skysight-inc/HackerNews huggingface dataset:
Pick one of the Discworld Series from Terry Prattchet. I have read it as a teen/tween, my wife discovered it a year ago, and we both really like it.

Depending on your tastes:

* if you like straight up fantasy parody, you can go from the beginning, and follow Rincewinds journey, a mage hapless at magic, running away from peril of mostly his own making.

* if you want different take at folk-tales, with a hint of Shakespear and a dash of, dare I say a dash of feminism, follow Witches of Lancre. Granny Weatherwax is an icon!

* if you like noir and urban-fantasy, follow Ankh-Morpork city watch led by daring Samuel Vimes and then continue with introduction of newspaper, resurection of post office, rebuilding of banking system and ushering in the age of steam.

I loved most of them. Didn't regret reading a single one.
You might or might not want to refer to a reading guide: https://www.reddit.com/r/Fantasy/comments/8900fu/the_discwor...
The things is, laws aren't whims.

Law shouldn't be applied based on the opinion of some bureaucrats. That's how you get a tiny fine for a big multinational because "they are responsible for too many jobs" or the classical one "their lobby pay me well enough" while the tiny startup get a too big for them fine because, who cares.

Can't we both agree that this fine is WAY too small? Can we both agree that this fine would be WAY too big if it was for a tiny website with a few hundred users?

The idea behind GDPR is amazing, I agree with the concept. What I disagree with is the execution and that fine is the proof that it's pretty badly done.
Buzzwords aside, I've found Event Storming invaluable for understanding the behavior of domain/API for potential clients. Identifying the bounded contexts, how they interact, and allowing to clearly communicate with non-technical folks has been very beneficial. Even more so when can look to the bounded contexts to decide what to build and what to implement with a 3rd party service.
I haven't looked in detail but the description strongly suggests an applied ML focus (which would be very typical of IT certifications in general). In AI/ML, there's some overlap between applied AI and research AI--e.g. you're going to want to know something about statistics in any case--but I'm not sure the distinction is always appreciated.
It always takes time for parasites to evolve in a new system.
Open-source projects greatly depend on reputation.

E.g. I can trust the people behind git: some of them may be poor UX designers, but they won't let out a version that eats my files, or is backwards-incompatible. If a completely different team forked git, I would be quite wary to use the fork outright for my daily work.

When all long-term maintainers stop maintaining a project, the last person leaving should turn off the light. The project should be officially stopped, because no people remain in behind it.

Whoever wants to pick up the development should fork, and use a different name. This way, the forked project will accumulate its own reputation: of course, initially propped in major ways by the idea of "this is a fork of a well-known project".

At the very least, it would be a heads-up for everyone who depend on that project that a major change in it is happening.
>But when you make a package used by millions of people, you become responsible for their safety.

Says you! I don't agree with that. Author clearly doesn't either. You're painting it as though the author knowingly handed it over to some hacker when in reality he had 0 cares about this package and just handed it over to the first guy who asked. I would have done the same probably.
Then it will read like the mythical ad. God. The pedantry around here is astounding.
I'm confused by this edit
He could probably synchronize his RTC to the GPS system. GPS works by sending a clock signal plus satellite ID from each satellite. Devices using GPS then use an ephemeris to determine the location of each satellite and then calculate the relative position of the receiver.
That's just a cop out! Such a tired meme!
Loyalty programs, reputation systems, escrow, etc. Nothing will ever be perfect, but the status quo of chargebacks is also not perfect.
> you’re trusting random strangers on the Internet to run code on your systems

I mean that's pretty much how the world works. Even running Linux is trusting random strangers on the internet. Most of the time it works pretty well, but obviously it's not perfect. Even the largest companies in the world get caught with security issues from open source packages (remember Heartbleed?).
no one knows! but probably something line "publishing secrets mumble mumble national security mumble mumble"
Not "trusted" ones per se.

I can make a contract that relies on one single third party and in that case you are correct that there is some existing trust relationship. However, the protocols are designed such that the trust you need to have on the service provider is minimised with trusted computing systems and the contract's mechanism design.

Conversely, I can also write a contract that trusts a pool of oracles, or a prediction market (here the trust would be in the prediction market protocol and not on its operator), or a token curated registry where individuals are paid to give accurate information.
So do you have some kinda data breakdown on the typical startup, or just other anecdotal experience?
How about just not transfer ownership of the original name. Let foo become foo-new or go from john/foo to bob/foo whichever is appropriate thus ensuring that only those who affirmatively added bob/foo or foo-new are ever effected.

Vetting new maintainers sounds like hard work that you might not feel like doing for free no problem just don't do it and don't give them the damn name.
There's no evidence that the prosecution would be for anything non-'journalism' related; that is unsupported speculation that the author doesn't imply or suggest.
That attitude is ridiculously commendable, major kudos.

