skysight-inc/HackerNews huggingface dataset:
"If you have tons of depedencies then it's not feasible to check every diff."

Part of bringing in a dependency is bringing in the responsibility for verifying it's not obviously being used badly. One of the things I've come to respect the Go community for is its belief that dependencies are more expensive that most developers currently realize, and so generally library authors try to minimize dependencies. Our build systems make it very easy to technically bring in lots of dependencies, but are not currently assisting us in maintaining them properly very often. (In their defense, it is not entirely clear to me what the latter would even mean at an implementation level. I have some vague ideas, but nothing solid enough to complain about not having when even I don't know what it is I want exactly.)

I've definitely pulled some things in that pulled in ~10 other dependencies, but after inspection, they were generally all very reasonable. I've never pulled a Go library and gotten 250 dependencies pulled in transitively, which seems to be perfectly normal in the JS world.

I won't deny I haven't auditing every single line of every single dependency... but I do look at every incoming patch when I update. It's part of the job. (And I have actually looked at the innards of a fairly significant number of the dependencies.) It's actually not that hard... malicious code tends to stick out like a sore thumb. Not always [1], but the vast majority of the time. In static languages, you see things like network activity happening where it shouldn't, and in things like JS, the obfuscation attempts themselves have a pretty obvious pattern to them (big honking random-looking string, fed to a variety of strange decoding functions and ultimately evaluated, very stereotypical look to it).

And let me underline the point that there's a lot of tooling right now that actively assists you into getting into trouble on this front, but doesn't do much to help you hold the line. I'm not blaming end developers 100%. Communities have some work here to be done too.

[1]: http://underhanded-c.org/
Unfortuntely, whilst npm is the largest source of packages, it's not the only place where this problem exists.

Most programming languages have this issue to one degree or another, which is that they have a package management repository where there is no curation of content, and generally no package signing (there are some cases where that exists, but the take-up isn't always great).

The challenge is that this now seems to be embedded in the culture of a lot of development, and changing that culture would be very challenging, I'd imagine.
Well this undermines everything dominictarr has done for secure scuttlebutt and other projects, including datproject and its connection to Knight Foundation.

"Oops, I just gave the repo to an unkown dude", OK. Sure. Just replace "unkown dude" with "to my colleagues at 5 eyes secret service organization"

This kind of mistake is not a mistake, not from a dude like dominic.
I wouldn’t characterize either as FP, though—both of them still actively encourage maintenace of mutable state and use of macros.

They may be “simple” in that they are very analyzable but you’re teaching a whole bag of skills, and the most FP part of lisp/scheme is just the closure.
> how would someone benefit from NOT getting paid at a union auto job instead of getting paid?

Because of how the money flows through the system. Instead of products being purchased and driving profits for the company (that then pays the workers), the money comes from the general populous (who get no return for the bailout expenditure), to the government, and is then given to the corporation.

So, the people being paid from bailout money are no longer benefiting the population as a whole, and instead have become parasites that act to divert government money (the population's tax money!) away from the common good.
Prisoners want cell phones so they aren't being gouged by a profiteering prison system charging exuberant fees for phone use.

https://www.theverge.com/2018/3/13/17113712/prison-phone-cal...
insurely.com is available.
> should gross me $1M (house money).

That's more than my FIRE number haha, real estate in the Bay Area is so silly.
sign me up too, please. kawfey@gmail.com
Would anyone want to support a third party which audits popular dependencies, and digitally signs off after being reviewed? I currently audit source code for private companies, would be cool to pivot and focus on open source projects.

Feel free to email me, jt3@justin-taft.com
Automatic plant watering bot: Roboveg
Kind of ignored this because it's a long list of stuff. I don't really want to repeat stuff that I've "heard". Friend of mine does consulting for a few big orgs, and he tells me that things are bad enough that many of his customers are looking to move in spite of being heavily subsidized by Microsoft. He mentioned numbers like >$1m in credits. Unfortunately, my friend isn't very technical so when I press him on details, I get very little.

However, that correlates pretty closely with my own personal experience. I've worked with a fair bit of the Azure products and it feels to me very much like a work in progress.

The identity management stuff has been a moving target since day one. That is, how to authorize against the service itself. This is apparent in many of the Python libraries where this is documented.

The Python libraries that I've seen look like they were produced by interns. I'm performance with ADL is pretty rough.

My main goal with Azure was to deploy Kubernetes clusters there. The list of problems is very long and has been documented ad nauseum in many Medium articles. In the 14 or so months I've been working with Azure, it hasn't improved as quickly as I'm accustomed to with AWS and GCP.

