skysight-inc/HackerNews huggingface dataset:
Is there even a generalized guideline on how to handover npm packages?

It would seem like common sense to let something die and let any new interested maintainers fork the project thank to just wantonly hand it over to a complete stranger. But I could easily see someone getting into the habit of trusting people and not thinking about it too much.

Maybe a combination of better guidelines, some kind of code of ethics along with better means of communicating these changes through npm would've helped this issue a lot more. If not to actually prevent the problem then to at least have some ground to hold people accountable other than accusations of people should know better.
Hello :-). My method???
> If you want your startup to run for more than a year

I've never seen a start-up fail on account of technical debt. Re-engineering is expensive, but it means you have something worth re-engineering. I've seen lots of start-ups fail because money that should have been spent attracting and retaining users got burned on an elaborate engineering process.
I'm considering making an alt-chan that cyclically purges content.
> just `apply` things back into compliance

If your things are wandering out of compliance by themselves, you have bigger problems, imho.
For some reason, I don't trust google at all for anything...
Hired a business student to process Comstock satellite feed, asked "Can you program in C++?" "Yes," he lied, "can I come in this weekend to get a head start?"

He learned to program in C++ that weekend and hit the ground running on Monday. Two weeks later he came to me, asked "What is this 'new' and 'delete' stuff about?" I told him, he said "Wow that would be really handy".

Anyway 5 years later he was a Fellow at Adobe.
LOL this comment thread, what is everyone even talking about? people fighting over different vr headsets and whatever size phone they prefer in the context of a powerpoint presentation hah
Yep. I submitted it with "Dominic Tarr’s Statement on the hacker hijacking of the event-stream NPM module", which was as descriptive of a title as I could think of quickly.

It looks like the moderators have dinged the submission and changed it to: "If it's not fun anymore, you get nothing from maintaining a popular package" ... which I think we can all agree is generic, and fails to make the connection to the big news of the day.

It may just be whispering into the wind, but if the mods are listening — how about "Dominic Tarr: statement on event-stream compromise", which uses the Gist's description, and helps folks know what this link is all about?
our most impressive hire was also our biggest headache.

he was really smart, quick, nice, and had an answer for everything.

unfortunately he also couldn't accept things "just working." everything (in his eyes) had to be built to near perfection, and he would go on and on about how various systems needed to change/be re-written.

after we continually refused (as a group) to adopt his suggestions, he left the job for something else.
> Criminals have more rights than children.

I was in SF for a job interview a while back. Got off at Civic Center BART to meet a friend. Hoooooooly Cow! I'm not sure about 'rights' per se, but I saw at least two people shoot heroin up, in broad-daylight, in the middle of Market Street, on a Thursday, round about 1pm in the afternoon, not even 20 feet away for at least five uniformed SFPD officers. The officers did nothing. My friend says that's kinda how it is.

https://sf.curbed.com/2018/6/21/17488516/farrell-civic-cente...
Trump suggests US could slap 10% tariffs on iPhones
Can I run WordPress on it today?
Chinese Scientist Says He Used CRISPR to Create Genetically Modified Babies
Any chance someone wants to do a benchmark to compare the performance of this to other PHP implementations?
Google pays $1B for huge Mountain View business park
How to stream pinball
Who said anything about eliminating all large-scale rural farms? (And FWIW what I imagine would still very much be commercial farming)

Even barring any future innovation in city planning (better distribution of sunlight, etc), architecture (tiered building design, whatever), and agriculture (crops optimized for greenhouses), we would still benefit from growing food on rooftops, so why wouldn't we?

Oh and by the way, you can use electricity (realistically from a mix of renewable and nuclear power) to keep "sunlight" on in your greenhouses; they don't need to be on rooftops.

I don't disagree that it doesn't scale vertically nearly as obviously as it does horizontally, but why make perfect be the enemy of better?
we are living in a time that without noticing it we are focusing on the quantity, not the quality of our connections. how can we shift our thoughts and senses to the latter?
To an extent it's because his name is in the repo name (dominictarr/event-stream) https://github.com/dominictarr/event-stream so he is an easy and obvious scapegoat. But it seems people in general forgot that they are not paying and are not entitled to any sort of support.
The MIT license isn’t as bulletproof as you think it is.
It wasn't all that long ago that Google shut down Google Code. They said: https://opensource.googleblog.com/2015/03/farewell-to-google...

> After profiling non-abusive activity on Google Code, it has become clear to us that the service simply isn’t needed anymore.

And now they've created a new product which does pretty much the same thing... Wonder how long this one will last.
Never. I prefer tenkeyless.
What are the ethics? The developer isn't interested in maintaining it. Someone else was. So the developer gave it to that interested party.

