skysight-inc/HackerNews huggingface dataset:
It looks like no one is even sure what the code actually does? Or am I misreading that thread.
Yes, so much of this just comes down to what management feels like doing / not doing. I've been to major national warehouses that offer normal working hours (9 AM to 7 PM) and a relatively tolerable environment (even some daycare options) while still being massively profitable. Still, even at these better warehouses, any failures or problems mean staying past your normal shift time until the work is done.

I was actually just discussing Amazon with my wife from the consumer side of this. I have Amazon Prime, but everything I just ordered online around Black Friday is intended for Christmas. I really don't need it delivered in two days, certainly not at the human cost we read about. However, I don't see any real (other than moral) incentive not to order it as a Prime shipment, and that is the default option.

I wonder what impact it would have if Amazon were to not set 'Prime' as the default shipping option, or offer discounts on non-prime shipments for Prime customers.
Well, not really. Anyone can "take it over" in the sense of creating a new, maintained fork, but the various distro package managers have policies that I think generally require some review/approval process to transfer ownership of a package they publish. I don't know anything about NPM, but imagine it's a more lax process than something like Debian. It sounds like the maintainer here did something shady or simply reckless in effectively transferring ownership but not disclosing this to folks at NPM?
Looks like the malicious commits were made with a fake user account. No identifying information, barely any repos, generic profile picture.
Seconding this.

The markets aren't spectacularly and miraculously efficient, but they're efficient enough that products without demand will not last, with the exception of industry-wide collusion to remove the consumer-preferred option from the market. Game theory says the existence of a wanted-but-not-provided product probably won't last, however. And regardless of continuous cooperation of the participating suppliers, there can always be a new entrant.

Anecdotal on the TV point, but I recently purchased a new TV... no bend, no 3D (didn't even see that as an option), no hassle. :)
I think IoT here actually meant DIY electronic... at least I can't see anything in the article that says this was connected to the internet at all.
You are basically normalizing violent response to a non-violent action. US can do that because FB is US company. UK cannot just because you happen to visit.

Please realize that other states are taking notes at this situation. They are waiting for US/UK/etc exec to visit and make the same excuse.
Heaps is more of a game framework than engine. Though it is very high level. It gives you flexibility. The problem is that it lacks in documentation, real world examples etc.
My company is hiring; email me and I'll look at your stuff and make a decision about recommending you.
> How would one know that this guy had these documents

They'd know he had access to them from public information about his job and the relevant court proceeding.

Given the threat to use similar process on Zuck should he travel to the UK, I would assume that the Parliamentary committee involved has a way to get that kind of travel info about people of interest from the government, who, after all, works for and is answerable to the Parliament.
The Debt We Owe Central America
This is almost like meeting your future team-mates. After all they too have to cope with this day to day. So this paints some practical context.
GM should have been allowed to fail, but not because they were going to turn out to be ungrateful. They should have been allowed to fail because liquidation is the best medicine when the patient is insolvent and bankrupt.
It's very possible that we could throw trillions of dollars at this and still not figure it out.

Possible, but unlikely (imo). It's just that private business doesn't really do large-scale multi-decade pure research efforts with far-off ROI, and governments have chosen to spend money elsewhere. Hence, progress is steady, but slow.
Well, there's always a non-zero risk you break something, especially if the system is older and things don't come off easily. The fun starts when you install the new valves and re-pressurize the system. It's not difficult to introduce leaks, and I can tell from my personal experience that you will not enjoy it when it happens. So I completely understand why most people would prefer to just replace the knobs.
Looks like it was 0.3%

https://www.europeanpaymentscouncil.eu/news-insights/insight...

The outcome was that they cut back on lots of loyalty programs, and not many businesses passed on the cost savings to the consumers.

So sounds like limiting the fees had an adverse effect on the consumer.
General Motors Accelerates Transformation
Scientist claims First Gene-edited Babies Born in China
You could run NPM Audit (https://docs.npmjs.com/cli/audit)
No guns. Just lies and selling people out.
How are they not the same thing?
Both solutions rely on trusted 3rd parties then.
Is there something I missed? I wouldn't call Vive "here".
Ptop 1.0: A task manager written using Python
Nothing beefy, probably, but as for HIPAA compliance, AFAIK, you need to sign several specific contracts with your provider and blahblahblah, probably they're just billing you for the incovenience and for having the HIPAA seal.

"I'm HIPAA, the rest aren't, just pay for it".
So how is this better, cleaner syntax than checked exceptions in Java, for example? I thought checked exceptions were considered a failed experiment. The convention in go is to always handle the errors so isn't that the same thing?

Is it the lack of forced stacktrace that makes flow control through exception more palatable?

Do people just like convention over compiler enforced correctness?

