skysight-inc/HackerNews huggingface dataset:
> In Go, if a function returns an error you have to explicitly handle or suppress it. Otherwise code just doesn't compile.

ah, yeah, great idea. in practice this just means that most Go projects are minefields of

if err != nil { panic(err) }

or

if err != nil { return err }

ie a manual & repetitive implementation of assert for the first case and manual & repetitive implementation of an exception call stack for the second. thank you very much, I'll take the automated version known as exceptions instead.
There are a few issues with NPM that make this kind of thing especially easy/lucrative:

- An ecosystem of massive amounts of transitive dependencies increases the number of people you need to trust. If I wanted to attack a project that used NPM, their package.json dependencies would be a really good place to start. Find the least popular transitive dep they use and email the owner to see if you can be a contributor (repeat for all of their xdeps). If they don't immediately give you publishing rights like OP did, then show some chutzpah and make valid commits until they do. While this attack works on any programming language's dep system, it's easier the more transitive deps a project has. People ITT blaming the OP don't understand this attack always works on a long enough timescale. Do you think there isn't someone out there who would make high quality contributions to an xdep of primedice.com (online gambling site) for 5 years to finally get publish access?

- Anything may run during `npm install`. npm install supports an --ignore-scripts argument to not run any scripts during install. This should be the default.

- Unqualified module names make it more desirable to "take over" a package than just publish your own package "npm install <username>/event-stream", so it contributes to an ecosystem of ownership-transfer that's far less likely to exist on, say, https://package.elm-lang.org/ where everything is qualified by a Github username.

- NPM website doesn't show you source code. The github link on the project page is just a convention. I think the NPM website should have a light source code browser of whatever is in the tarball that you download and execute during `npm install`. Bonus points for reproducible builds from that source.

- Developers don't actually review every bit of code they use and execute, especially not transitive deps. And we certainly aren't going to bother to download the tarball from NPM and unpack it to inspect the code of every dep. Most people reading this don't even know how to do that.

I've thought of some ideas to help the situation, like creating a Github shield that verifies that a conventional build script like `npm run publish-build` reproduces the tarballed code on NPM, but then I would just be doing free work for the NPM organization, and it's still just a hack.
Please substantiate your own open source projects at any and all sizes so that we may, too, cast aspersions on your relationships with governmental agencies. I'm sure that will improve things mightily.

This is a community problem based on insufficient incentives and the way that the software development community is content to allow individual labor to replace community efforts and you, as a member of that community, are kinda pissing in the pool right now. If you can look past the initial dismay, this is a time for the software development community to look in the mirror, not to pick up your torches. It's a project that he hasn't touched in years. Why should he care? What are you doing to make him want to?
GM to slash jobs and close eight plants
This may be irrelevant but I'm curious why he chose a picture of himself to be at the top of his article? Seems completely irrelevant to the story but makes me wonder about him.
> You do realise that Bitcoin is experiencing much more inflation in its supply than the USD or the EUR, don't you?

So, I argue that it seems likely this would happen; someone will figure out how to fractional reserve the stuff, the gain is too great. But do you have evidence that it did happen? what was the mechanism?
you forget how seriously lazy developers are, remember left-pad?
Airbnb Hires New CFO from Amazon
And yet forcing the caller to deal with errors still doesn't prevent improper state in any way.
I don't even see any moral issues here. Is there any reason to believe the original author acted in bad faith? If you sell your used car and it gets used to rob a bank, did you act immorally?
> How does the company collect feedback from customers?

I’ve read quite a few of these guides and they mostly focus on equity/benefits but I think product/market fit and feedback loops are a treasure trove for job seekers because they can show you the future as well as how focused the founder(s) are.

As a founder I’ve never been asked about feedback loops and rarely get asked about product market fit. We’re not technically a startup anymore, so that could be why. But I think those are useful questions for any company that isn’t a household name like Facebook or Apple.

What you should be looking for in an answer is whether it sounds like the company knows who it’s serving and is actively working to understand that audience even better.

Regardless of valuation, rounds of VC, or the flavor of popsicles you can find in the fridge, fit is what will ultimately get success. In my opinion/experience.

P.S. - understanding everything else is also super important for _you_, but this is important to understand to tell if there’s a future in which those would be worth anything.
JuxtaPiton:Heterogeneous-ISA Research with RISC-V and SPARC FPGA Softcores
To be honest, I am not entirely certain. I suspect it was simply access to a straight-cut header. As far as I know it isn't and never really was a problem to let the wheat dry standing up.

EDIT: The farm has been through three generations . . . things evolve over time.
As a Musk hater, let me clarify:

* My view about Elon Musk is net positive. He has serious failure modes and his seems like asshole as a person, but he can also do interesting stuff that lives past his companies.

