skysight-inc/HackerNews huggingface dataset:
Most MOOCs from what I've seen are so basic to even take seriously. For example if you are learning some course called physics 101 which claims to be equivalent to college level. The real physics 101 in the classroom will be comprehensive in the sense that you learn all the material over 16 weeks by studying 15 or so textbook chapters - the whole subject in detail. The MOOC on the other hand will only cover the first 3 chapters or cover all 15 chapters but only the absolute basics of each chapter. The worse part is people take these courses and think they have a physics 101 understanding of the subject when in reality they only have pre-physics 101 introductory knowledge. It becomes really obvious what their knowledge level is.

I like the idea of MOOCs but there is a very serious quality issue with them at the moment, even the MOOCs from big name universities are a joke.
I read this: https://github.com/dominictarr/event-stream/issues/116#issue..., which might seem controversial, but what was he supposed to do?

I guess just let it rot and tell people to fork.
By now, it should be obvious that your efforts to attenuate the duration of long-running content won't prove to cultivate an increase in the quality of participation.

There are (at least) three aspects of online community participation, that seasoned users are pretty well-versed in:

1. Archiving, mirroring and back-ups.

2. Leaked screen captures and scrapes
of private direct messaging.

3. Back-end aggregation of logs and
messages, even for supposedly private
SMS interactions.

Forget it dude. We all know that whatever signals get placed onto the wire turn out to be spliced through passive beam splitters and land in an open S3 bucket.

The ones that don't? Your girlfriend just screenshots it, and and tweets it out in the open for the world to see anyway. Whoops!

There are no more online subcultures. Only distortions of perception enforced by impulsive, would-be moderators.
Not really asking for perfect/decidable.

Just wondering out loud on how to detect even one of the other active exploits that are surely in the wild. This one was live for 3-4 months before it got found by luck?

For example I would really appreciate if they added something to detect/warn when a package needs eval or http requests permissions (yes, I know npm packages don't have a concept of permissions).

Anyway your commonly repeated advice on how to defend yourself isn't practical (short of not using npm). The dependency that got me was nodemon. That ought to be "trusted code" with 17k github stars, 1 million downloads per week but apparently not. As I said already, even if I did check the commits to all my dependencies, I don't think I would've caught this one. It's a one line change in the minified build file of a transitive dependency nested 4 deep. All the commits around it are very normal looking.
That's not impossible. That's just people have terrible willpower
And with hindsight knowledge of how that story ended, we can only congratulate the author on a job well done. Churches were relatively safe havens for dissent because despite fundamentally different ideology, the actual ideals were pretty much aligned. And they knew and respected that, on both sides. For a state with torture prisons (edit: and with mandatory paramilitary classes at school, almost forgot about that), a state that routinely had the army shoot its own citizens, the GDR was surprisingly committed to peace.
World map of karst regions: https://i2.wp.com/www.circleofblue.org/wp-content/uploads/20...
The ruling class of China likely operates on different principles, e.g.:

"Policies that lead to enormous suffering of individuals are quite acceptable if such policies sufficiently advance the capabilities of the collective."

So I expect the demand for "unethical" research will be met there, and perhaps the results of such research will be "laundered" for public consumption (maybe with a process akin to parallel construction).
(this was me plopping into the real world)
If someone pays you a lot of money to program and are happy with the results.
Unfortunately the new Xperia XZ2 Compact is almost the same size as the original Xperia X, with the way phones keep getting larger.
I have heard about Rust. But I wonder if you can do something that a OO programmer (like me :) would call "string subclasses" so you do not manipulate a generic type called string, but a meaningful subclass such as "FirstName" or "LastName", or "TownName".
Google isn't the ultimate source of truth of the meaning of words. When someone says that another party is morally liable they mean morally responsible. That he ought to feel responsible and act according and consider others actions in the future lest he feel like he has morally failed people in the future. Ultimately we are often and are often expected to be our harshest critic and ought not to limit our duty to others to the minimum that the law requires.
When my kid wanted to do animated vector graphics, I looked at the options. There was a $22/mo subscription option with Adobe, and there was a competitor whose product I could buy outright for $30. I went with the competitor. Two months and 10 projects later, my kid has moved on to other interests. I ended up saving $14 over those 2 months. In fact what would have happened is I would have paid for 4 or 5 months of subscription until I got around to noticing that they haven't been using it lately, then I'd have to jump through whatever hoops they have set up to cancel the subscription. With the software I purchased, when they want to go back and do a couple of more animations in a few months, I won't have to worry about restarting a subscription.
I think people are just drawing a distinction between fault and responsibility. Neither is a subset of the other.
It's half the namespace issue (the release package name sometimes needs to be added) and half that maybe you haven't agreed with some fork that you will make it the official one beforehand. Maybe there isn't even a fork like that.

