skysight-inc/HackerNews huggingface dataset:
Warn HN: Malicious Package on NPM - check if you're affected
Hi HN,
As a user of OnsenUI, I came across something bizarre today. Running `npm install` lead to a warning and on further investigating, revealed there was a malicious package stuck inside my installation.

Running `npm audit` showed the following info:

Critical: Malicious Package
Package: flatmap-stream
Patched in: No patch available
Dependency of: onsenui
Path: onsenui > gulp-protractor > event-stream > flatmap-stream
More info: https://nodesecurity.io/advisories/737

What exactly happened? Apparently the maintainer of `flatmap-stream` gave write access to his repo to a random guy claiming to want to maintain the package. Both of them have been rid off write access as of now.

I have since reported this issue to OnsenUI community: https://github.com/OnsenUI/OnsenUI/issues/2592

If you're using this in production, please watch out.

More details on here:
https://github.com/dominictarr/event-stream/issues/116

P.S - this applies to anyone who uses packages that use `flatmap-stream`, not just OnsenUI.

To find out if you're affected, run `npm audit`.
I don't know if you plan on going freelance remotely or having a standard position, but I would recommend you to either:

1 - pick one language you like/fill strong with, play with it and train a bit (like 2-4 weeks) and then go seeking new jobs with this language as your main skills.

It will allow you to discover the job of developer and help you gain knowledge on what you will have to learn (languages, frameworks, etc). You will also be able to see what position you like: front-end, back-end, dev-ops, data, etc.

2 - pick one field you are strong with, search for what technologies you will have to learn. Again, train with these for 2-4 weeks. Go seeking a new contract.

For both, I will recommend to be humble and pick the first job as junior-junior dev. Explain your situation. The first one may not be a remote contract, as you are not trustworthy yet.

In one year (if you are good and serious about it, 2-3 years if you have more troubles), you should have enough knowledge to be able to train with any technologies and adapt quickly to new fields of application.
Anybody experienced this festival first hand? It had been my dream to witness this as an outsider, having very special memories of few days spent in Varanasi hanging around burning ghats.

But maybe I am romanticizing the event and actually its much less pleasant for foreigner.
Yes, failure to include an inventor of a single claim invalidates the patent family.
Pretty much this. Horza Gorbachul was completely correct in his assessment of the Culture.
"monetary exchanges have become the de facto be-all and end-all of social interaction"

Now that's a dystopian theme- I presume you mean that a lot of social interactions these days are on technological platforms that are themselves seeking to make a profit (or a at least a return on investment if not an actual operating profit)?
The developer seems to be confused about information asymmetry.

For one,  cap tables are convoluted and not always available for inspection so it is impossible to translate given amount of options into percentage of equity owned. This cannot be solved using a smart contract. A convoluted, complex cap table doesn't automatically become easier to read because "smart contract". As even a junior developer will tell you, there are tons of ways to write a program which looks like one thing but does something else.

While making it public sounds like a good thing, smart contracts and Ethereum EVM is new tech. So, not every employee especially from a non-tech background will be able to read it. So, this basically takes one complex thing and replaces it with other.

Secondly, pricing is not only dependent on cap tables. There are tons of things going on. How profitable is the company? Are they booking revenue front up to make things rosy? etc. and even publicly available information doesn't tell you what price should an ESOP be. Take an example of Uber and Softbank. Some of the stocks were thought to be worth more than others:

https://www.bloomberg.com/opinion/articles/2017-11-16/softba...

This information might not be public all the time.
Its another example of why these types of patents shouldn't even be allowed. There are always a large number of people who don't get credit and/or won't get paid. And then all of the people who have very similar ideas or maybe the same one who get blocked from bringing products to market.

If the patent system somehow made it so people like the author of this post would actually make lots of money, that would be different. But it doesn't work that way.

There was an application that I worked on. I figured out all of the hard technical problems as the lead developer. Then when the guy got funding he kicked me off of the project, hired his friends, and filed a patent. He was "nice enough" to put my name on it but not as an assignee. Meaning I could never own any of the hard work I did.

This is the type of thing that reminds me that the idea that we really even have a civilization is a myth. Everything is just a game where the people who start with the biggest advantages and stoop low enough for the best scams come out on top.
Honestly, the first part of your response sounds pretty much like the very symptom of the problem discussed here. You presented a very bleak outlook, no doubt informed as much by dystopian fiction (and the culture enjoying it) as it is by rational analysis.

If everything seems destined to hell, with no one capable of doing anything about it, people just give up and live their lives focused on short-term needs. This ends up directly contributing to those world problems we're all worried about. Maybe an influx of positive fiction could help change the overall mood towards the idea that the brighter future is both possible and worth fighting for?