My fear is typically around having "mixed edited" code. That is, code that is edited by hand and generated. I greatly prefer being able to know that the generated stuff is extended by language mechanisms and I will never really have even the ability to edit something that the generator will do. I have seen bugs in generated code, but I have always pushed to fix the generator, not just fixed the generated code. (That make sense?)

And, reiterating because I feel it is important, your position is awesome. Thanks for sharing!
How Surveillance Inhibits Freedom of Expression
No in the U.S. a handful out of a million cops are bad apples. Some legitimately find themselves in difficult-to-interpret life-or-death snap decisions on a daily or weekly basis and they get paid 1/4 or less of what some privileged engineer on HN does. And then a few bad apples plus a few legitimate accidents are over-analyzed as some proof of systemic racism in one of the most diverse countries on earth.

Meanwhile, you want to talk about abuse of minority rights, take a look at China's treatment of its muslim population:

https://www.nytimes.com/2018/09/08/world/asia/china-uighur-m...
https://www.independent.co.uk/news/world/asia/china-uighur-m...
An experiment to create a zero-dependancies* React app
I would like to argue that the so called "Musk haters" are not a group made of haters. Wast majority has neutral or analytic approach but labeled as Musk haters.

The Musk fanboys on the other hand form more clearly defined segment.
> Being pro-choice doesn’t require nullification of an unborn child’s rights. It’s the recognition that the mother’s right to agency over her own body takes precedence.

> That does not imply that a doctor or researcher has the right to risk causing debilitating life-long symptoms to another human being at any stage of development without a clear medical justification.

It's not the doctor making the decision to go ahead with this procedure, it's the mother. So, according to you, a mother has the right to kill an unborn child in the womb because it's the wrong gender (not uncommon in China) and that's "agency over her body" but then she can't attempt to mitigate the HIV risk it has given her child by procreating with an HIV-positive male. This is absurd.

> I also fail to see how the scientific basis is relevant to the ethical question. Whether the science is good or not, we’re talking about unnecessary procedures with inherent failure rates that can have brutal life-long consequences.

Nobody knows if there will be "inherent failure rates that can have brutal life-long consequences". That's why the science is bad. If the science was good, you'd know if the procedure is really that risky or not. If the procedure was 100% safe and effective, it would be unethical not to perform it.
The only way to have good hardware support is to buy two computers, and send one to a developer.
I make an important distinction in the article. The FOSS community is not one 'type' of person. There are plenty in the FOSS community who use proprietary software. I have yet to hear a compelling argument on this thread for using FOSS software exclusively.
Sounds like Snyk:

https://snyk.io/
This exploit is not NPM specific, could be any programming language. (Though NPM is a bit easier to exploit since there are so many packages and a large tree of deps)
I feared as much would be the case. Even in non-generated code there's perhaps some instances where that code would make sense.

However, if you were to audit your dependencies and find a new case of this, you could examine it further to determine whether it passes muster. I suspect code like this is infrequently added to packages.
Is anyone going to bother crawling through all dependents of this library, extracting the package.json descriptions to find the proper key to decrypt the string and find out which package was being targeted?
> Traditional processes for understanding the domain also tend to focus on nouns.

The most traditional requirements development and system analysis process I can think of, structured analysis (as developed by Ed Yourdon at others and first popularized in, IIRC, the 1970s), focuses on modelling a planned response system in terms of the events it needs to respond to and what it needs to do in response, and decomposing it into subsystems modelled the same way.

Using shared visual models is a common technique when applying Structured Analysis, too.
I don't have one. A few times a year, I wish I did, not for raking the lawn, which can be done quickly enough with a rake, but for clearing leaves out of garden beds--the rake does bring mulch and can bring plants along--and from a short gravel walk.
Humor: Modified Bayes' Theorem
This is great if the assumption is that the startup will be successful, however given the failure rate it feels like the focus should be on risk management. How much risk should I as a developer be willing to invest knowing that statistically things might not work out.

Additionally, it would be great if there was material like this that was much more approachable by someone early on in their career.
Does this work on parrot drones also?
Is that you, Horty Bluett?
It's almost as if you posit that the flux through every piece of surface is exactly the same. I suspect it's not.
MSFT is more predictable to me as it has a lot more sources of revenue and looks like they are doing very well in cloud.
This is bound to happen from time to time. We should invent some tools to nuke the affected code from orbit.
Little Sister
This is a pretty comprehensive comparison given the number of APIs included there. Based on my experience, different APIs return different content, could you share how do you normalize them (the logic behind each API response to your NSFW/SFW labels) ? Thanks!
Do you mean NiMH? NiCads are pretty outdated at this point. The cost of 18650s is so low now that I'd skip NiMH too. You can get free 18650 cells by going to your local landfill / dump and grabbing discarded laptop battery packs. They typically have a few bad cells with the rest reusable.
Linux has a giant user base, a giant installation base, and a giant pool of talented devs willing to take on unpaid work.