Or is my understanding incorrect and devs don't really like go's error handling?
In the end, either taxpayers pay for it, or all holders of the currency of equivalent instruments do (through inflation).
German regulator fines firm for GDPR fail
If a function can't succeed there's no reason to continue executing it. Stopping and reporting the error to your caller is the common case and should not be discouraged by adding friction and obscuring the useful parts.
In Europe, and probably many other countries, national transfers are very easy, and international ones are only more difficult because they're less common.

They are the default way that most people receive their salary, pay the rent or mortgage, pay utility bills, and in many cases make one-off transactions to small businesses, friends etc.

On top of that:

- Most countries have methods for making a regular transfer. I pay rent, water, electric, phone and broadband like this; each company can choose how much to take from my account each month. The consumer protection if a business makes a mistake is very high.

- Some colleagues use the "push" type regular payments for their children's pocket money. It's common for rent, since that's usually a fixed amount.

- There is a mobile app to make it easier to pay friends and very small businesses, since you can use a phone number rather than a bank account number as the identifier.

International transfers are less common, but in the last year I've received money from a Spanish organization I worked for, a Singapore company that owed me a refund and didn't want to refund by credit card for some reason, and some German tourists in a remote area who'd lost their wallet. They transferred €200 to me, I withdrew it from an ATM in local currency and handed it over.

There are statistics on all these methods (plus cash and cheques) for the UK: https://www.ukfinance.org.uk/wp-content/uploads/2018/01/PUK-...
While Toyota and Honda are paying those same high rates as GM they haven't had nearly as many problems as GM staying afloat.
If you want to teach FP you should use the very first and most simple FP languages --- Lisp and Scheme. Despite their extreme simplicity, they provide an extremely expressive power (through their macros) which is still unmatched in most other languages.
At high enough levels you also get invited to exclusive Google Guide meetups.
In the US sense of “government”, Parliament is the highest body of government of the UK.

In the common parliamentary-democracy sense of “government”, the UK government is an entity subordinate to the UK Parliament.
I certainly made a broad generalization, but in this HN discussion you can find people asking why we can't just have a simple HN or Stack Overflow-like site for upvotes and downvotes instead of the existing peer review system (implying that it would be trivial to apply the tech used for social discourse online to academic publishing) and another comment about spinning up a peer-to-peer BitTorrent approach to distributing digitally signed data. And in every discussion of the topic on HN that I've read someone always asks the same type of question about why this is still a problem when it should be trivial to apply software tech toward a solution. My intent wasn't to discourage folks brainstorming technical improvements for the system, it was only to point out for anyone who isn't entrenched in the intricacies that there's a lot of reasons for the dysfunctional system to both exist and persist.
Yes, a democracy, where half the people and the leader chants "America First"... How does this differ from how other non-democratic countries again?
How does that help? You still update from time to time get fixes, new features and then you can get some unwanted code which is not discovered yet.
Early operating systems only had one program run at a time.
This statistic might be completely different on BART officers only.
The author makes it sound like cover.com is a super intuitive domain name for an insurance company... personally if I heard 'cover' outside of the context of this article I would not have made that connection at all. He does a pretty bad job of justifying a pretty bad decision, in my opinion.
Unpinned dependencies are harmful.

If you aren’t reviewing the diffs of your dependencies when you update them, you’re trusting random strangers on the Internet to run code on your systems.

Espionage often spans multi-year timelines of preparation and trust building. No lesser solution will ever be sufficient to protect you. Either read the diffs, or pay someone like RedHat to do so and hope that you can trust them.
>If the original author has no use for the project anymore and someone offers to take it over from them, why should the author be expected to refuse? Isn't adding another potentially unknown maintainer generally better for the community than a project dying?

Depends on the project, I guess. Open source can always be reanimated.
Why use dedicated IP for online business
But this wouldn’t catch issues with pushing immediately after being granted access, new github accounts pushing changes to libs with thousands of dependents, libs whose dependencies were yanked from npm. Only published vulnerabilities, right?
A funny thing is that on README.md, the `Install from source` section has this: `git clone https://github.com/barrysteyn/node-scrypt.git`.
For nearly a million bucks you can build a brand on its own domain.

This is just an article trying to justify bad decisions in hindsight.

If you cant find a smarter way to spend a million dollars than buying a flashy .com then I would seriously question the entire business.
"Learning material" for actually-advanced folks can be freely found on Github/Gitlab, as well as various Slack and Discord channels.

One simply has to muster up the motivation and effort to seek them out.

Honestly the best way to improve, IMO, is to just start participating and contributing.

"I hear and I forget. I see and I remember. I do and I understand."

-- Confucius
I'd be curious how this handles all the posix cases not well suited to object storage.

Renaming a folder than has a million files/folders inside is a single operation in SFTP, but 2 million operations on S3.

Does it handle writing at arbitrary offsets within a file? Does it download the file first then let you start writing?