I feel like 90% of the open source libraries I've written are maintained by someone other than me now. If that's considered unethical, next time I'll just not open-source it.
If "clickbait" is writing enticing headlines, sure, I'm proud to be "guilty" of that, but the usual definition of clickbait is if the article contains no substance. I hoped that timeline and reflections would add value though. If you want to write a blog post called "Why C# sucks" if you feel the language and ecosystem specifically enables that go ahead. I don't really understand your hostility here, and I'm sorry if you feel I wasted your time with the summary. I'll choose not to engage further with you at this point as I'm not finding your feedback constructive.
It has not been my experience, coaching/advising a bunch of people through interviews with tech companies over the last few years, that most of this information is hard to get.
So you are saying that PHP is dying since 2004. That’s ridiculous. There are new languages and more alternatives today that’s it.
Hmm, the cause does matter. If customers want it and you're not giving it the risk is they'll go elsewhere to find it; that's why it is sold in that way, to apply pressure: "if you don't do this you'll lose customers" hits the businesses who are already succeeding.

If it's "other companies are selling the idea to customers that they should move to a subscription model" then the company you're pitching your subscription service assistance to can decide to promote the purchase model instead of going along with convincing customers to buy in a different way.
Uber's New CEO Just Sent an Email to Employees and Taught a Major Lesson
My biggest complaint with Google Cloud's UX, which applies to their new Cloud Source Repositories opt-in UI: They shard out so many of their user experiences into different websites and domains.

Under the umbrella of Google Cloud you've got Google Cloud Console, Firebase, Stackdriver, Source Repositories, Dialog Flow, probably a couple others I'm forgetting. Almost all of these have entries on the Google Cloud Console which open a new tab and link you to a new website.

It makes keeping track of where things actually are extremely difficult. For example: Firebase functions on the Firebase UI are also Google Cloud Console functions. The old Google Cloud Datastore product, which lived on the Console, is now Cloud Firestore on the Firebase console. Stackdriver logging used to be on the Stackdriver UI, now its on the Cloud Console, but there are still references to Stackdriver all over that product, and they continue to invest to Stackdriver (Istio service maps).

AWS does this a little bit, in four or five of their hundreds of products. Lightsail is one example. Azure does this a little bit as well (DevOps is a separate page even though its essentially an Azure product).

GCP is the worst offender. I want to see a better unifying vision for what being a Google Cloud customer actually means, instead of all these confusing and isolated experiences.
So there's a couple of things going on here. There basic biology, which is that we've evolved to have a really long childhood. We're 24 before myelination has mostly taken over our brain, greatly reducing it's plasticity. You can think of myelination as the brain spending energy to cement synaptic pathways that have so far proven to be useful. Now, new synaptic connections need to compete with existing connections, which I suspect actually takes more energy to form, and thus feels more effortful when learning.

Aside from biology, I suspect we have a hard time learning new things as we get older for similar reasons that other computer learning gets harder with age. At some point each new piece of data represents a smaller percentage of the total data gathered. Which is to say, that if you're trying to generalize something each new data point can only move the average/median by a smaller and smaller amount. As such you need to spend more and more time feeding in variants of this new data to have any hope of it having an effect on your model. This can be seen most painfully, if you take something like a neural net and try to train it to do something other than what it was initially trained to do. You're not going to find a chess playing NN, that will be able to then learn to play go any time soon. And if it did learn to play go to any decent degree, it would probably no longer be able to play chess nearly as well.

But, aside from all that, that doesn't mean you can't learn as you get older. Brains are far more plastic, even into old age than we once believed. "You can't teach an old dog new tricks" has been empirically shown to be false, time and time again, especially as we get more and more FMRI data from older people.

I will say, that what others have talked about in this thread, is that there are obstacles other than biology that get in our way for learning. Sleep is a big one. Sleep is key for long term memory formation. If you're not getting enough full REM cycles every day, learning is going to suffer greatly. Also things like adult obligations can really get in the way. There seems to be some growing evidence that people's achievements severely dip in their 30's and 40's, which coincides with raising kids, or caring for aging parents. But mostly, in my experience, seems to be sort of a peak for social obligations that can't easily be blown off. There are times when I'd like to stay home on a sunday night, and make time and space to do something new and difficult, but instead have to go to the inlaw's for dinner to maintain that relationship. And as cliche as that sounds, I like my inlaws, so I make that a priority. Eventually, people die, or move away, and maybe you can work fewer hours, and learning can get easier again, largely because you have more large uninterrupted chunks of time. I hear many anecdotes that musical instruments, of all things, are something that retired people get really good at, relatively quickly, because of the time they have to practice.!
I think these are all reasonable questions to ask a startup with no established reputation. If all you want is a 30% increase, these startups are probably not the fit for you to begin with.
Yeah, they worked amazingly well at stopping some terrorists.