Besides, projects don't usually go from active to completely unmaintained. Adding it to the Code Shelter is a nice way to solve this when you see development slow down, because you basically have nothing to lose.
Every startup that's offered me options or RSUs has told me (upon request) what percentage of the company that represents, or given me the total number of outstanding shares and let me do the math. They usually won't share a full cap table, but without knowing the total number of outstanding shares, the dollar value of a share is meaningless.

I'd just value the equity of any company that won't share this information at zero.
Every once in a while you need a signal flare, but most of the time what’s required is a lightbulb.
It just comes to supply and demand, and being competitive in the market.

Companies looking to recruit and retain specific talent got creative with compensation packages in attempt to keep wages close to market.

I first heard of this during the dot-com boom in the 90's. Companies were paying "huge" signing bonuses.

Sadly I graduated after the burst, but after 9/11, and went into the defense industry. No signing bonuses, but did have a good relocation package.
Facebook forked PHP to make Hack to try and make PHP usable.

Yahoo is yahoo.

Wikipedia wouldn't have the resources to change anything.

Google has a wiki page for their developers telling them to never ever use PHP for any google project.
>If semantic versioning always behaved as it should be

The exploit in question specifically relied on this expectation, by creating a new patch release for the exploit. Even if you could trust well-intentioned maintainers to use it correctly, there's always this risk.
In the prior race between almost nobody and almost everybody voted democrat. Not too useful.
I'd be curious to hear about your edit -> recompile -> run experience with Rust. My typical dev process is edit -> auto-recompile in the background -> refresh the browser / whatever I need to do to see how my edits affected the thing I'm working on. Rust's compilation speed seems like a non-starter for me.
It means you get to choose whether to watch men's tennis or women's tennis; men's gymnastics or women's gymnastics; men's track and field or women's track and field.

It means you don't have to deal with as much social and sexual drama between team members for team sports, which I suspect (but don't have data because I don't think adequate studies have been done) distracts from practicing the sport. This is a similar problem to mixed-sex infantry squads. You can wish for all the equality you want, but you won't get it.

It means you have many varieties of sports with women competing that girls and other women can look up to as role models or inspiration or motivation to participate in sports.
Certainly. The touch controllers and room scale makes it completely different.
Teds in 1980's East Germany - now that's something I would not have expected.
ts.hs
I'm guessing the observation "that AI was nothing more than the automation and repackaging of the output of human intelligence" mentioned above
This resonates with me, as my alma mater definitely doesn't have much (compared to the top endowments out there). It's not amount to sneeze at, but still, there are others ahead of us.
United States blocks Iran from fusion megaproject
I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork.

Then in the original project you can say “the last version of this project is N.N; here are some possible candidate successor forks, which have not been vetted”.

This way no one who is merely keeping up with version numbers will accidentally step off of a reasonably good package on to a fraudulent package.
As a user of free software you should always accept the risk that it is maintained by a malicious actor. It is just as likely that the original author will turn malicious. You as a user have the responsibility of auditing all the free software you use.
Every problem you describe sounds like a solvable engineering problem.

We may need to design our buildings to accommodate these kinds of problems, but that doesn't mean they should be dismissed outright -- The potential energy benefits are substantial.

It takes a just a small leap of imagination; we're not talking about magic.

If you take anything away from this discussion, let it be this:

> [Climate change effects] threaten future gains in commodity crop production and put rural livelihoods at risk. Numerous adaptation strategies are available to cope with adverse impacts of climate variability and change on agricultural production. These include altering what is produced, modifying the inputs used for production, adopting new technologies [emphasis mine], and adjusting management strategies. [1]

[1] https://nca2018.globalchange.gov/#sf-10
The lack of "solves this problem in a mature way" examples in the official tutorials / documentation is IMO a big part of why people think Go code is simpler.

Of course it's simpler if you ignore things. Or don't respect cancellation signals. But you shouldn't do that. And once you do, Go starts to get incredibly verbose and error-prone, and you have relatively weak tools for reducing that duplication.
I wrote a part of our product, actually invested years in it, that does a certain thing I won't say on Amazon's cloud. One day, Amazon released a competing service that does the same thing.

There was a flaw in our product that had one of our customers pushing to use Amazon's offering. Turns out Amazon's service cost about 4x what it cost us to do it ourselves. It wasn't obvious at the time given Amazon's purposefully obtuse pricing.