What about just writing a few bytes at the beginning of a large existing file and then closing your SFTP handle?

How about 2 users accessing same file via SFTP at the same time?
> That’s the gp’s point I think, the U.K. doesn’t have the the same separation of powers between government branches as the US. With some minor exceptions, Parliament is the whole enchilada.

An example of this is that, until recently, their "supreme court" was a committee in one of the houses of parliament:

https://en.wikipedia.org/wiki/Lords_of_Appeal_in_Ordinary
That makes a big difference if you're an American citizen, in America.

Outside its own territory, the US has a long history of being far more aggressive than China, so for someone who is outside both the US and China, it's not at all a given that it's better being spied on by the US than China.
Bailouts also use money that the government doesn't yet have.

In 2008 and its aftermath the U.S. ran up huge budget deficits, and the Federal Reserve for the first time monetized enormous amounts of debt. That was all money that the government did not have.

Besides, money is fungible. It doesn't matter if an entity has the money or can quickly raise it, especially if when it has the money it was already earmarked (or soon was going to be) for some other particular purposes.
Good eyes, but this looks like it may be a red herring. That is a fork of the `scrypt` package, canonically found here:

https://www.npmjs.com/package/scrypt

With one maintainer, Barry Steyn, whose referenced repo is here:

https://github.com/barrysteyn/node-scrypt

Somebody would have to pick it up from a git URL, I think. (Maybe they could typosquat, but we'd have to find that first.)
Mars InSight Landing – T-minus
and/or use fixed versions with package-lock. Or private npm cache if you are concerned.
It's not clear to me if these are intended to be startup-specific questions only.

It asks "How does the company collect feedback from customers?", which sounds like a pretty generic question, but there's nothing at all about working conditions, which I'd consider a top priority at any job.
Really? Do you think the US government would use your information in a more or less restricted way than the Chinese? Would your answer change if you were: a) a citizen of the US, b) a citizen in China, c) a citizen of a country where china has massive influence, d) a citizen of a country where the US has massive influence, e) a citizen of a strongly independent country?

Your answer is so baffling to me that I checked whether you're a real person, and you seem to be. I'd be surprised if either China or the US launched a war because of your personal communications so the question seems to come more down to who you trust to abuse the information more/screw you in an unaccountable way.
Thanks, just upgraded the dyno formation, it's back up now!
That's not the case in many (most?) of the cases I mentioned.

In plasma for instance, the operator and seller could collude against the buyer but any "illegal" operation they do on-chain is enough for anyone to trigger a mass-exit and cause financial and reputational loss to the operator.

A common theme in all the on-chain payment technologies I mentioned is that they do not put any one party in "charge" but the volunteers who run staking channels of any sort (plasma, lightning, etc) can and will suffer financial damages (loss of deposit, etc) if proven to act maliciously.
I'd like to point out that parent is talking about BBC radio, but you're asking about TV. I point this out because I was about to reply that if you're in the U. S., you can get much the same experience with a collection of local public radio stations. At least in the Seattle area, there's the classical station, there's the "mostly jazz" station, a couple of NPR affiliates. Mostly ad-free, if one doesn't count the bumper sponsorships.

But you were asking about TV, so that doesn't apply. Though between Netflix and HBO Go, we get all the TV we can watch without ads. It's jarring to turn on a TV in a hotel room these days. "I'm continually amazed that people pay for this."
That may be good advice, but it has nothing to do with whether price controls restrict competition.
i mean, yes? but also his concerns around clock drift and email notifications are legit.
I'm about to agree to join a startup, but reading all the comments made me hesitate.

But I don't see a growth opportunity in a big company, the work is boring as hell and there are engineers, who joined 5 years earlier than I did, are still on same level as mine.

And the key engineering work is hold tightly by early members, unless they retire, I don't see a chance.

And I want to do robotics. Although my current company is investing in the area, they only need people with the right background, i.e. PhDs in robotics. And I have talk with google recruiters, they let me choose a position before the interview, but all my selections are as boring as my current position.

Doing a startup seems to be only way?
> If that makes sense :)

You're just trying to justify/rationalise that you like go's arbitrary positioning on the result/fault continuum (well not continuum, it's not really 1-dimensional), there are few positions which can't be justified there.

> But to me _exception_ would signify something unexpected happened.

Being provided random garbage when prompted for a CVV can reasonably be unexpected.

> Whereas, for example, if you have a method that writes to a File and the file you provided does not have the right priviledge -> this is an Exception because the user could not expect this.

Why would the user not expect ACL issues on something well known for involving ACLs?
The Four Biggest Use Cases for Chainlink
> there is a huge range of great options for storing electricity

Producers of wind and solar power would love to hear about them!

Re SPOF: since the fusion devices are much less reliable, as of now, than reservoirs of hot liquids, I suppose the reservoir is much less of a concern.

