skysight-inc/HackerNews huggingface dataset:
Especially given that Dominic maintains hundreds of packages[1].

He's a good guy and a great developer, and he's always been supportive of others who want to help out. When working on Scuttlebutt[2] I got some flak for a change I made and he said this[3]:

> I argued against this before, but @christianbundy wanted to do it, so I figured okay do it then. Maybe it is annoying for everyone (in which case christian probably learns for experience) or maybe it turns out to be a good idea! in which case we all do. Either way, shooting down* something someone wants to do (that doesn't have a strong measurable reason) leads to a permission based / authority driven culture. And that isn't what I want. This may make ssb less stable... but I'd rather have less stability but more people who feel like they can work on it / are committed to it.

>* "shooting down" is not the same as negotiating a better solution that addresses everyone's needs. I think that's a good thing, plus being good at negotiating is a very good skill.

[1]: https://www.npmjs.com/~dominictarr
[2]: https://scuttlebutt.nz
[3]: http://viewer.scuttlebot.io/%25%2B2WIaJ%2BoRVURoTAke9YWuJzp%...
So if I understand you correctly, he was supposed to have run some sort of background check with all the state agencies to figure out if he was a bad actor or someone who really relied on the module and wanted to maintain it. You can’t protect against all possible outcomes from a situation like this. Seems like we’re just looking for people to blame whenever there’s an issue these days
I doubt the Serjeant-at-Arms has a gun, although apparently the role does include sometimes wearing a sword:

https://en.wikipedia.org/wiki/Serjeant-at-Arms_of_the_House_...
Putting somebody in jail for fraud is the same kind of infraction and response - it is normal.
It's a connector for the optional FlexVer module they intend to release in the future. It's not OCuLink.
If the Stellerator, or any of its descendants, turn out to be the answer to practical fusion, it would have been contingent on vast quantities of computational power being available cheaply. It does not matter how much money you poured into your Stellerator project in 1970, you could never have built the 7-X, because there would have been no way to produce that design in the first place.

Personally, I think one of the answers to "tech seems to have stalled" is that it's easy to underestimate how important cheap computational power is, even without "AI", to moving forward. For another example, as fantastic as the 1960s space projects may have been, I think they just weren't economically sustainable, so it isn't that amazing that they didn't become a self-sustaining industry right away. I think it's easy to look at SpaceX and say "Gee, there's nothing that we couldn't have done there fifty years ago", but again, I suspect you miss just how much of the Falcon rocket is a result of extensive cheap computation abilities. Even if you could use modern computers to produce a design that could have worked fifty years ago, there's still not necessarily a practical path to that design using only tech from fifty years ago. (And of course the Falcon is full of stuff that couldn't exist fifty years ago.)

Modern tokamak designs are of course run through all kinds of computations nowadays too (because everything is), but the stellerator design, in a deep and fundamental way, simply isn't possible without massive computational power, whereas we've been building tokamaks since before massive cheap computational power.
Inside the Wild West World of Gift Card Bitcoin Brokering
Is PHP dead? Not according to usage
It's not that quantum mechanics isn't true, it's that the standard model must be incomplete (the standard model is a field theory that's built on top of the framework of quantum mechanics). In fact, one can derive Einstein's field equations from quantum mechanical arguments as a low-energy effective theory.
It'll probably change several more times before something actually gets constructed.
Move fast and break things. I view this as an endemic fault of how npm, and to a larger extent javascript, culture works and thinks.

