file? Everything needs to be shifted.
What's inside an HSBC SecureKey?
My password manager is accessed through an SELinux enforced VM without networking. AFAIK this is as secure as I'm going to get (debating the tradeoffs between a VM and airgapped machine) without using Qubes.

But at least, in the event of an exploit, the VM is still without networking.
Specially maintainers of popular NPM packages.

eslint-scope has 500K downloads every day for god's sake.
Unix's \n, Windows' \r\n, and older Mac's \n\r.

Deciding whether a line-end terminated when reading from a network is kinda hard...
A machine can have "insanely good IO" if you're not judging it in the context of older hardware, yes.

Four thunderbolt ports is great. One adapter to plug in all of the things you mentioned is also great. iPhones and hard drives don't need dongles, they just need cables. A USB-C to USB-B 3.1 cable is $1.33 from Monoprice; USB 2.0 version is just $1.12. Not too shabby.

For iPhones: the only times I've had to plug my iPhone into my laptop is doing development, but a cable for that only costs $20.

But let's compare it to the previous (2015) MacBook Pro: two USB ports and two Thunderbolt-and-Displayport ports, and HDMI. Five ports total, but no flexibility. Our office was full of DP-to-DVI dongles already, so swapping one dongle for another seems like a no-op. Difference now is that we can buy USB-C monitors which also serve as a power source and a USB hub, meaning one cable to plug in my entire desk. That's something you can't really get on the old MacBooks (at least, not without spending a lot more than it costs to do it on the new MacBooks.

So yeah, the machine has "insanely good IO", and once the rest of the world catches up it'll be even better.
I'm pretty sure he means "it is an easy equation to memorise, but it's not trivial". People can remember the formula, but have no idea how it actually works.
I use HapticKey, which makes the Touch Bar slightly less awful by clicking the trackpad when you touch it: https://github.com/niw/HapticKey
Sure. Just don't forget that corporate officers are also people, and no amount of fiduciary magic will enable them to exceed the typical limitations of human nature. And that includes falling victim to trends, gossip, and me-too.

In general, let's not elevate anybody to superhuman status, no matter what Ayn Rand wants you to believe. It's never true, and it never ends well.
I think this was important. The class of bugs it would have created if it had been compatible with the unicode/ascii split would be hideous.

Fail fast. It's better to break right away than having false senses of security. There is always __future__ too.
Though on the other side, you have to judge how many libraries you want aren't in the Debian repositories, how much effort it takes to publish something into the Debian repositories, and how completely out of date many things in them are.
Greens 'bewildered' by kerfuffle over Microsoft's Protected cloud status
Here in Brazil, we have two kinds of flour from manioc, a very coarse one used in Farofa and in a taco-shell like crunchy thing we call Tapioca, the other is a super thin one called Polvilho, used in biscuits and cheese bread. maybe they're related to the ones you know.
i like bulma better
Your quote wonderfully illustrates that npm are either being obfuscatory or entirely missing the point.

How did they determine tokens for 4,500 accounts could have been obtained, and what is that even supposed to mean? The problem here is that any user of these packages could have had their .npmjs file read and exfiltrated, not just some upstream package maintainer. Were there only 4,500 valid npm tokens or something? I cannot imagine that is the case.

So either they looked at 4,500 packages uploaded during the compromise window and they're not explaining how they undertook to do that, or they don't understand the vector and are minimizing the severity of the issue.
At my open office, the CEO announced in a company-wide meeting that they would be putting a ping-pong table in the breakroom (very open, could be heard everywhere). Instant "No's" coming from everywhere. Just one example of the kind of and amount of thinking that went into designing this place. Well, the real problem is that this office was a last-minute rush-job :-( They ended up getting one that could go outside, but that was just to save face.
Sent you an email. Looks like I did get refunded for the force post, but had issues later with other transactions.
> You had to go through a list of approved modules and versions.

I was actually talking about this with coworkers at lunch.

I think this is too expensive for individual developers/small companies, but there's really nothing stopping a wider open source community from marking specific modules+versions as more likely to be secure.