A year ago, I shifted the majority of my production infrastructure from AWS to GCP. By comparison to Azure, I was pleasantly surprised with the quality of the products from GCP. My company uses GSuite which made identity management and RBAC a breeze. The GKE product is way, way better than anything else, and there are a handful of things that I like better than AWS.

I wouldn't encourage anyone to shift from AWS unless they were planning a large Kubernetes implementation. I would encourage folks to try GCP and especially GKE to get a sense of the differences.

There's nothing about Azure that I've discovered yet that would cause me to recommend it to anyone. It's possible that if a company had a heavier investment in MS products that it might be worthwhile, but that's not the case for mine. We only ever use MSSQL occasionally for development purposes and I've found that I can spin up an instance of that quite nicely in k8s with the Microsoft authored helm chart.
Unpacking Magic Leap's AR Play
NPM needs to make accessing the source code easier. It has always bothered me that the linked repository can be set to absolutely anything the author wants.
yep, and that's why I said "from a license standpoint". Software licenses aren't moral constructs, they are legal constructs.
> I don't know too many people who could afford a $20k car to drive to work and then a $40k truck just to park in their garage 95% of the time.

You could just rent a truck when you need to transport something that's beyond the car's capabilities.
This is an enterprise offering. We gladly cough up more than this on almost every service so we don’t have to manage it. If something breaks, we just use our business support plan.
I respect and support your decision to have a child. Someone needs to do it, and I'm glad that some people want to. (and I'm certainly willing to contribute to things like education to make that easier.)

But you need to understand that many of us (myself included) really don't want to have children ourselves.

We are people, too... and saying that all housing needs to be built large enough to accommodate a family with children is unfair and a waste.

I mean, sure, I pay more taxes than someone of my own income with children... and I think that's fine. If the additional taxes were spent on things like education, I'd even be okay increasing that difference and paying even more, but it does nobody any good to say I can't buy a smaller place because you want to have a kid.
Margin Notes: Automatic code documentation with recorded examples from runtime
Got an email address?
> Downstream must be responsible for only depending on software from reputable sources, there simply is no alternative.

The alternative is to use distributions that do vetting and staging.
Then you border-tize all div's. That's messy. I suppose one could write jQuery to filter certain divs, but it's not a universal solution.
Chapter 5: Basic Machine Learning Practice
Exactly my point: automation will serve greed, not anything that will clearly be good for humanity.
> When has this ever happened?

Nazi Germany, Communist Russia, Contemporary Russia, Contemporary China, Saddam's Iraq, Mussolini's Italy, et cetera ab nauseum. There are so many cases of dictators existing in a rubber-stamped democracy where the only party that matters is the dictator's own, the only people that may vote are the "responsible citizens" in the dictator's party, and so forth. Many of those countries have/had service requirements for citizenship/party membership, not unlike the thought experiment Heinlein offered.

> It is impossible to have districting that is exactly equal, with each and every district having exactly the same number of voters. Would anything short of that meet your requirements for "universal suffrage"?

Districting is only one means to electing representatives. There are certainly alternatives to explore, even if no clear "better path", partly because enough experiments simply haven't been run in the wild. The impedance mismatch between popular vote and representatives elected is a sign that something needs to be changed. Exploring alternatives is hard work, and maybe something that needs to happen.

> It seems to me that there is no possible system that could actually be implemented that would satisfy your definition of "democracy".

Sure, but that does not mean that we should stop trying to make what we have better. True democracy where everyone votes on every issue doesn't scale. [1] Representative democracy is full of ugly compromises, but for the most part it works better than many of the other alternatives humanity has tried. But we can't rest on our laurels. We should strive to get better at picking our representatives. We should strive to have fewer voices shouted over and/or ignored outright. We should strive to continue to bulwark our democracies against fascists, authoritarians, and would be dictators who like democracies only when they rubber stamp their dictatorships.

[1] It absolutely did not scale in age with the communications technologies of the US founders era. It's technically possible to try to scale it now with modern communications technologies, but that is unlikely to be something people actually want in their lives, and still fails to scale in vectors that matter such as a personal time commitments from the average citizen.
I'm not convinced that "Apple's refusal to let developers set app prices at a more granular level is an unfair predatory practice" is a slam dunk argument.

Additional later note: the actual court case here does, in fact, argue that requiring that all app prices end in 0.99 means Apple is dictating pricing terms, which on some level is of course absolutely true, i.e., it's Apple's fault I can't price my app at $1.49, or $3.33, or whatever. But (1) that still doesn't prove that the 30% cut is harming consumers, which is what American antitrust law is relentlessly focused on, and (2) if that's the crux of the argument, it can be addressed simply by removing that restriction. It can probably be met even if Apple says "you can price your apps anything you want to, but if your app is not free, we're going to take a minimum 29¢ cut."
That's not the real reason, though I'm sure it's a factor. The real reason is that Android is lower in the market and thus their customer base tend to purchase one and only one device. Apple is more expensive and their customer base has more disposable income to spend on devices. (And since they have more disposable income, Apple is more inclined to provide a better tablet experience).