If this is an indictment of anything, it's an indictment of the entire NPM ecosystem -- it's been the wild wild west for years; haphazardly using whatever NPM install gives you is baked into the culture.

Sure, Dominic is an active participant in that culture but it seems to me that it is impossible to have a largely unmoderated volunteer system with as many packages are actively used without things like this happening.

Keep in mind, this is a case where the system worked, more or less -- an observant user caught the issue, and made a public issue of it. Who knows how many packages have slipped by like this?
Sadly Borland really did a big mistake dropping Kylix and going into that Inprise endeavour.

Probably Java would have never had taken off if they kept their compilers accessible to the hobby developers.
A market of razor thin margins? I think not.
US airlines are swimming in cash

2017:

* American Airlines profit: 7.6 Billion USD

* United profit: 7.1 Billion USD

* Delta Airlines profit: 4.7 Billion USD

* Southwest: 2.2 Billion USD
Volt = hybrid, Bolt = electric
"I think the Assange/wikileaks indictment is a misstep by the justice department/current administration."

That is how power is gained, by taking risks. Maybe this will fail in court, maybe it won't. If it won't, the government will get more power.

"how can Assange be indicted but not the NYT?"

To demonstrate power, you don't need to be fair. In fact, not being fair is much more scary.

"I do think that Russia has made use of wikileaks"

To me, this begs a question, why was USA so inept in not making use of Wikileaks themselves? If it is an "independent" organization up for grabs.

Perhaps to get more power, you need a good enemy, too. That's why.
Can I ask a simple question not being a javascript guy? Should this be considered a security vulnerability in need of mitigation, ie should I try and identify all the places this/these packages may used in our production code, and ...do something?
Web workers vs. Service workers vs. Worklets
I owned a 2017 Chevrolet Volt for a little over a year. It was a great car and it is the main reason I ended up buying the Tesla Model 3. The Volt was my training wheels move into an EV, I had the full benefits of an EV with the safety of never have range issues.

I just got addicted to the EV part and found myself always trying to better my range. My commute is roughly 54 miles round trip which is in line with the EPA 53 miles range the Volt has. In mild weather, say 55F+ I could make that trip and have six to ten miles to spare. Winter with temperatures near freezing or below I fell back on the gasoline motor.

However also notice that GM is doing away with its platform mate, the Chevrolet Cruze, and that is the bigger story. Ford already state they are dropping many of their sedans and GM is dropping the Cruze as well as the Impala, the later is from the plant closing in Canada.
It's worth pointing out that this recommendation behavior is only unintelligent if it has a downside, i.e. reduces Amazon's profits. Companies (and their AIs) only care about your business transactions, not whether you're annoyed.

I'm sure Amazon engineering is well aware of the jokes about their recommendation engines. But their recommendation engines are not calibrated to reduce jokes, they are calibrated to increase sales.

If you only know ONE thing about a person, pinging them about that one thing might still be better than ignoring them, or offering completely random recommendations. A memorably annoying ad can work better than a boring and inoffensive one, sometimes.
This is great work and the authors should be really proud.

The hard thing about BCI research is that it has to compete with operating a joystick with your lips. Quadraplegics get incredibly good at this, to the point that they can play RPGs:

https://www.youtube.com/watch?v=qj6tFWs1bhg

Perhaps BCIs will eventually get so good that they will be superior to these joysticks. Then quads will be able to play first-person-shooters :)
The science is still very young, but it's often called "fluid" and "crystallised" intelligence. Fluid is thought to peak at around 25 years old by some people.

It's a really controversial topic that provokes super emotional reactions and a lot of bad debate but it's worth reading about the terminology and studies that have been done.

This article[0] has a header image that summarises the answer to your question

[0] https://examinedexistence.com/the-difference-between-fluid-i...
I think the point being that when a filesystem the mv is atomic and just updates an inode but on S3 those operations can take place on thousand of different machines.
You don't control either from the POV of LE verification infrastructure.
> Don't get me wrong -- I don't much care for Assange [...]

Why has this blase paragraph become so common? Want to defend Trump's actions on X as consistent with a past president? Include a paragraph on how you don't like him. Want to attack academia for being too much of an echo chamber ("grievance studies")? Make sure to have two paragraph digression on how you're a liberal, not one of those icky conservatives.