--

Honestly, everyone here owes themselves to watch Disney's "Tomorrowland". Yes, it's a bit clichéd. But it's also heartwarming, and for me it was the first thing since many years that left me smiling and full of energy. The movie asks some very pointed questions about the state of the world, and covers this very topic: that our obsession with dystopias is forming a self-fulfilling prophecy, and that this is a kind of dumb thing to do to ourselves.
The case for Kafka I've seen the most is "decoupling". I.e. two pieces of a system, both of which are often owned by one team, are talking to each other over Kafka because this way they are decoupled, which keeps the architecture clean. So, to make the system simpler, we make it more complicated... I was never sold on this.
It’s good for Mozilla to take a stance, and drop the pretense that you can have the cake, eat it, and have all your other cookies left over.

Circumventing paywalls is not a crime, but it is also not victimless. The crisis for journalism is already eating at the foundations of democracy on the local level. To blithely ignore this is the triump of short-sighted egoism. And the inability of publishers to prevent you from doing it is no more justification as the old shopkeeper’s failing eyes are a license for you to steal from the produce displayed outside.
Architecture-Oriented Programming for Cocoa with Objective-Smalltalk
sure they're amply qualified to find a more satisfying job anywhere else (provided they break their own corporate mental conditioning).

those few who can't see it, can always look for a job in a high-street bookstore. The perks include: free access to all books in the ethics section.
GOPATH is still being used internally by Go modules, but it's set up automatically and you never have to even know it's there.
It will probably remain an option to use it as a user for a while due to backward compatibility.

I don't see how that prevents you from using Go modules.

> a fix for that design problem is not euphemistically described as experimental

The simple reason for it being "experimental" is because Go 1.11 is the first release to include it, not because of some inherent instability. Wait till February for Go 1.12 if you're so worried.

> no LTS means not ready for production

I don't know what you mean by LTS here, since every Go release as of 1.0 has been backwards compatible.
People don't get to the top by being ethical. They get to the top of the org chart by playing politics. Many of them are practically psychopaths.
> The truth is that these days revolution can only be televised. And that is itself cathartic for both the author and for the audience.

One thing I notice, apart from all the stuff that outright glorifies militarism and sadism, or makes serious concerns seem ridiculous: even when it's "good guys in a bad situation", even if they end up "winning", so often what's displayed thoroughly and realistically, with great attention to detail is the violence, the abuse, the pain, the mechanisms of control, all the negative stuff... but the hero usually wins via some silly thing that is not realistic, or even just luck.

On average, you often see realistic horrible things, and that's either unsolved altogether, with an unhappy ending -- or it gets solved by means that are not realistic. Like drawing bad things with permanent marker and nice things with water color, then washing the surface with water.. the realistic stuff sticks, the rest fades. At the end of the day, a person got used to seeing more people getting hurt, more arguments resolved with witty one-liners, more people getting murdered -- but they didn't get anything useful for themselves, just some numbing and conditioning, maybe even a bit of fear to take home with them.

I have to think of The Last Days of Sophie Scholl, that movie certainly isn't "happy". I was sad and upset after seeing it. But it still gave me more than it took, if you know what I mean.

Most writers and actors should simply be ashamed, consider manual labor and never speak again. But that's just my actually unpopular, but earnest opinion.
Exact same setup here. Works great.
texinfo is the official documentation format of the GNU project. It is standardised, ubiquitous, allows cross-referencing and version control, and provides all the semantics you might need. It allows you to render into multiple formats.

https://www.gnu.org/software/texinfo/manual/texinfo/html_nod...
You're advocating the use of the well explored EMG (electromyogram) interface. These exist and work but the amount of training to operate one is actually higher than training a person to move themselves. They're used for subvocal speech and no hypnosis is needed. Galvanic skin response is a subset of EMG.

The winner would be a plain old analog interface which you can operate with body movement, not to fine yet not too gross. Keyboard is a similar thing but digital. Mouse is analog but planar.

Getting higher dimensional than 3D + time is very hard (gestures) and that is what's required for speech or fully operating a machine. Thus the projections.
If a company's user email list is hacked, how much harder is it to attack other information? Financial information (e.g., credit cards) usually get extra security, but plenty of other information is typically stored right next to email addresses (e.g., user behavior history, IP addresses, signup dates, pricing info, password hashes, friend connections, etc etc etc).

So whenever a company says that only their user email addresses were compromised and nothing more, I'm pretty skeptical of the validity of their assertions.
> A third of Instagram would get fined...

And nothing of value will be lost.
Suburbia is a postwar invention, enabled by and designed for the automobile. We have not lived in habitats made of subdivisions, cul-de-sacs, collector streets, and parking lots for "most of human existence."

You may be thinking of the traditional town, which is characterized by pedestrian scale, mixed uses, and continuous structures right up to the sidewalks of narrow streets, engaging pedestrians instead of boring them with "open space."