* My view about Musk fanboys is completely negative. They fill discussion forums with discussion that is fit only for sports fan or religious people. Only positive thinking or you are a hater.

It's actually good that he says that people are going to Mars to work themselves to death and die in accidents etc. Because when others try to say it, Musk fanboys are thinking they can play computer games there and the main issue is boredom.
What this article tries to tell is that using DuckDuckGo is just a one small piece of bigger puzzle, not that DuckDuckGo tracks you.
That just looks like a convenience function to me. Rather than passing 1,2,4,8,16 in as the value of N, you pass in 0,1,2,3,4. Has the benefit that it's not possible to pass in a number that's not a power of 2 (which might not be valid, I don't know how scrypt works).
Pretty sure that Amazon and Apple registered their names quite early in the internet frontier days when domains were not very expensive. Not sure what Nike paid, but they were already a huge company by the time the internet came along. There's a big difference between a conglomerate dishing out a large sum vs. a series A startup.
That would just record the total neutron flux. It won't form an image unless you have a lens, aperture, or something similar.
It's attacking a particular package -- some package out there depends on ps-tree directly or indirectly, and its description is the secret key.
Canada. Well, the US is using national security as a reason to urge people to drop Huawei. Meanwhile it's an obvious economic as well as soft power play.

In recent years we've had several trade disputes with the US, illegal immigrants pour in to our borders from the US, and US sponsored environmental activists have disrupted many of our natural resource industries.

So can't say I'm too keen on the US attempting to restrict our trade with China who, for all their faults, haven't been a bad partner.
There should be well known best practices to signal that a repository is not maintained. Example: archiving the repo (it becomes read only). Then somebody forks it and updates the NPM registry with the new repo.
We at Nanonets have been building a lot of Machine Learning models for drone based image analysis. A frequent request from our customers is how do they use our models to do real time analysis. So we decided to create a how to on building real time object detection using a DJI drone.

Also useful if you're just looking to get the video stream to your laptop/computer.
It would be nice if we could pin libraries to a particular maintainer, as well as a version.
Flash to a empty cartridge for DS/GBA/NES. There is no lockout. The GBA homebrew scene especially is actually quite active.
"Hey! This random piece of software I found under the table at the pub does not have my best interests at heart?! My feelings are hurt!"
A lot of haters here, while Space X is launching rockets on rockets and selling Tesla like hot cakes.

If the design changed radically, it did change radically, I guess we'll again be amazed when it'll be revealed.

Being good at marketing is essential for keeping people interested in space exploration in those dark times.

I'm sometime very tired of the pessimist sentiment here.
https://reproducible-builds.org/
Well, it would not happen if people used Elm :)
This is a mental comparison. Leaving aside police gun deaths because that's it's own insane internal logic/world, do you think that black people in the US don't have more rights than Chinese citizens? So for example, what do you think would happen in both countries if a senior party official punched you on the street?
Of course he was under compulsion - but I seriously doubt that anyone involved had a gun on them.
Why would you think OCaml can't do that as well? opam lets you build from source with "zero configuration". We don't use it because we have invested heavily in autotools and want to integrate with many other programming languages, but the option is there.
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :)

* : Last I checked, the two most popular Linux distros I'm familiar with (CentOS and Ubuntu) only make their iso hashes available via http-only served files that are GPG signed
+1 for Fuzzy searching with Sky Scanner.
The real issue is surface to volune ratio of the contained plasma. This needs to be as small as possible for the containment to be effective (reduced energy losses through the surface area). So you want your reactors to be as big as possible.
Putting it on paper does not make it so. A single lawsuit and you could easily be out thousands even if you win.

The legal outcome could vary widely state to state and nation to nation.

If putting a blurb in a text file makes you feel safe about being sued for negligence you haven't considered all possible venues.

Here is an article about liability waivers

https://www.enjuris.com/blog/questions/liability-waivers/
End-users are harmed and are not licensees, and so, even if the license disclaimers are effective (boilerplate disclaimers are often broader than the law of some jurisdictions will give effect to) the claims they would have for negligence would not be covered (and would not be transferred to downstream maintainers, who likely have concurrent liability, absent a indemnity clause as well as a disclaimer in the license.)

So, while I don't think the upthread claim was about the maintainer having legal responsibility, I don't think it would be entirely wrong, even with the license text, if it did.
You realize that automated credit scores are a thing in the US right? China is taking the concept a step further, but it's not unique to them
No pressure vessel required. Meaning no explosion possible. Intrinsic safety by design.
TiVo has a lifetime subscription but I assume most people go for the monthly.