Eventually we fixed the bug, brought our customer back in line with the rest, saved some money, and have continued providing this service much cheaper than Amazon. I think it works for us because of a few reasons:

1. The service we offer is challenging enough that most dev teams won't want to do it themselves, they'll outsource it

2. Amazon has little incentive to charge less (see #1), little competition

3. We're small enough that we can still provide that face-to-face level of service and hand holding that's nearly impossible to get from a larger org

Amazon/Microsoft/Google may come into a particular market, but it doesn't automatically imply that they can (or even will) do it better/cheaper/faster.
> and because others who are using his work are also supposed to be similar professionals

I have a hard time believing that anyone who has built so many popular packages on npm (or any open source) also believes that the hundreds of thousands of users who install his work are "similar professionals" to him, or, even if they were, that they have built safeguards against this kind of scenario. I've barely used npm/node in the past few years and even I'm still aware of how the ecosystem makes silent changes to dependencies non-trivial to detect.

> because he's not putting anyone's life in danger

Software has real-world implications.
You joke but that's very likely to happen eventually if it hasn't already. At the very least I wouldn't be surprised if Mozilla made a prototype JS engine in Rust.
We Bought a Ghost Town
It is generally accepted that "right tool for the job" is a desirable philosophy.
You're not wrong; quite right, in fact.

My point here is less about payment guaranteeing a lack of bugs or having someone to point a finger at and more at incentivizing the team building it to fix things quickly. Of course, there's always the <Insert Negligent, Well-Compensated Fortune 500 Company Here> problem, but that's a case-by-case issue.
I operate a fast camera at W7-X. It's a normal high-speed camera that records light in the humanly visible range, and the plasma emits in that range and reflects off the walls. IR cameras are most often used to gauge the temperatures of vessel wall components.

Our camera looks through a pinhole in the vessel wall, but it sits a few meters away from the machine and gets that view through a bundle of optical fibers. There wouldn't be enough space to place the camera right at the pinhole because of the magnets and their cooling systems, and the magnetic fields would be pretty high. The camera needs to be shielded from the fields for its electronics to work properly, and the shielding box perturbs the magnets' field, so moving the camera far away is a good idea. We don't worry about neutrons, because W7-X plasmas are fueled with stable helium and hydrogen (no deuterium or tritium so far, mainly due to onerous nuclear regulations in Germany), and these fuels don't produce many neutrons at all.
You can probably just measure the entropy of literals, but then an attacker might use reflection to construct arbitrary strings. Not an easy problem.
Modern PHP's quite a bit better than the utter mess that was 4.0 or even the half-ugly 5.0. They've deprecated the worst of the misfeatures, especially by default. Now if only they'd adopted the HHVM/Hack Collections instead of the terrible arrays...
I think some people buy multiple copies or order over and over again, so the actual probability is high relative to other items (because as others have said, the total number of items is huge).

I think maybe the real mistake is that someone who is buying a bunch of copies doesn't really need the item to be recommended to them. The recommendations are more helpful for things that you can't find in the history.
Do you have any links to a high level description of how this would be hooked up to a powerplant? Would this be used to heat water as per a typical fission plant?
I thought Go was a hip to hate language also. Seems to get a bunch of grief about "missing" things. I quite like it but haven't used much beyond toy projects.
So much for "many eyes make all bugs shallow" I guess. Problem is that 99% of those eyes are turned only toward using the product of someone else's good will for their own personal profit. And 99% of the remainder are only looking for bugs in the features they use, or just aren't that good at spotting bugs. This only gets worse in environments like NPM, which make it easy for dependencies to proliferate beyond anyone's expectations, so people don't even know what code they should be looking at.

This is still better than the situation with proprietary software, but problems like these are kind of inevitable in an ecosystem where people typically write 5% of the code themselves and blindly pull in the other 95% from who knows where via unchecked package dependencies.
People keep casually making this suggestion. In JS this can involve hundreds or thousands of transient dependencies. Have you ever (1) worked on a React app and (2) vetted all of React's 829 dependencies yourself? It's not remotely feasible. The only solution becomes "then don't use React!" - is this the best we can do?
Will there be pull request support anytime soon?
I put in the work. I once heard a very good fencer say that the way they keep calm during competitions is to tell themselves that they've put in the hours of training and the blood, sweat and tears necessary to win. I spend hours of my days writing code, reading about how to become a better programmer, constantly analyzing my work and finding ways to improve. I'm not going to spend my time worrying about whether I'm a good programmer. I will be a good programmer.
This is a very complicated thing to answer concisely, but I'll take a stab at it from a product development perspective.

You know you're a good programmer if the things you build "just work." It should be near impossible to find flaws in your solutions. This is actually rare. Most developers I've worked with will declare something "done" well before all of the flaws have been worked out.
Credit report
THANKS UNIVERSAL HACK9. 5 years ago my apartment complex mailed my last water bill to the apt I just moved out of. It was before my mail forwarding was complete. I never was notified. I made the mistake of just paying the amount of $43.00 a few years later as I was buying a house and this was showing. I didn’t ask for them to delete it upon payment. I am now in the process of buying again and need to remove this. The apts have since then changed ownership and I am not sure what to do or how to get this off as it is bringing my score down but UNIVESALHACK9 @ GMAIL. COM came thru and removes it from my report after proper negotiation he also raise the score and everything is perfect now. Thanks!
> 4. If your code which you wrote few years back looks bad to you, then you are on right path.