Walkability was not a novelty for the young and childless. It was how you got your kids to school and yourself to work or the grocery store. Mixed use wasn't about "exciting." If you prohibited commercial uses for miles around your house, you'd have a hell of a time buying milk.

About the only thing a traditional neighborhood shares with suburbia is single-family houses. In most other ways it's the polar opposite: its defining characteristics are what suburban zoning prohibits. It would be a huge win for urbanists to reform modern suburbia in the image of the traditional town. The Bay Area's housing capacity would skyrocket. Planning based on minimized travel needs and a redundant, load-balanced street grid would significantly soften the impact of growth on traffic.

Turning this [0] into more of this [1] would be immense progress. You don't have to build Manhattan.

Andres Duany's spiel on this topic is excellent. Here's a nice compact PDF: http://www.ulct.org/ulct/wp-content/uploads/sites/4/2013/02/....

[0] https://www.google.com/maps/@37.3649085,-122.0288736,3a,90y,...

[1] https://www.google.com/maps/@37.8669525,-122.2587504,3a,75y,...
A yeah, ok, that's an amazing game, but it's David Goliath with massive tension. ManU v. Arsenal mid season passive defence is more normative.
This new site looks really awesome and really got me into why not trying rust the next time I'll write a hundred LOC bash script.

Much better than the previous version. I had a Wow effect yesterday on mobile and now seeing it again on desktop, it's till wow! Strange that there are so many negative arguments here.

Also really interesting to learn about the fireflower problem - there's some truth in it! Applicable to so many things in live...
4. enjoy annoying captcha during every search

5. switch to duckduckgo
I think it´s because most of the UX is designed a long time ago. The pricing wasn't too dynamic and search engines/airlines were more focused on business travelers (from which they have more money) and they usually don´t care too much, how much it cost and when they must / want to fly.

We are building our search engine (focus on EU low-cost mainly) which allow what you looking for (even if you want to search this) for example: A -> B [stay 2-6] -> C [stay 10-12] -> A
I think it's more like this: most parents want their children to be better off. The vast majority of people is a couple steps away from poverty, holding themselves afloat only through decades of hard work. Not surprisingly, the core consideration is the child's ability to find a well-paying job.

And if you really think about it, "monetary exchanges" have been "the de facto be-all and end-all of social interaction" for a very, very long time now. A part of growing up is the ongoing realization that all the things you believed are done because they're needed are actually incidental, and done primarily to make money. It's a sad state, but not new.
Income tax is ridiculous. Especially in India with the stats I presented.

How exactly are tenants getting the better end of the deal? It is the tenenat who:

- pays the rent which is arbitrarily high and increases every year thereby offsetting the puny salary hikes

- bears the burden of excess tax because the landlord refuses to pay taxes on money earned from rent

- has nothing to show for the money spent in rent

- loses a large part or whole of the "security desposit" when shifting.

Taxes are high because a minister decides to charter a plane and fly thousands of miles to meet another minister for 30 minutes. Taxes are high because when they meet they decide to exchange bouquets that cost tens of thousands of rupees. I can go on and on...
No, I am sure that there are at least a sprinkling of both US and foreign intelligence assets within the ranks at Apple, Microsoft, and Amazon too. Why wouldn’t there be?
Obligatory XKCD https://xkcd.com/720/
The mozilla add-ons site actually rejected the version with tracking (the post acquisition one) for some years due to the tracking and still featured the old version without tracking. Chrome's webstore version did have the tracking, tho.

Now in the era of WebExtensions (which are SOOO much more secure!!!) it seems they finally approved a version published by those bad actors. No idea tho if and what tracking is in there and if mozilla stuck to their guns and made them remove tracking or not.
If your country has "democratic" in the name it's probably not democratic. If your major has "science" in the name it's probably not science. If your company has "don't be evil" in its motto...
I would think that "keep me in dark of doing this questionable thing" wouldn't absolve anyone in leadership.
Yes, permitted. You need a license, which is something that can be denied for a multitude of common reasons. Gun ownership in Switzerland is taken seriously and very heavily regulated. And the same goes for bullet ownership. Read your wikipedia link; it reads nothing like what anyone in the USA would recognise.

Relative to the USA status quo, Swiss gun laws are like a far left socialist wet dream. No electable left-wing politician would ever imagine being able to get one tenth of Swiss-style laws passed in the USA.
> Also, while there are some shitty schools with "forcing small children to sit and focus on unmotivated externally assigned busywork while being passively monitored by a stressed out and outnumbered authority figure", ADHD happen in non shitty ones.

Op wasn't describing shitty schools. He was just describing schools.
I wonder if the solution is going to be to run the GraphQL resolvers at the edge so that they can make use of cached http requests. Doesn’t solve client side caching but it should be pretty good for making the most of CDNs.
I believe that both the US and Chinese governments would see Google entering the Chinese market (in a censored form) as a benefit to each of their respective countries. Who said anything about other governments? The US gains visibility this way.
Things rings painfully true
> There's no obligation to always make software useful for other people.