Most consumer-oriented services (Spotify, Apple Music, Netflix, etc.) could be sold with a lifetime option but I suspect the balance sheet liability would be unattractive to most companies and the big upfront payment toward an ultimately unknowable future service would be unattractive for most consumers. (Will the company still exist? Will I still want the service? Will the company come out with a new and better service and put the one I paid for on legacy support?)

>Even buying music and movies outright has become increasingly tough to do.

Really? I admittedly don't do it a huge amount but my impression was that CDs and DVDs were still pretty readily available for purchase on both physical media and digitally.
Bagels Are the Best Ring-Shaped Breakfast Food and I Will Brook No Other Opinion
then we might want to question why the community sees silently pulling in updates as "best practice". Is it?
Seems like a double-edged sword.
That doesn't look that far off from what you'll see in generated code, e.g. something like babel could easily output the lines you've pasted.

The rest of it is extremely dodgy, of course.
It's just doing 2^logN...
A reasonable position -- and obviously better in this case -- but in general I'm not sure most people agree. The overwhelming majority of the time maintainers are not malicious.
Reading the comments I wasn't the only one thinking WTF did I just read.

He tries to justify without anything tangible. Well the company is built on intangible things anyway.
> An Assange prosecution could give the Trump presidency broad new powers to put Trump’s media “enemies” in jail, instead of just yanking a credential or two

I don't understand how a prosecution of something completely unrelated to what he has done on/with wikileaks automagically translates into donald having 'broad new powers' to start throwing journalists in jail. If Assange is blamed for and/or convicted of some sexual misconduct or whatever (again, unrelated to his 'journalism' work), does the author think that all journalists are guilty of this and subject to imprisonment?

Edit: thanks for the explanations. I look forward to the incoming HN bury brigade, since I asked a question based on a false pretense. Such is the reddit^H^H^H^H^H^Hhackernews way.
No one knows what it does but we do know that it seems to execute some encrypted bytecode. This seems remarkably unconventional and likely a good way to bundle malware.
Allowing the first person to express interest to "adopt" your project, seems to me to have all the same potential bad outcomes as allowing the first person to express interest to adopt a child from an orphanage.

For children, that's much of the reason for Child Protective Services to exist: to regulate orphanages and adoption agencies such that they will thoroughly vet prospective adoptive parents; and to establish and regulate a fostering system—pool of known-good temporary guardians (foster parents) that can take care of children temporarily when no vetted-as-good outsider can be found to take them more permanently.

Now imagine a software org that acts on abandonware software projects the way a CPS-regulated orphanage acts on abandoned children. Start by picturing a regular software foundation like the ASF, but then 1. since all the software is currently abandonware, the foundation itself steps in and installs temporary maintainers; and 2. since the foundation's presence in the project is temporary, they seek to find (and vet!) a new long-term maintainership to replace the existing one.

Of course, that level of effort is only necessary if you care about project continuity. If it's fine for the project to die and then be reborn later under new maintainership, you can just let it die.
I think OP was asking in regard to individuals from anywhere else in the world visiting countries anywhere else in the world besides US (or NATO). The question you could ask is which country would bomb people with drones based on cellphone metadata? https://motherboard.vice.com/en_us/article/d738aq/us-drones-...

I get the whole point of we at least have the freedom to discuss this but it doesn't work without its hiccups. https://en.wikipedia.org/wiki/Laura_Poitras#Government_surve...
> That's just plain irresponsible. He must have known how popular the library was. Taking ownership of browser extensions and common software libraries is becoming a very popular attack vector. Owners of these need to be a little more diligent when transferring ownership.

I'm sure he would do it for $150k/year. He won't do it for $150k/year? Increase the price until he says "Yeah, sure I will maintain it". Or maybe he will find someone else would would maintain it for that money.
Microsoft Pulling Even with Apple in Ranks of Biggest Companies
In the current system, when you get to see the reviews of your paper, there are still the same challenges for anonymity and ugly consequences that you’re pointing out. Perhaps even to a greater degree, because the information is “leaked” through gossip rather than in a formal process.

If all reviewer comments were collected and then published at the same time to prevent them influencing each other, how could that make the situation with respect to “frank and honest” reviews any worse than it is already?

Are there entirely secret journals where nothing is accessible to non-contributors, for the same reasons? I suspect the answer is no, which is why these feuds often play out in attack-counterattack sequences of published papers.
Esri and Winning
This must be the fifth incident that could have been readily prevented if npm simply required signing for it's packages.

Just do the same thing we have for SSH: on first connection (installation), ask if you trust the other side. That goes into your authorized_keys (lock file). If you connect again (update) and the key changed, print a big scary warning. No blockchain needed.
I'll also second this. Not as clean or orderly as the DC metro, but for the most part the NYC subway was easy and simple to get around in.