I believe npm to be a giant landmine of untrustwothy packages thrown together. No package is trustyworthy as the dependency chain runs too wide and too deep. And having unwieldy dependency trees is considered a feature of npm.
GM to Kill Chevrolet Volt, Cruze, Impala as Americans Ditch Passenger Cars
If you want a sustainable business, you need to charge money for it. Unless you have a huge user base, donations just won't work. It's as simple as that. The majority of your users aren't going to be feeling charitable enough to give you money when they don't have to, but I'm sure a portion of them would give you money if they had to in order to continue using it.
Of course you think bedding, a cover is what you curl up in every night when you sleep
Prisons Want Cell Phone Jammers to Stop Criminal Activity
The other person set out to subvert node modules, the author was just a target interchangeable with 100,000s of other module maintainers. There are already documented cases of very popular node modules having their passwords compromised so this is probably a form of attack we will see grow significantly more prevalent since these modules can see database credentials, encryption keys etc.

This is also very similar to bad entities obtaining or acquiring browser extensions to discretely poison with spyware and advertising, which happened a lot of times.
> Random NSA people knowing stuff they shouldn't isn't the same as 1984 on machine-learning steroids tracking your every thought.

I'm pretty sure the Chinese government has some sort of "1984 on machine-learning steroids" type stuff as well, so they might not be as different as you think.
Couldn't you use an Azure webapp? It has FTP and user management, though not as granular as this. You should be able to use IAM to only allow the user access to that one web app and they can set their own username/password. Not quite as simple as sending out creds from one interface, but it's an option. Not sure how many users you have, obviously if you had tons and tons of users it would become a choir, but if it's just a few users I'm thinking a webapp could handle that.

Alternatively, if trusted users enough, you could use an Azure blob and use CloudBerry. That one is probably not HIPPA compliant though.

I don't even know if this new AWS SFTP plan is HIPPA compliant, don't you have to have a log of file check in/outs? And user login logs?
https://www.raywenderlich.com/

Funny, insightful, plenty of screenshots and very detailed explanations.
>> and W7-X basically only exists because German reunification happened, and the German government was looking for a big science project - any project - they could leverage to funnel money into East Germany

That's the first time I've heard that. Brilliant!
Well I live in the UK and am more concerned with Five Eyes monitoring me than China.

China might be able to hack my servers or steal from my PayPal account, if they cared. Five Eyes can ruin my life and leave me destitute, or imprisoned. Or just have me SWATted if I am particularly troublesome.
Another example of how social engineering is usually what gets you hacked as opposed to a software vulnerability
I'd love to do this, but how can you review thousands of lines of code that changed?
Ask HN: Why is it harder to learn new things the older you get?
The older I get the harder it is for me to focus and to learn new things. It’s almost painful. I still learn a lot but it is not as seemless as it used to be. Why is that?
a good sales/pitch deck can be relatively friction-free, or unimpressive. it's an element.

but a bad deck will lead to a painful experience, almost every time.
> I believe this is false.

It's literally not, though. That's what the license says. It expressly disclaims any such thing.

If you want somebody to incur responsibility, you have to get them to take it on. You can't just demand it of them.

Fortunately, there is a good way to do exactly this. Did you bring your wallet?
It's less whether the gear is modern and more about the layer that it operates at.

A network firewall doesn't see the DNS name that an internal system looked up in order to make an outbound connection. It just sees the source/destination IP/port. Processing a rule based on source/destination IP or CIDR and port is very fast, and all happens locally. Trying to make that device handle rules by IP address is pretty tricky. Does it do a reverse lookup on the destination IP? That may not give a result that's even remotely like what the client used, especially for cloud-hosted destinations.

For a lot of applications (probably including this one), a proxy is a good approach, because DNS resolution can be delegated to the proxy, and therefore the proxy can easily apply DNS-based rules as well as IP/CIDR-based rules. However, proxies tend to make people unhappy because they generally require at least some configuration on the client side. Microsoft used to sell a product[1] that made this transparent for Windows clients[2], but obviously that doesn't help for most modern shops where a lot of the systems are Linux, MacOS, etc.

[1] Internet Security and Acceleration Server ("ISA"), later renamed to Threat Management Gateway ("TMG"), now deprecated and approaching EOL.