Let's see them stop me from procuring a weapon.

FFS, even my ISP is more of a problem than dust sensors.
Why wasn't NPM monitoring for this kind of behavior? I guess it wouldn't catch all bad behaviors but this is just asking for it.
> Well, if you only look at a 12 month period, then it might look like "bitcoin is dying" ...

Not dying yet (I wonder whether it will ever die), but "fading away". Which seems obvious, but hey, let's hope for another bubble!

> It's about sound money and financial autonomy. Demand for these is only going to continue to increase, particularly when far-left fintech companies are actively pushing people towards it, by refusing to conduct trade with people who have "wrong" political opinions.

And here comes the "economics theory" behind btc. Especially "sound money" is always fun to hear ... Nothing sounder than wildly fluctuating speculative asset! And people will demand it for sure! (or someone is paying for anything legal with btc again?)

I am not sure why some people keep believing in this. I-cannot-be-wrong syndrome?
The vast majority of developers don’t know what those details are

Let me fix this for you. Vast majority of developers are actively denied access to the infrastructure by their managers. They pretty much know everything what an infra eng knows (and even more, after all all this catchy cutting-edge apps like Kubernetes/Elasticsearch/etc. was written by them) or even more.

Blame the managers and no-one else.
If you have your list of possible errors, it really shouldn't take that long to write a `errorObj -> string` function.
For what it's worth: it'd be undecidable to catch all vulnerabilities even if you very precisely define the semantics of your virtual machine, because it'd require knowing whether a certain line of code will be executed, which is known to be as hard as the halting problem. Practically, maybe? Maybe one can use ML to check codebase for suspicious code. But in an ecosystem like npm no matter what protection you have against hackers, someone will try very hard and inject vulnerabilities like this. You should defend yourself and use checksums for deps and execute only trusted code.
Then mark the project as abandoned and add a note suggesting the new volunteer’s fork.
I stopped coding long before I ever got proficient enough to say I was a “coder”, but have spent enough time struggling with “intro to x” beginner code writing courses to get a hint of what goes on when writing programs.

I’m presently going through something similar to the authors situation as I’m migrating my leads into Microsoft Dynamics and learning to make the platform for my use case (real estate brokerage). It’s not “infrastructure” but it’s the foundation for my business

I can say that even something as simple as correct implementation of software is not something that should be done at speed, or without serious consideration towards portability.

For example, because I’m solo and also working another full time job, my emphasis is on completing the migration ASAP energy though I’m aware of small errors in the database that might bite me later.

Also, while I’m comfortable with MS’s record of maintaining enterprise software, it’s slightly suffocating to feel that I will effectively loose my time investment should they decide to abandon Microsoft Dynamics
“Pattern Recognition and Machine Learning” by Chris Bishop is now free
It's strange that I can tell by the way they write. I'm not always correct but many times I'd find someone writing as if they were an expert but you could just tell they were only regurgitating something they read. They couldn't make a proper connection between things they were saying. I'd trick them in a way to reveal their age and way too often it was 15 to 17 years old. Sometimes 18 or 19.

You can also read them saying they wanted to take CS when they graduated from school so you can glean from that they are probably in high school.

Or I just flat out ask them (or accuse them).
I think with "single responsibility" he means the packages. So instead of complex packages that are hard to maintain they have lots of smaller packages that are easier to maintain. So a single person can maintain several packages.

Not saying that I think maintaining hundreds sounds like a good idea, just trying to point out the misunderstanding :) .
No: https://github.com/MagicalTux/goro/blob/master/README.md#tod...
what you are referring to are the top 1% of researchers in their fields from whom you constantly hear about. the other 99% which account for the majority of grant money just keeps peddling nonsense for a living just so you can hear about their brand new idea of a dark cosmic gluon that could be produced by a yet unforeseen backreaction 10^18 ms after the big bang. give me a break. not that it's entirely their fault, given that it's either that or they'll be shunned by their "scientific" peers.

I'm all for space exploration and pushing the boundaries of humanity. which is why I'm rooting for companies like Space X or Virgin Galactic, not a relic of the cold war that keeps sending over-funded space junks in orbit so a bunch of cowboys can study how the respiratory cycle of frogs are affected in zero g.
Company is Twitter
There is also this to consider

https://haydenjames.io/80-percent-web-powered-by-php/
Fortran is still a thing
AFAIK, GSR is really intended to support cloud deployment. So not a replacement for Google code.

I think the assumption is that most folks will use github / gitlab , etc. as their primary, and mirror to GSR for deployment.
One day some part of not all will shutdown and disappear and where is your sources again.
There are no engineering questions on this list, and the more I think about it, the more correct I think that is. Unless you're stretching the definition of a startup, most of what passes for current engineering is volatile and subject to lots of change. Better to ask questions about the team and their experience so you know what you'll need to build.
Would you mind elaborating on the cognitive burden you find Rust imposes?