I think there should be some opt-in system for objectively predicting code quality and developer/maintainer opsec. Apply some rubric for {secure programing techniques, static+dynamic analysis, CI deploy toolchain, basic security hygiene of the developers} and recursively apply it to the upstream dependencies. Display the score according to that rubric on the project page -- this would be far more useful of a metric than "number of downloads" or "I used it at my last company".

It doesn't protect against malicious insiders, but not having a high score could act like the "Scarlett Letter" we need for low quality repo-modules.
older macs are just \r not \n\r
I've read Neuromancer and Snow Crash about once a year for nearly 20 years.

Michael Marshall Smith's early sci-fi books, Only Forward and Spares, have also had many re-reads.
The alternative here is password reuse for most people. That's so much worse. Lesser "evil" I'd say.
Most of the instrumentation I have found myself losing have been at the application levels. And to be clear, most of them are still somewhere, but not nearly as well polished as in services we have not on containers. (I'm also primarily talking about a bunch of internal practices at my current job.)
Automating Drug Discoveries Using Computer Vision
So, we insist open-source software developers to keep their "implicit contract", but we (as society) allow companies to buy companies that develop and maintain open-source to close-source it or just close the entire establishment? Without legal consequences.
"The Linux kernel offers an API to add new schedulers
to the kernel. ... [In Linux] multiple schedul-
ing classes can co-exist"

Very cool! Are there any real-world applications that use non-default/custom schedulers?
Everyone is different, but studies continually show that the net overall effect of open offices across people is hugely negative: productivity goes down, stress goes up, disease transmission goes up…
Well, on the worst case scenario, you get not worse than before. So this seems a net win.
You sound very logical and well-meaning and seem to be a good person in general, so I have to resist my initial urge to turn this comment thread into a flame war, but:

1.) a shared "purpose" to me is literally the same as a "Shared intellectual approach" -- purpose is a synonym of what I was trying to say.

2.) I strongly disagree that "disagreeing with the way you do certain things within the frames/boundaries of pre-agreed purposes and projects" is what anyone is trying to say when they talk about "intellectual diversity." If your definition of intellectual diversity (just inferring here so lmk if I'm wrong) is "disagreeing about how a job should be done," then literally every company on Earth is diverse by that metric, so its not a particularly useful metric IMO.

3.) IMO when people refer to "intellectual diversity" they are referring to having strongly held and opposing viewpoints about issues that are much larger than "how this job should be done." The viewpoints that qualify as "intellectually diverse" in all discussions of the concept I've read are referring to politics and/or religion.

I respect that you have an effective working process with diverse and strong viewpoints about software, but I think that strongly opposing viewpoints about software do not meet the commonly-held criteria for "intellectual diversity." Strongly-held opposing viewpoints about religion and politics do.

Compared to politics and religion, It's easy and fun for you and your coworkers to strongly disagree about software development. When you guys strongly disagree about that topic, the final outcome (as you just described) is positive: Everyone learns new things and your product gets better.

But it's extremely difficult and potentially way less fun for you and your co-workers to strongly disagree about politics and/or religion while still having a positive final outcome for all involved.

My question is this: do you know anyone who can? Because if anyone can provide me with a link to an article/blog post about "intellectual diversity" as it seems to be defined in common parlance -- I.e. "group members holding strongly opposing viewpoints about politics and/or religion" -- let me know because I'd be fascinated to read about it.

My curiousity is this: I wonder if intellectually diverse organizations share characteristics and if there was a way to map all organizations and find out which ones are "intellectually diverse" and what commonalities they share. Some part of me wonders if CrossFit and yoga would be the most intellectually diverse but the other part thinks maybe they're self-selecting for some tribal/religious/political qualities that I'm not even aware of. Would be cool to find out :)
Why Blockchains Don’t Suck, and the Perils of Distributed Databases
It's much like some of the long german words which are literally just a series of concatenated words.

I assume that 1000s of years ago german and maori students were struggling to get essays completed under some unreasonably tight word limit. This was their solution, and the subsequently buried the evidence.
I was lucky enough to live across the street from a great independent video store[1] and part of the fun was spending 30 mins or so browsing the shelves for 3 DVDs for the week.