The problem, which you basically acknowledge, is that software that isn't useful generally doesn't get used. If you write nice custom scripts to make your own workflows more efficient, that's great... for you. But to make any interface "useful" (whether it's a UI, an API, etc.), it doesn't just need to be "useful", it also has to be accessible. That should help explain why even crappy UIs are so ubiquitous. They are moderately useful, but extremely accessible.
The point of the old website was convincing developers to use Rust. It seems the point of the new one is convincing the higher ups to let their developers use Rust.
Yeah, but in the wealthier countries, apart from Germany and France, it seems iOS is either almost tied or in the majority (I just looked at US, UK, Canada, Netherlands, Sweden)
Well DC is one of the most violent places in the world. And the places that are not the most violent benefit from obscene cash infusions and 2x normal salary, to the point where real-estate in 'non violent' DC is unbearably expensive, moreover, DC was 'designed' a long time ago, also, the streets that were 'designed' are not the things that make it nice.

I see your points though - really creative aspects of urban planning, infused with some kind of true cause or design, maybe can yield some interesting things.

But most suburbs are not that. They're just places with extra wide roads, pre-planned access to shopping etc..
Yes, in civil court. What part of it should be illegal?
What you describe is the standard in some industries. If a research team discovers something new, lawyers will make a patent out of it that is broad / vague enough to prevent any further research in that area by competitors. At the same time they look at the patents of competitors and if they are too specific they try to patent similar ideas.
Voice Quality Hacks – Cloud Contact Center
Haskell (in the form of intero+emacs at least) also has very nice REPL integration and will automatically reload any changed modules and any modules that depend on the changed modules. The debugging facilities are nowhere near what CL/SLIME offers, but I find I need a debugger much less often in Haskell anyway.
But fiction is about setting expectation. If popular works start to show that it is possible for political organizations to not be full of shit, people will expect that, and exert extra pressure. This beats the current attitude of "politics is a shitshow, news at 11; I don't care about this anymore".
dqueue – delay queue on top of well known message queue written in golang
This is because they read these stories of desperation and identify with the oppressed. Don't get me wrong, the Taliban is also twisted in many ways and evil at the core - but they're on message and know how to exploit oppression to entice others to join. The only way they're able to do this though, is for the oppression to occur in the first place.
AMA with Francesc Campoy on Hashnode
Holy cow. It’s amazing to see this on Quanta magazine, because I didn’t think that many people had heard of or were interested in algorithmic information theory. I’ve been following Hector’s work for a few years and for fun implemented his paper on (brute force) iterating over small Turing machines. This sort of approach is top down — start with the best theory of computation (and in some ways, AGI) and then work backwards to develop computable approximations. Contrast this to the bottom-up approach of neural networks, which is more like “we’ve found these things that work well in specific cases; can we tweak them to do more?” I think ultimately the top down approach is going to be more productive, because there’s a strong theoretical framework already in place that basically sets the upper bound on what you can do.

A lot of papers showing progress on computable approximations have been published just within the last year. There was one recently showing that the halting problem is in fact solvable for “almost all” Turing machines, which is a bit surprising; I would have not thought this was the case. Ultimately though, we don’t need to find the absolute shortest Turing machine that produces a given output string — we just need to find a decently short one that performs better than our existing models. Any sort of algorithmic approach is bound to be vastly superior to a purely statistical approach.
Yeah but Go has garbage collection. Rust's ownership model makes up for not having GC.
What happens when those exports stop being reliable, if and when renewables get cheap enough that electrolysing hydrogen from water is still cheaper than mining methane from Siberia despite the inefficiency of the former?
I just block them for everything except for first party sites using uMatrix.

For some sites I need to allow google.com cookies otherwise I will keep getting recaptcha checks.
I'm pretty sure I've seen this on Silicon Valley. Have been telling people who don't work in IT that it's pretty much a document from season one, and they refuse to believe me.
Inner monologue is something that often doesn't exist with ADHD

"Brain Radio" is ADHD normal
To some extent this is already happening in languages popular for machine learning. Libraries are written in C/C++ and the users just glue things together with very accessible API's.
>It's important to both suspend disbelief to enjoy fiction from reality and take fiction with a big grain of salt that it's often missing considerations of reality.

Ironically, this happens in the utopian case with Star Trek, which gets invoked as an example of a valid and functioning "post scarcity" society based on fabrication and automation, despite the technology in that series being essentially magic.
It doesn't work, since people faced with paywall moe to competition that only has ads. If adblocking is common enough will try harder to make micropayments just work.
Working with Terraform to streamline our provisioning process