What if the recent stuff looks bad too? :)
”There are technical reasons for this (high cost of inner interpreter overhead, lack of dynamic memory allocation, program structure that makes it difficult to work in large teams)”

I think none of those have much to do with real time, per se.

Inner interpreter overhead may affect performance, but a real time game need not perform well.

Lack of dynamic memory allocation can’t be an issue, as one can always implement it in Forth.

I don’t contest that difficulty to work in large teams is an issue with Forth, but that doesn’t affect ability to write real-time games; it affects ability to write large/complex games.
> hope he didn't write 300K lines of Terraform code.

If you look at the company, their product is providing infrastructure code, it was not a byproduct.
Go after PHP is therapy
Maybe that almost everything was destroyed in 1755?

But yeah, it's just a lukewarm book review.
I'm trying to help you make a potentially good argument stronger, not trying to shut it down. Disputing it and telling me I'm wrong (even if I am) and that electrocuting people is like JS frameworks having "real-world implications" is not going to help you with that.
Yeah, but it’s not just about Apple.
Why your F# evangelism isn't working
Incidentally this can come into play even for exceedingly popular packages. For example, consider deciding to use Babel versus TypeScript for ESn -> ES5. I am a fan of both, for different reasons and uses. Both are excellent tools, widely used, of great quality.

Babel, configured in a typical way, will have at least hundreds of (transitive) dependencies. TypeScript has none, every line of code is from Microsoft.

I have pointed this out to numerous people in the process of deciding between these tools; so far I don't think a single one has given this consideration any weight in the selection.
People in this case aren't asking for support, they're asking for the project to have been given to a trusted maintainer or declared abandoned.
lftp is fantastic. The mirror function has a “reverse mode” too

For regular tasks you could also look at “rclone” which is like rsync in many ways but can upload to s3, backblaze b2, sftp and any more directly. Without remote support.
I'm really surprised that nobody has mentioned ImageNet and its use of Mechanical Turk (Amazon crowdsourcing platform) to label 14 million images [0].

[0]: https://en.wikipedia.org/wiki/ImageNet
Makes you think how many backdoors out there like this.
Yes but then you have someone culpable for their mistake.
Have you ever created a package that people started to use, which you then had to maintain for purposes that didn't do anything for you and then no longer even need the package? Pretty much any rando offering to take over maintenance is going to be welcome to it compared to the dozens of requests and insults offered as bug reports.
To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintainer to a malicious one.

Edit: Clarified second sentence.
> It should be near impossible to find flaws in your solutions.

The number of open issues in most OSS repos would make me hold my tongue before saying something so farfetched.
> A majority of the web still runs on some variant of PHP, and that guarantees that it's not dying anytime soon.

The same is true of Perl, but (depending on your definition of "not dying") it's not clear that Perl isn't dying.
I'm not sure I follow or agree with your first premise RE war on drugs. (The 'why')

But I do agree on your initial steps for restoring public faith.
Has anyone noticed how they use what appears to be the GitHub logo on this page...? Surely that isn't okay.

https://cloud.google.com/images/products/source-repositories...
> It might not make money (I legitimately do not know) but it helps drive GCP adoption/usage, unlike code.google.com which didn't.

Understandable considering that AWS has codecommit and MSFT owns github now.
Well, it mentions classes, for example. The opcache handles that already, cross process. For a live object, people tend to use apcu. It's not as nice as a shared object across 2 couroutines, but it's reasonably fast because it's using mmap and fairly fast serialization to share the object.

So, what they are proposing is helpful. But, they seem to be assuming that PHP shares nothing across processes. That's just not true.
I'm doing the ES6 + Immutable thing right now in some React apps. (I'd prefer to use TypeScript, but the codebases are too large to convert.)

It's an improvement over plain JS, but also a nightmare. For example, it's hard to create truly immutable classes. I ended up with this pattern:

class Foo {
#props

constructor(props) {
this.#props = Map(props)
}

get someField() {
return this.#props.get('someField')
}

withSomeField(value) {
return new Foo(this.#props.set('someField', value))
}
}

It works, but it's annoying. Then you have, as you say, all the coercion/conversions between Immutable and plain JS values.

TypeScript would help, but I think I'm going to look into Reason, too. I think I heard that it supports interoperating with ordinary JS. The problem with TS, last I tried it, was that while it supports JS, there are subtleties (like the lack of support for default imports) that mean it's not fully backwards compatible. You can't just run a JS codebase with the TS compiler and expect it to work, as I understand it.