When checking out I’d often get some good advice from whoever was at the counter on what to rent next time if I liked what I was getting that day.

As much as I love the convenience of streaming I’ve still yet to find any algorithm that seems to be able to make a decent selection so I’m gonna have to say I’m nostalgic for those times :(

https://www.aliceinvideoland.co.nz/about
Obligatory warning: don't trade more than you can afford to lose.

I can't see how making leveraged trading accessible to the large masses is beneficial to anyone other than the app makers and institutional investors.
In all honesty, none was intended.

It struck me that my favorite intellects usually do foremost concern themselves with “how poorly we understand systems and why it's critical we get better at managing them”. This intellect just seems most important right now.
I’d argue that if you’re playing with options on industries or companies you know well (not your employer though) you may even have an edge over institutional investors. Unfortunately it’s not possible to buy calls on pre-IPO companies though
Yeah, this is exactly how the emacs `shell` mode works, and it's fucking awesome + completely addictive.

The only bad thing about it is emacs is so shit-ass slow at rendering text that I have to drop back to a normal shell for commands that spew a bunch of shit (like maven, ugh).

It's one of the can't-live-without-it things that's keeping me on emacs.

(Also how dumb is it that a text editor is slow at rendering text? Emacs is amazingly flexible, but the implementation is just junk. I dream of an editor w/ the speed & implementation quality of Sublime, with the flexability of emacs, that'll still run in a terminal. And a pony. I want that too.)
Has anyone ever written a static analyzer to audit an npm package? Say I'm looking to add a new npm dependency, and I do my due diligence, pouring over the code, scanning the issues log, etc, and everything looks kosher. But then it would still be nice to run it through some kind automated analyzer, which also recursively scans dependencies. I ask because even simply grepping each file for the string "eval" would have flagged this.
I switched from Sublime to VS Code because it was better at handling giant log files that would kill subl
Sure even if your chosen search engine is ddg or gg on firefox (i guess it opens edge maybe) . No politics here. The purpose of notepad is to edit text with no frills. I would have liked better something like unicode encoding selection, minimap or invisible character toggling. Or even better searches options for anyone (regex could be a bit too far..)
Note that `eslint-scope` and `eslint-config-eslint` were both affected[1], so duplicate this search for both modules.

[1] https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...
Scientific data. Sometimes I forget that a .txt file I'm working with casually in Igor Pro will cause my laptop to seize violently if I accidentally open it with something else.
So the reality is that the growth of the web far outpaced any sort of design principles that could have been implemented by any committee.

TCP/IP development happened quietly for the most part in the 1960s-70s. There wasn't a lot of pressure, and they had a decent amount of time to get the protocols right. There wasn't an economic demand for Arpanet.

And it wasn't until about 1993/1994 that the web exploded in use and popularity. That was only 4 years after TBL created HTML. That's when you saw the explosion of JS/Java Applets/CSS/Browser Plugins/etc.

In some sense, the same thing is happening in the python world. While python has been around for a while, there were maybe 800 python devs at Pycon 2010. In Pycon 2018 there were 3000ish(?).

I do agree with you that the Python 3 update wasn't done well, I think it is because they didn't predict the language's explosion during the 2010's.
I think the difference is that you don’t know if the server is running Apache or nginx or IIS because it’s abstracted away.

The only interface is the input into the function and the output it returns.
I suspect we mostly agree with each other. My experience with folks in containers so far has proven to be that this is often hoped, though.

Specifically, we had devs talking about how we wouldn't have to worry about system patching anymore, because the containers would take care of that. With no answer for how we trace versions and patches through our systems.

If you are already tooled enough such that you can completely redeploy a full stack easily without worrying about some in place modifications, the difference between a VM and a container are relatively minimal, all told. Especially since you have to be ready to pull down the host of the containers anyway.
I'm not quite sure how to explain it if it is not self-evident. The defining characteristic of Kafka's work was situations where the protagonist has to struggle against powers that are both unseen and overwhelming. So here we have Microsoft, one of the world's most powerful corporations, saying "You can trust us because if we were not trustworthy you would abandon us and flee to the competition." Except that there is no competition because Microsoft has destroyed it all. That reminds me of Kafka. YMMV.
You are a charity case.
Unless, say, someone uploaded malicious code to a repo with a dependancy the password manager pulls in which changes that behaviour...