I understand that fusion efficiency grows with size; this is why we are surrounded with colossal self-initiated fusion reactions, and have one nearby! But before we can scale, maybe we could still turn net-positive with smaller, less reliable devices. Remember how unreliable first cars were.
I think bedding not insurance. I guess its a lesson on if the first thing to come to your mind is as common as you think or can you make an advertising hook that puts it into everyone's mind.
> late-stage

At that point, it's just another job. Unless the company is clearly headed for a unicorn IPO, your tiny slice of the company is unlikely to be worth much.
This is one of the reasons npm packages with a compiled minified dist js files are a bad idea, makes hiding malicious code surprisingly easy.
We are spending a relatively pitiful amount of money on fusion power research. The US has spent $29B TOTAL in 2010 dollars from the 1950s through 2010. (I couldn't easily find global numbers, but I can't imagine it's more than an order of magnitude higher)

Some other numbers for comparison:

NASA's current ANNUAL budget is $19B. [1]
The BP oil spill cost $40B. [2]
"A 2016 IMF study estimated that global fossil fuel subsidies were $5.3 trillion in 2015, which represents 6.5% of global GDP." [3]
The US alone spent $600B on fossil fuel subsidies in 2015. [3]

>It's not obvious that throwing more money at the problem is going to change this.

This is true, but we haven't funded it enough. The potential upside is insane. We aren't funding research accordingly.

[1] https://www.quora.com/How-much-money-is-being-spent-on-resea...

[2] http://www.fusionenergyleague.org/index.php/blog/article/hav...

[3] https://en.wikipedia.org/wiki/Energy_subsidies
In completely unrelated news, Deno completed its second milestone two weeks ago and there’s now basic support for creating servers and reading files.

https://github.com/denoland/deno/milestones

https://github.com/denoland/deno_examples
That's great feedback, we'll add labels soon.
Aggressive than China with countries or individuals? Which country would you feel safer taking a vacation in, having insulted the premier in a viral tweet?
Live: https://www.nasa.gov/nasalive
If you have tons of depedencies then it's not feasible to check every diff. You may able to do it or pay someone if you are a bigger organization, but a small shop or solo developer can't do this.
It's better if the new maintainer's intentions are altruistic. From @dominictarr, the maintainer:

> he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years.

That's just plain irresponsible. He must have known how popular the library was. Taking ownership of browser extensions and common software libraries is becoming a very popular attack vector. Owners of these need to be a little more diligent when transferring ownership.

Perhaps there should be some sort of escrow jail for new maintainers where all changes are reviewed. Certainly better vetting needs to take place.
Get ready for more of these type of attacks as time goes by, and they won't all be as obvious as this one.

Supply chain attacks are increasingly being seen as a good vector and there are thousands of unmaintianed Open source libraries buried in the dependencies of popular projects.

Also worth noting that package security solutions, which check for known vulnerabilities, are unlikely to solve this kind of problem unless they track "known good" package versions and alert when things change.
> Isn't adding another potentially unknown maintainer generally better for the community than a project dying?

No. If it's someone involved in the project for years you feel you can trust then sure, go ahead, but someone coming along being like "sup, commit rights plz" then something's just wrong with you of you agree. If that person were serious about it they could still fork it and maybe msg users of the old version about it.

Sure those people could still mess up by just switching over without checking the new fork, or having good reasons to switch like bug fixes or new features, but at least you as the author of the original lib did your part to prevent any messups.
> The code that runs on your bank and "legal system" was written by people who make mistakes as well.

And the results the code produces is constantly audited, both internally and externally.
Haha, thanks for your concern. I don't think you broke it all by yourself ;). Just upgraded the dynos, it's back up now!
A voice of reason. Thank you.

Yes, liquidation is the answer when the patient is insolvent and bankrupt.

In a systemic crisis, however, our bankruptcy courts cannot move fast enough. That is a problem that needs to be tackled, otherwise scared politicians will always have enough time to reach for bailouts.
But what really drives me nuts is textbooks. The data is practically handed to them with ISBNs. How hard could it possibly be for someone to tweak the algorithm so it doesn't suggest to me every edition of every text book I've ever purchased? Beyond the customer annoyance factor, this is a business issue. There is a virtually 0% chance that any textbook suggestion will be converted to a sale. That takes up valuable suggestion real estate on the user's screen and keeps me from seeing a suggestion that I might actually be interested in buying.
Git is decentralized so it doesn't really matter where it's hosted. Github works since it's free, but everyone who checks out the source will have the full git history and so also becomes another repository. Easy to move a git repo to somewhere else.
I haven't had a lot of time to look at the offering, but can anybody tell me if these courses have any theory, or are they just for promoting specific AWS ML services without going into the underlying complexity?