[2] It hooked into the network stack and rerouted requests based on a proxy routing rule table. Imagine a centrally-managed proxychains, but with the system configured to default to check the proxychains config file for every outbound TCP connection.
Get started with cryptocurrency investment
This article is literally an advertisement, there is nothing interesting about the story at all.
NASA's Insight Mission to Mars – The Oatmeal
The reasonable answer is that he should absolutely not have handed over publish capabilities to a completely unknown third-party. This seems obvious to me.
I think Vive is pretty good and Rift is even better (I own both). What are your gripes with it?
Here a recording of one of our guys on a webcast and it also shows the tool in action: https://www.youtube.com/watch?v=vA3L8_DaECQ

"No lock in" is an important aspect for us. We know of some other big players with "RAD" type tools which "generate" code, but unless one continues using their tool, the code they're left with is effectively unusable. Their business models are also often around runtime licensing.

As devs, building a tool for other devs, we want our tool to continue to be used because people clearly find the value in it, not because they feel locked in.
Just so people out of the loop understand:
https://www.theguardian.com/world/2013/nov/20/us-uk-secret-d...
The british government actually encouraged and even paid 100 million dollars for the nsa(cia) to spy on their citizens.

While china's surveillance system is scary because it's in public, what might actually be more dangerous is the massive surveillance campaigns the US is carrying out. The US is more than happy to provide surveillance to all 5 eye countries.
Hard to say, but if you have no interest in visiting either, so it's renditions and extraditions that you have to worry about, then ...
You still get plain text if someone in your garden tries to communicate with someone outside of your garden. Or, alternatively the folks outside your garden get an awkward link to your website where they can only view the message there.

I don't think those are very good reasons for doing what you did, since the set of users not using protonmail is orders of magnitude larger than the set of users that do, so protonmail is basically just covering a very small edge case (communication between protonmail customers) while making it more difficult to use the more common case of communication with folks that do not use protonmail.
>If the company does something that jeopardizes the stability of society, just enforce control.

It didn't work out well with Bombardier (CS-series).
If fusion research funding got 1'000 dollars a year, we wouldn't have 1'000'000 dollars worth of research after 1000 years. Just as there are diminishing returns after throwing so much money at a problem, throwing too little means that progress will halt and we get stuck in a local minimum because we need a bigger cash infusion to get over the hump.
I am obviously very uninformed about this, but in the picture I'm referring to [0] you can see the walls in pretty good detail, so I assumed it was an optical picture.

No idea if a neutron flux picture would provide these details or not.

[0] https://www.ipp.mpg.de/4550362/original-1543230147.jpg?t=eyJ...
> Relocation expenses

A large company with a senior level hire will have amazing relocation benefits.

Friend had one at director level, everything was taken care of.

At worker bee level, you're right, you might get two nights at a motel if you're lucky.
Fellow prime customer, share your thoughts there 100%.

I know they incentivize not choosing fast delivery with 5 dollars in coupons for new Amazon service (pantry, music, etc.). But if im buying something, chances are i need it yesterday, i dont want to sign up for Audible or something.

I was thinking after the podcast, Amazon, and really all of these logistics companies, market to customers "were at scale, autonomous, our tech cant be beat", when in reality there are just thousands of humans running/driving around warehouses putting things in boxes.

God speed
Why does that distinction matter here? Besides, many OSes in the past were more like libraries than active resource managers.
Maybe not, but you can avoid updating unless necessary. Assuming you only make necessary updates (and at least do a cursory check at the time) and vet any newly added-dependencies as you go, you can greatly reduce your own attack surface. You're still probably vulnerable to dependency changes up the chain, but then at least you're depending on a community that is ostensibly trustworthy (i.e. if every maintainer at least feels good about their top-level dependencies then the whole tree should be trustworthy).
The final pre-commission price here is normal range for a short, common-word dot-com bought by a motivated buyer from an unmotivated seller. It's fine. Above $1M is crazy though; I think the brokers were softening them up.