Only time I've ever been jumped or harassed on a train was in Madrid.
Sounds super great! Congratulations on your anecdotal experience which means absolutely nothing in this context. I just hope a wide-eyed college grad doesn't come across it and influences his/hers decision about joining.
IIRC scrypt is only defined for powers of 2 for N.
npm does vetting?
"And then I learned about error propagation using the question mark operator in Rust:... Arguments can be made about creating custom error messages at each call level, but is that really necessary most of the time?"

Actually, one of the things that has prevented Go from "simply" or "just" solving the error propagation problem is precisely the recognition that in real code,

if err != nil {
return err
}

becomes problematic at scale, because it obscures the history of the error. Stack traces are great for humans, but not terribly useful for programmatic interpretation. Personally, I still tend to use "if err != nil { return err }" as my sort of default sketch implementation, but I find it is very common for many of those to grow something else before the program ships, and I'm still not all that great or consistent about layering errors properly anyhow.

I'd suggest to a lot of people that it may be worth reading or re-reading the Go 2 error proposal [1], and to try to come at it with some relatively fresh eyes, rather than reading it for "does this precisely conform to my preconceived notions about what error handling should be?" (Another interesting aspect is around providing some base API for errors, and processing composite errors, rather than expecting end-users to do all the definition [2]. Personally I consider both important.) There is some legitimately interesting discussion and work around what to do, based on waiting to gather a lot of data about error handling before just slamming a solution into place, moreso than may meet the eye. I can't speak to Rust's solution in practice, but having used Haskell for a long time with union types for errors, I can say they are hardly error-handling nirvana there. If I'm reading the Rust documentation correctly, they're going to have the same problems in Rust as they do in Haskell.

[1]: https://go.googlesource.com/proposal/+/master/design/go2draf...

[2]: https://go.googlesource.com/proposal/+/master/design/go2draf...
I hope everyone talking about motel responsibility are donating to all the open source projects they depend on. If not I find the moral preaching a bit one sided.
Reading between the lines, they had an existing app with some name recognition, probably following a bunch of advertising spend for that brand.

The mistake they made was not bothering to choose a branding friendly name at the earliest stage. But they made their bed and this is them lieing in it.

The fact this required reading between the lines shows this is a terribly written article.
What Is ReactJS? – Codementor
Why would someone update to a new version of a dependency if they don’t trust the new maintainer? Can’t you pin dependencies to a particular version with npm? In my world, you should have a really great reason to update a third party dependency—“there’s a new version” is not a sufficiently good reason.
Except you don’t pay Google for views, you pay for clicks. So it is in their interest to show things that convert.
Just to toss in another: I first thought book cover, then later the full "Cover.com" (including the capitalization) makes me think of makeup.
It does if they don't handle the exception, which is the situation being described.
This isn’t true. This is a valid program, after all—even though fmt.Println returns (int, error):

func main() {
fmt.Println(“Hello”)
}
Ya, it is really sad that nothing positive ever came out of Space X or Tesla.

/s
If I thought I might be on the hook for damages caused by a mistake in how I run an open source project, I would never open source anything.
What vehicles are they competing against? The Volt and the Leaf? Again compliance cars, these vehicles aren't trying to dominate a market but rather counteract fleet inefficiencies elsewhere.

Tesla is the only manufacturer right now that's 100% committed to EVs. Everyone else is either making compliance cars or legally obligated to dabble.
I can't wait until code augmented with general formal proofs (not just types) becomes mainstream in e.g. kernel modules.
FBI Created Fake FedEx Website to Unmask Criminal
Mono is required, but all my libs are on .NET Core now, so is only as part of the deal. I use Visual Studio Mac.

The repl is not great, even on windows. F# is not the kind of language for a great repl experience, imho. I rarely use the repl anyway (the only one I use regulary is the python one)
I think it's worth asking whether Apple's 30% cut is too high, and worth asking whether they would still be able to have that cut if there were official ways to load commercial apps onto iOS devices other than the App Store. (By "commercial" I'm explicitly excluding enterprise software and TestFlight.) But I don't think it's the question that's going to be answered by this court case, whether or not that was the original intent of the plaintiffs.
IMHO there are only 2 long-term solutions to this type of problems:
1) Reduce the number of external dependences as much as possible
2) Pay authors to properly maintain the packages that you rely on. If you use them on commercial projects it's the first and the cheapest possible security measure you should invest in.
Unfortunately, one of the things that makes JS dev pull in so many deps is that it lacks a decent standard library. Meanwhile, the Go standard library is amazing!
When that happens, pay people.

Seriously. Having a moral discussion in tandem with scale seems very poorly misaligned with the interests, needs, risks of pretty much everyone involved.