Why is it necessary to explain that defending an ethical norm in the case of a certain individual does not imply endorsement for all of that individual's actions? Can't we consider ethical arguments on their own merits, without regard to the underlying ideology of the speaker? Is it a garlic clove to ward off American hyperpartisanship?

It's my perception that such garlic cloves have become ubiquitous, where only a decade ago they were much rarer.
You can do a lot of the same stuff with Bluetooth Low Energy and avoid putting your entire winery on the internet. I really like BLE because it's a very straightforward set of protocols for building sensor networks and sending/receiving data.
Logz.io Adds Grafana for Incident Detection
This would mean that rsync now works with S3 as it has an sftp target... correct?
Community service, win reelection, and a trivial fine in America.
I don't know how to be charitable here, the side note is completely wrong, and I'm not sure what interesting point could be made here.

A theoretical perfectly-machined set of gears is a mathematical construction, not a physical construction. It seems reasonable to me that a mathematical construction could have infinite precision, but it is obvious that a physical device has limited precision. An analog computer is a physical device. We might as well pretend that a digital computer has infinite RAM and an infinitely fast CPU, if we are in the business of assuming that an analogue computer is infinitely precise.

In general you can make many of the same engineering tradeoffs with simple analogue computers. A cam wheel can encode a function, and by adjusting the size, manufacturing tolerances, and materials you can control the amount of error that the cam wheel gives you when calculating the function. Similarly, with a digital computer you can adjust the number of digits used to represent numbers, the size of lookup tables, the number of iteration for iterative methods, etc. and control the amount of precision a digital computer provides.
AWS is IMO the best vendor if you are looking to for HIPAA compliant cloud computing. Our bills are higher than they would be for a non-medical application, but nothing astronomical. Programmer time is still way more expensive.
Maybe something that would actually run it in a sandbox and say, catch the calls to AES256 decryption and flag for human review would do the job?
... and laying off 14,000 people.
I would rather see it as if contributors gain _trust_ based on their contributions, which is not necessarily the same as authority.
Expert level 1v1 poker bot
>However, I'd rather not have the Linux community "embrace proprietary software with open arms", thank you very much.

Why? What possible harm could it do?

>Why are you defending yourself and exactly what against?
I didn't write the article as a defence. I wrote it as food for thought. I would like to see Linux usage increase. I believe those that reject proprietary software outright are preventing this from happening. A vocal minority give the impression that proprietary software is not welcome. This has not been our experience.
Right now it just gets logged, I'm working on a collaborative filtering algorithm now that I have some data.
> Anecdotally, I know many a kid who has taken an interest in space and rocketry

I was personally inspired to go to physics partially because of my love of sci-fi and all space related. That's completely orthogonal to the skeptical sentiment or lack of moon landings in my lifetime.

Real "space awarenes" comes with facts, not with hype. You can drive only so much motivation from outside.
There's a similar effort in the Python / Django world called Jazzband (https://jazzband.co/). This model will probably become more and more necessary as maintainers need to move on from projects for whatever reason. Having a safe place to transfer a project to with a formal process (announcement of the change, code review before acceptance, etc.) would certainly help combat this issue.
> treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way

Yet so many business use third parties to avoid to deal with storing credit card data....

The IP is considered a PII too.
attitude control, not altitude control. Thrust vectoring controls the attitude of the rocket. As in where the nose is pointing.
From an engineering point of view, though, you want the reactor to be as small as possible. That's because output is limited by the power/area that the first wall can withstand. So, the volumetric power density will be inversely proportional to the linear dimensions of the reactor.
He was doing this for free and releasing it under an open source license.

In your analogy the business would be performing the chores for free and telling the users that the business is not responsible for any damage related to the access granted by the key. I don't think most people would sign up for that without a business relationship.
Elon Musk on “assassin drones”
Ask HN: What book(s) or article(s) do you read once per year?
GitHub does it for Ruby Gems.
Author here. It's not just one thread. And not just Reddit.
But having CI, proper logging, and code review isn’t over engineering. The time, effort and bugs saved by spending 1-2 days putting these policies and procedures in place is valuable early on.

Of course, each of those pieces is at risk of becoming over engineered. But hopefully the team has a leader that knows when to move forward and when to pull back.
If you're flying domestically, check out Southwest's low fare calendar.
You honestly think that the author of software released as open source is going to be liable for vulnerabilities in that software ... really?

If that were the case, you'd pretty much wipe out the software industry as it stands today :)

I'd be very interested in case law where you can see the users of a service (which might not even disclose what software they use) are able to sue the author of a package used as part of that service.
antocv, like many of us values security over feelings. If you want to run maybe insecure code to help be supportive of someone, go for it. His point is valid though and you can ignore it at your own risk.