We paid much, much less for https://fauna.com/ during our seed stage and rolled up all associated domains along the way cheaply, but we were also willing to change the brand if necessary, and had done some investigation as to the "acquirability" of the domain when we were just starting out.

I question the use of multiple brokers, though, that seems needlessly expensive and guarantees that the negotiation will be hardball because no relationships can be built.
No? I'm saying that there were no alternatives during the hype.

They didn't try to start a trend. They tried to make something up to warrant a new purchase.
Wow...that's pretty cool!
Dependencies need bugfixes and you may even want to use new features, so locking is not a permanent solution.
Exactly this. The big tech companies use their own buses. Most of their employees are affluent enough to own a car or Uber for other destinations.
The tier system changed recently, it's a 10 tier system now, and tier 5 is much easier to get.
No actual data other than "What exactly those breakthroughs could be is entirely unclear."
You’ve explained why dollars are inflationary, which I already knew. You haven’t, however, explained why an inflationary currency is bad.

> Which of these are you going to save money with?

Neither. Most of my savings is in productive assets (i.e. stocks). Some is in gold.
WordPress DevOps: Yes, you need a DevOps team even for your WordPress
OA journals are a middleman too. They typically charge, just in a different way. In fact, popular OA journals can have much higher profit margins than your average subscription journal. If you're advocating for free publishing (whether OA or not) I'd challenge the belief that a system can scale to the current needs of the academic community without charging someone (institutions, governments, authors) and fees of some kind. You can certainly make the argument that the world would be a better place with all actors in the endeavor being non-profits, but that still doesn't at all mean free publishing.
You can't vet the people, but you can vet the code. Of course, if you just give someone commit rights, then you can't. But generally speaking the maintainer understands the code they merge into a project, and that is the vetting that takes place.
Shadow of the Tomb Raider – Coming to MacOS and Linux
Lack of code signing is what's harmful here.

My maven projects' dependencies are technically all pinned, but updates are just a "mvn versions:use-latest-releases" away. But, crucially, I have a file that lists which GPG key IDs I trust to publish which artifacts. If the maintainer changes, the new maintainer will sign with their key instead, my builds will (configurably) fail, and I can review and decide whether I want to trust the new maintainer or not.

Of course, NPM maintainers steadfastly refuse to implement any kind of code signing support...
Indigenous Studies: How are the native people of New Zealand marginalized?
it enables you to run git diff after updating your npm dependencies, so you at least have a chance to detect something shady
I have had it with impractical books that give opinions masked as advice on tech and business.

I'll prefer fiction any day.

Recommendations?
Ideally you don’t pull in thousands of lines of code in unknown dependencies as a starting point
> In the past when UK based executives of online gambling firms have travelled in transit via the US they have been arrested even before going through customs, in effect in international law it is somewhat akin to piracy

No, arresting people who are not subject to any privilege against arrest in international law, who are on your territory, whether or not they have passed through customs, is not, in international law, in even the slightest way “akin to piracy.”
My comment wasn't meant as a criticism of Rust. Rust's trait system does the heavy lifting for enabling this operator (and all kinds of sugar, for that matter), so this makes sense for Rust. Go doesn't have a trait system (though it could well be a useful addition!) or a macro system, so the alternative is to treat errors as a special type instead of plain-old-data as they are today.
consider the alternative around here; a shared room. I think a 12x12 retreat where I could lock the door and not be bothered would be dramatically better for introvert time than a shared room or even a private room in a shared house (thought a private room in a shared house is going to cost 2-4x as much)

I mean, consider that there's a lot of single introverts around here. If there are smaller places they can move to, there will be less competition for the giant places that introverts with children need.
The problem here is that the diff is not source, but "compiled" code. We ultimately come back to "Reflections on Trusting Trust" [1]

[1]: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html
Rust may be a very good choice for systems programming. However, safety criticial software can also be written in other languages which don't need a borrow checker -- Ada and SPARK for instance, or even in C with verificatino tools (FramaC etc.). Most developers also don't need Rust's "feature" of not having a garbage collector since they are not involved in systems programming. As for me, what makes OCaml attractive is its functional nature combined with a very practical imperative syntax. There is no steep learning curve like in Rust, and OCaml's compilation speed is staggering.
I doubt that. High energy neutrons are difficult to diffract (so no lenses), reflect more like light on fog than light on tin foil (so no mirrors) and pass through material too easily for a pinhole lens to be plausible.