It's all about the benjamins. Google would invest in tablets if android users spent money on them.
Seriously, I don't get how the others in this thread don't get this. Nobody's talking about the legalese of the license - he's undermined his _own_ credibility, which is all that really matters in open source. If he's fine with people not trusting his packages in the future, that's fine, but THAT's the trade-off, regardless of how you license the code.
An Elon company exaggerating their current progress?

Say it aint so!

I liked Elon about 3 years ago before we found out he was a master Marketer. I feel played.
Well, except humans who need to eat!
Wow. How did you find it? Thanks for sharing the tip.
Clever.

Something out there depends on ps-tree (directly or indirectly) and the description in its package.json is the AES key for this string.
Hm, UK is pretty much the only dominantly English speaking country in Europe, which makes we wonder why you suspect that.

Even directly translated most German speaking folks would call it "insurance" or "being insured" first and "cover" (decken/gedeckt sein) having several equally specific meanings aside from insurance, and being mostly used by insurance selling/handling people.

That aside, Non-English-speaking people would typically not associate English words with something in their daily life, besides programming maybe, i.e. if we have frequently used terms in our own language. So in this field I would say it is quite irrelevant for the rest of EU what term is associated with insurance in the UK (France and their disgust for any non-French word for example?).
> as for academics having no interest in technology. yes, that is a problem. but that is changing. the younger generations are more comfortable with technology, and i am guessing that if they don't use modern tools, it's because their supervisors can't deal with them, and they are not bold enough to change the status quo. but they will once they are in charge.

And that is not going to happen for next fifteen to twenty years.
In 1976 a plan for how much funding over how much time was made to get fusion ready. This graph shows the possible paths, as well as the actual level of funding, and is a great explanation for why fusion seems to always be x decades away: https://commons.wikimedia.org/wiki/File:U.S._historical_fusi...
Sorry I haven't written clearly so you've missed what I was saying. I mean that the privacy violations of the US are of a lower order than the industrialised scale of the Chinese, and not just collecting and filtering for terrorist flags but plugging into eg. citizen scores.
If there is one thing governments do not like it is being ignored and their power and reach is broad enough to make you comply in various ways.
You don't need to diffract the neutron flux. Instead, you can wrap (low-res) neutron-sensitive material around the stellarator tube. IDK now well would conventional photodiode or CCD work under high magnetic field, though.
It's true that functions that return (result, error) tuples are hard to miss the errors from, because you have to explicitly either at least accept it, or ignore it. It's both visually obvious that you've dropped the error and there are linters to catch this for you (which I highly recommend integrating into pre-commit hooks).

However, if a function just returns an error, but no result value, it is indeed easy to silently drop that error without realizing it by simply invoking the function and not catching the result at all. To which, again, I'd highly recommend using linters at commit time or even code save time.
> Six months ago I would have agreed with you. And then I learned about error propagation using the question mark operator in Rust:
https://doc.rust-lang.org/book/second-edition/ch09-02-recove....
Arguments can be made about creating custom error messages at each call level, but is that really necessary most of the time?

No, this is not necessary most of the time, and I don't consider the "custom error messages" argument to be a very good argument against sugar. The convincing argument in my mind is that unlike Rust, Go has no trait system to facilitate this sugar, so the alternative is to special-case the compiler to support the error type. Of course, Go could implement a trait system, but "error handling sugar" is a negligible factor in whether or not such a system should exist and how it should be designed.

TL;DR--what makes sense for Rust may not make sense for Go.
I have no idea. This was my first reaction as well. I agree with another comment in this branch: covered.com makes much more sense. A tagline like "we've got you covered" just flows naturally.
What cookies? Wouldn't Microsoft have to go out of their way to make their telemetry programs pick up and use the cookies from the user's browser?
It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible for their safety. To then hand over a package to a hacker or unknown party is just morally wrong.

Just mark it as deprecated and call it a day, like a normal and responsible person.
Agreed. hicover.com is $3.7k on Namecheap. They could have had 821k in the bank and just as good a domain name. They raised $8M on their series A according to Crunchbase, of which they spent _10%_ on a domain name. Say they sold 20% equity in that round, that's 2% of the company on a .com. That $820k could have gone a long way to delaying the need to raise a B (which they did 14 months later for another $16M), and get more favorable terms/valuation when the time came.
Batteries as a Service Boon or Overreach?
Enterprise sales typically involves some "champions" inside the customer's companies looking for solutions to problems they currently have. They do have the need already and vaguely know what the needs/goals/benefits/challenges/costs are but not in crystal clear terms. They are looking for "experts" i.e. you to come in to spell those out and educate them. They are evaluating a bunch of companies and technologies. You have to make your sales pitch stand out of the pack to get the deal.