I find that after roughly two years of writing Rust, I can architect and re-architect big projects fairly clearly, and the type system gives me strong reassurances that refactors haven't screwed things up.

Not to mention the advantage of even simple things like enums, which most languages (including Go) tend to lack.
I've written a lot of software in my life -- almost all of it for myself, and I just never bothered to open source most of it, because if I'm going to open source it I want to make a good impression, so I want to clean up the code and write some docs and make sure it it builds ok for others, think of a name for it, upload it somewhere, etc. It's just so much easier to keep it for myself and not bother with any of that.

Despite all this, I have open sourced a couple of things here and there. Little things. Things that virtually no one ever used, as far as I know. But once I did get a very polite feature request from someone on something that I'd moved on from, so I told them I wouldn't do it.

That was more than a decade ago, and I still think about it and feel kind of guilty for not doing it.. even though I know I have nothing to feel guilty about.

I can imagine being the author or maintainer of a popular package must be like this times a thousand. You have to put up with so much negativity and pressure from people who demand you do work for them for free.

I feel for these people. Anyone who spends even the smallest fraction of their life to give a gift to the world does not deserve anything but praise from those who benefit from it.
> How would you resume execution at the panic point?

You invert it: rather than panicking, then continuing from the panic point if things recover, you proceed, only panicking to perform a transfer of control. Interestingly, this is what Lisp does: SIGNAL[0] (the most primitive function) just looks for applicable handlers and calls them from most- to least-recent; this means that if a handler transfers control (panics, in Go terms) then the condition has been handled; if not, SIGNAL just returns NIL; ERROR[1] does the same thing, but calls INVOKE-DEBUGGER if no handler transfers control; CERROR[2] is like ERROR, but it adds a CONTINUE restart, which just lets control resume.

It’s possible to implement this same structure in Go: conditions.Signal() would search for applicable handlers and execute them in order; if control transfers then it’d never return; conditions.Error() would invoke one or more handlers, or the debugger, and would never return; conditions.ContinuableError() would invoke one or more handlers, or the debugger, but might return.

The key is that it’s possible to execute a restart in the dynamic context of the signalling function (via use of Go’s context.Context), and only rewind the stack when you don’t need to go back down it. I think — I’ve not yet implemented it!

0: http://www.lispworks.com/documentation/lw71/CLHS/Body/f_sign...

1: http://www.lispworks.com/documentation/lw71/CLHS/Body/f_erro...

2: http://www.lispworks.com/documentation/lw71/CLHS/Body/f_cerr...
Coverage.py 5.0a4: the sys.path to hell
Of course, sequential code is simple. Overflowing additions don't have anything todo with the code. They overflow or not.

> Usually code looks simple only because it ignores errors..

No, it looks simple when the structure is right. There are other error handling strategies than "handle it now, or pop the stack frame and let your caller handle it now!". But with exceptions that's all the choice you are given (unless you convert them to regular data).

Since exceptions strongly discourage alternative error handling schemes, no wonder they lead to unmaintainable code as soon as a considerable amount of conditions actually should be handled, instead of just bailing out.

> As for sequential, we're in the age of multiple cores and GPUs..

What point are you trying to make? Obviously what I mean by sequential code here is that you can easily reason "if control flow reaches point A, then B will be executed, too".
> I want to see a better unifying vision for what being a Google Cloud customer actually means

The thing you've got to understand is that none of these products are "Google Cloud" products. They're Google services (or, even moreso, services of random third parties which Google has acquired) that you happen to be able to hook into from your GCP project and access through the GCP CLI.

The closest comparison I can think of is Heroku's "Elements", which are third-party offerings (usually of their own services, with their own service dashboards and everything!) that happen to be subscribe-to-able and high-level-configurable through Heroku's dashboard/CLI.

Except, in this case, many of the third party "elements" that are subscribe-to-able and high-level-configurable in GCP, happen to be created by other departments/sub-companies of Google.

Still nothing to do with GCP, though, any more than a random Heroku Element has to do with Heroku.
Automated integration testing
Its hard enough to keep roofs watertight. Add wet soil for months at a time and the corrosion, leaking, mold etc become a problem.

If you want a farm, put it on a farm. If you want a solar generator, put it in a clean well-lighted place. All this hybridization (rooftop farming, solar roads etc) is not sound engineering.
thank you for writing this. It makes me reflect. As I grow older, I realize more and more than connections in life come and go. Life is really a passing of many different people in your story. Some will stay for very long while some will only be there for a short bit of time.
Hah. You can lose people hundreds of millions of dollars worth of assets and because it is magic internet money and not real money, you are coding instead of in jail.