I think you have to go to quite low energies (per neutron, not flux) for neutron optics to be a thing. Neutron cameras use collimated neutron sources to get around this, but that option isn’t available here: https://en.m.wikipedia.org/wiki/Neutron_imaging#Neutron_came...
I'd love links to some resources on how to make a great sales deck if you could share some
> for the alternative there was only one John Brown and family and maybe one Free State of Jones situation, for almost everyone else, they either did not see it as evil we see it today and commonplace (so not perhaps evil in their own eyes) or not willing to make the ultimate commitment against it

John Brown was one of many anti-slavery militants who was involved in Bleeding Kansas, and far from being the extremist he's portrayed as today, he was widely considered a hero in the North, with songs being sung in his honor by Union troops during the war, (https://en.wikipedia.org/wiki/John_Brown%27s_Body). Others defied federal law in attempts to free slaves and secret them north towards Canada.

The resolve and radicalism of the abolitionist and free-stater movements shouldn't be underestimated. Many Americans in the antebellum years perceived slavery as an unconscionable evil just as we do today. A few undertook great personal risks to resist it, while many, many more worked through the political system to resist slavery.

Many of our contemporary perceptions of antebellum America are somewhat biased by the historical revisionism of neo-Confederates.
So spending $825k on a domain "has translated into sales". Great. What kind of sales? It's telling that all the supposed benefits here are really vague.

Maybe they could have paid someone to come up with a domain name that doesn't cost $825k.
Maybe "everyone should have a job".

I think that's just a spin on the real "goal", or at least the feeling behind it; people don't deserve any help when they're down because they could have a job.
You can't, you're forced to trust to some degree depending on factors specific to your project. If you're writing missile navigation code then you better check every last diff, but if you're writing a recipe sharing site then you don't have the same burden really.
Casper, Nike, Box, Amazon, Apple, ... Are those all bad decisions?
If you are going to go through an exchange anyway, how is BTC helping you? Both parties still need to trust coinbase or whatever and ultimately the transaction is identical to using venmo.
I thought album cover

Edit: Why downvote a comment like this?
Hack your incentives and win
What's the greatest compliment you can get on HN?

Already been done! (Bonus points if it's "And I did it!")

Event Storming is a type of behavior analysis, perhaps a step up from User Story Mapping, that looks much more geared to plugging into a FP paradigm than any of its predecessors.

In the past, we've focused a lot on structure in our models. This is the flip-side, looking at behavior. And yes, author, it is most assuredly a modeling exercise.

What the heck. New buzzword, new faces, an easier path to certain kinds of deployments? Sign me up! Let's give it a shot. Might be a blast.
Code review can't catch determined malicious actors. It just isn't a viable protection against that kind of attack.

Take a look at the underhanded c contest for plenty of proof where even very senior developers told up front that there is a backdoor in the code often can't find it! And they can't all be blamed on C being C, many of them would work the same in any language.

I don't know the solution, but shaming users and developers for not reviewing code enough sure as hell isn't it.

All that being said, reviewing changes in dependencies is still a good idea, as it can catch many other things.
>It's not a trend where buyers choose recurring payments, but where companies only offer services through recurring payments.

If a firm could be profitable and offer out-right purchases relative to recurring payments, why aren't they doing that? Let the market be rife with only recurring-payment firms. A purchase firm enters with higher prices, if they fail to succeed, it's "buyers [are] increasingly choose recurring service payments over outright purchases."