Part of the sales process is to identify those internal "champions" and supply whatever materials/ideas/education to them to make their jobs convincing the others inside the organization easier.

A good sales deck like the one in OP makes a huge difference. I remember going in with a sales guy to a big bank customer meeting once to pitch our pre-alpha product (yes, we were still building it). My God, his sales deck was amazing. I was convinced myself after listening to his presentation and wanted to buy our product. We got the multi-million deal at the end, admittedly with lots of help from engineering during the sales. :)
I think UK should have nationalised Facebook to protect citizen's privacy. Why should Facebook even exist in private domain?
> And if we are concerned, we should, he would advise, simply make a fork and write an email to npm to warn them.

Well... yeah. If you don't trust him, don't trust him.

If you don't trust NPM's vetting, don't trust NPM's vetting.
Automating the Google Chrome Dino Runner Game Using TensorFlow.js
It's not a small use case for corporate users where the internal mail is all encrypted. We also have full PGP support and the bridge is fully integrated with this, so we hope the garden aspect will decrease with time, though we expect PGP volume to remain small. You are also heavily discounting the overhead of having users manage their own keys locally in your preferred solution.
Nobody's saying you should never accept a patch from an unknown person. "Of course, if you just give someone commit rights, then you can't." is the whole point!
How to Do Real Time Object Detection on Drones
Contempt of Congress is a real thing in the USA, so refusing a Congressional subpoena can result in enforcement and criminal charges.
Initiative Q?
All that machine learning and they still haven't cracked down on counterfeit goods on their platform?
Oh. Fair enough.
Sounds like a Star Trek episode: a creature evolving to avoid weapons, morphing into something unstoppable.
So that's a fair point, you're more concerned re UK/US because you are citizen/in a controlled country. I think that might be how a lot of people feel, and I agree. But can you see how for the equivalent guy living in someone firmly under China's influence they would be more scared of Chinese surveillance than you are of Five-Eyes? And that it would be further reaching in terms of what sort of actions might lead to repercussions?
Also, if you ever plan to be a founder yourself, working at a big company might not give you any useful experience at all.

Alternatively, from experience, while big company might not give you valuable experience it can give you some good people to have in your network. Even if its to ask your former company accountant for advice choosing a billing partner.
With all due respect, I disagree.

No business in the world needs another product or solution. No business needs a subscription-based business to thrive. Nor does every business need to do inbound marketing to survive as well. Plenty of businesses thrive without it.

What Zuora and Hubspot (and many others have done) is use the same principles as religion to sell an ideology to their potential customers - an ideology that makes them think that they need what is being sold otherwise a horrible end (hell) awaits them.
Amazon tablets run their own brand of Android with their own app store, do they not? Maybe things have changed since the original Fire tablets launched. I don't know how dominant those tabs are outside the US. In any case, I didn't mention Amazon as the Fire line these days is more of a way to lock people into their ecosystem of Prime video and music, rather than a "do whatever you want" style tablet.
>The problems that crypto-currencies attempt to solve are more to do with monetary policy. E.g. - you can't have things like quantitative easing / manufactured inflation if your money supply is dictated by a tightly controlled algorithm.

If that's what you want... the extralegal aspect of cryptocurrencies is a big problem. I still have a few hundred bucks tied up in e-gold, which was perfectly setup to do what you want, and backed by real gold, but as a side feature was also convenient for black market transactions.
Correct, presumably the domain name is a capital asset that preserves its basis, so the real cost is the opportunity cost of not spending the money elsewhere. We don't really know this cost.
Go's error handling has flaws, but one thing it got right is having a single error type that everyone uses. Most of the time you don't think about what subtype it is.

In Java, declaring a method to throw any Exception (or should it be Throwable?) is considered an antipattern and most people use subtypes. I think if the exception hierarchy were simpler so that most of the time, there are only two kinds of methods (those that always succeed and those that can fail), checked exceptions would have worked out.
Low-loss and broadband non-volatile phasechange directional coupler switches [pdf]
I'm not sure that it would matter much in practice. I don't think anyone really reads the code for their transitive dependencies.
This is a great point. I think that on average you're unlikely to recoup the difference in wages in the event that the company is sold. I worked for a startup for four years and got nothing.
Design Paradigms of Intelligent Control Systems on a Chip [pdf]