Some code somewhere needs to be able to decrypt all those stored encrypted passwords - that code is a _super_ high value target.

I like/use/recommend/have-paid-for 1Password for 5-6 years now - but I worry that the online and 1Password for Teams implementation - even though I trust the 1Password team to "get it right" - has got to be a really "fun" target for sufficiently motivated and resourced attackers. (If I were sitting round at the NSA looking for a fun project - automated MITM of 1Password traffic at p0wned or backdoored-by-agreement carrier or IX routers, using trusted root CA certs to create legitimate-seeming SSL certs, and on-the-wire JavaScript code injection... I reckon I could sell that to my super-sekrit-PHB as a worthwhile research project. )
I'm not him but to me the big thing that Firebase has and AWS Lambda doesn't is Firebase - a database.

Firebase Functions === AWS Lambda but it's only one of 17 components that is Firebase.

Also, Authentication component is nice (easy way to implement accounts/login with Google/Facebook/Twitter/email).
There is a ‘npm audit’ command but that checks for known versions of a package that have a vulnerability so it’s not a static analyzer as far as I know.
Can you elaborate on what is wrong with Cloud SQL? I have next to no experience with it GCP Cloud SQL, but use AWS RDS a lot.
>So yeah, the machine has "insanely good IO", and once the rest of the world catches up it'll be even better.

I mean, that's the thing. Apple jumped ahead, and USB-C just isn't common. (At least, for me. I can't name any device I've used or even heard of that uses USB-C.) So, it's a less than practical option if you're in the market for a laptop, not so much insanely good.

I wouldn't buy a computer with only serial and parallel ports because none of my devices use them, and I wouldn't buy a computer with only USB-C ports, because none of my devices use them.
Are you able to determine if some piece of equipment you use every day is turned on or not, and able to accurately relay this information?

If so, you are not part of the demographic the parent is talking about.
> From Sears to Radio Shack

The idiotic thing is that Sears was the original Amazon, with their mail-order catalog business. It worked out well for them for a long time. But they became your grandparents' favorite place to shop (and their product offerings reflected this) within a few generations, and in their desperate bid to stay relevant they've decided to mimic the business model of Service Merchandise, which paid the price for its own irrelevance 20 years ago.

Everybody overhypes Amazon but it's not (entirely) online shopping that Sears is competing with-- it's Walmart, the neighboring, booming B&M business.

Radio Shack is not much better. "You have questions, we have blank stares" gave way to "you need solder, we have cell phones." Somewhere along the way they were forced to sell nothing but phones and lost any cachet they had as the only electronics vendor in most towns, as they were now competing with the 5 or 6 phone stores even the smallest of towns already had. I don't know where they went wrong in the first place but in this overteched age the market for consumer electronics is clearly there.

It's like watching a horror film where all you can do is scream silently "don't do that!" as the debutante goes into the basement to investigate the strange noise. Some of these pivots are just painfully short-sighted.

I suspect malls may yet make a modest recovery. More and more of them are starting to attract "lifestyle" businesses to prop them up and drive foot traffic, such as movie theaters, events, bars and (actual) restaurants.
Why should one not run Terraform locally?
You said "Not better than China censorship."

That's ridiculous. There are degrees, shades of grey.
Don't most virtualized hosts already solve the "less wasteful" point? I get that hypervisors and friends aren't bulletproof, either; but I have fewer ways to shoot yourself with those than I have with containers.

More, you have to worry about the container host anyway, so you haven't removed the need to maintain a host. You've just added to it the need to maintain the rest of the container infrastructure as well as your application stuff.

For places that have not solved the "virtual hosts should be virtually free" problem, containers are quite welcome. You can get going with them quite quickly. If you have already solved that problem, they can look an awful lot like just more work.
show a code sample before your whole manifesto
I think serverless will be included in the k8 or competing product replacing it out of the box.