skysight-inc/HackerNews huggingface dataset:
Hi eridius, thank you for your awesome comment, I really appreciate it!

> But for example if your service needs to be able to make outgoing network requests to arbitrary hosts then you can't prevent a malicious dependency from sending your private data to its own server.

Ideally you would know exactly which hosts you would want to talk to, but I know and understand that is a huge amount of work, but I know companies that are by default locking down everything and only opening up for things that are asked for by the app.

> If everyone followed this advice, then the advice won't change anything. This advice only helps you if other people ignore it, at which it's just "let the suckers try the new versions first". And even then it won't solve the referenced social engineering attack, because that attack was targeting one specific user, and it doesn't matter how many other users test the dependency.

That you can install something that is only 1 hour old without explicitly saying yes to that, exposes you to something where even outsiders wouldn't have time to even contact npmjs.com to take down the package.

And alpha and beta software is quite common, it is just now common in the node.js/npm sphere.

> This doesn't help either. The malicious package was published by an authorized maintainer of the project. Presumably if the package was signed with a private key, that private key would have been given to the maintainer to use in deploying (or alternatively the maintainer would have simply asked the original author to deploy the new version).

I trust Dominictarr and you would not give others your private key, so I would know that it was not signed by dominic, but by a new author, and that could be raised as a issue. The same thing happends with SSH, first time you connect to a server it generates a host key, if the ip of the server suddenly change, you have to explicitly regenerate the host again to be allowed to connect to it again. It does that so you don't connect to random servers if they were hacked.

> The malicious package was published under the name of a trusted author already.

The publishing rights were moved, but the new author was not a trusted author. The npm publishing model is not based on trust but based on permissions.

> This isn't particularly scalable. It's hard enough as it is to get other people to even review the source of your open source library; asking them to stake their reputation on signing it too would be an even higher bar. Very few packages would end up cross-signed like this.

Yes, but you could put a price on people verifying packages for you, you could make an incentive for people to verify. This is like reviews on Foursquare and all these things, were people make their buying decisions based on reviews.
I absolutely agree with you and that's been my experience too, I've seen exactly those problems in both my own code and others' code. It took me personally many iterations over various projects to learn the boundaries of where redux makes more sense and where component state makes more sense.

That's perhaps the biggest actual inherent problem with redux, that it may implicitly encourage everything to be in the one single centralised store, for newcomers. That's a hard problem to solve, though I'm fairly certain Dan Abramov and the other maintainers have tried to make it clear that this, and using redux at all in simple apps, is usually a mistake.
Well, I think most people do it by some sort of "trial and error", the tool of choise is Matt Godbolt's Compiler Explorer [1]

I sometimes listen to the CppCast Podcast and one of the Hosts, Jason Turner, likes to write code in modern C++ for some vintage computers. He tests code bits in Compiler Explorer for that. He also has a YouTube Channel where he does that [2]

[1] https://gcc.godbolt.org/

[2] https://www.youtube.com/user/lefticus1
WebSatchel is a browser extension that allows users to save a copy of an entire webpage or link into their "satchel" located in the cloud and search for it using the search engine on our website.

It's free to make an account and start saving pages right away. Just download and install the extension on to your favorite browser and make an account and begin saving.

Also allows users to save all their open tabs into a "collection" and open them back up all at once whenever you want.

Begin building your personal web today by saving pages that matter to you!
I'm wondering if vertical symmetry might be involved (and a way of optimising future efforts) - plotting the journeys of the top three on this post definitely seems to imply that.

https://rjp.is/calendars/topthree.png

Compare and contrast the original set from @jgc's article:

https://rjp.is/calendars/originals.png
>There are a million visual frontend builders out there, and they are all terrible, because you can never get them to do what you want.

I disagree. I had worked with Visual Basic and it had a great balance of ease of use and flexibility. If you are not obsessed with the feeling that you need to see the underlying code of the UI, you can have a great visual builder. Of course you need to code the event handlers, that's pretty much should be the coding required. I am talking about something like webflow + code for event handling.

>require a huge amount of hacking around which results in code that is worse than what it would have been otherwise.

that is because you haven't seen a great implementation yet. and as another commenter mentioned below, mobile UI builders are better because there is a uniformity in mobile design, while desktop (web) design lacks uniformity. It's possible.
The Diet that you need to follow after a medical abortion
Ted Kaczynski (UNABOMB) was a genius
Computers are still for the tech crowd, as smartphones prove :)

After all, 1 billion computers out there and soon 6+ billion smartphones.
This article keeps referring to the bulkheads as watertight, which they were far from...
Just wanted to +1 this. I also read Japanese at a high level (JLPT N1) and I've always learned characters in context of the vocabulary they are in. Spending months learning 2000 "meanings" for characters isn't a great way to spend your time in my opinion, the hard part of learning a language is remembering tens of thousands of words. Kanji is relatively not a big deal.

The exception I suppose is if you really want to be able to write characters by hand, then the Heisig method has value. If you can live without being able to handwrite well, then it's hard to justify spending months up front remembering unhelpful meanings than actually learning the language itself...
$25 RTL-SDR dongle to sate intellectual curiosity about radio

$5 / mo // $ 60 / yr digital ocean droplets for intellectual curiosity about web dev

Not exactly within budget but ~$400 gym membership (from Costco.. so, factor in the amortized cost of that, too, I guess) for 24 hr fitness for 2 years - going to the gym has been a HUGE game-changer for me. Never really did it before with any discipline, and already within 3 months there have been great dividends for me. I'm much stronger than I was just 3 months ago. Much less anxious and stuff too.
it's weird to frame net new revenue as a "huge cost the whole community"

Taking less money from someone who is building a business in your area is not a cost. They have a choice on where to build, and tax burden is one of many factors in that choice.
Why would you want IndieHacker to track your revenue? I would thought that Stripe would provide the necessary information already.
Hi floatingatoll, thanks for the comment, I really appreciate it! It is valid reasons!

1) Yes, absolutely, it is quite interesting that there went so much time by, but that you can install npm packages without noticing that are less than > 1 hour old exposes you to risks that even people noticing can't prevent you from being exposed to.

2) That it could be sold, is a big problem that you can't solve, but if we discovered that it had been sold in this case, we cold then discard all packages that the author had also published, so a author would essentially put all his reputation at risk by just selling/giving away one package.
5 Reasons Why Russia Is Better Than America
New Tutorial Page for Vaadin and Related Technologies
If anyone would like to know more about the toolkit, I'll be checking the comment thread here periodically today!
Few more questions:

1. Batching logs will allow better compression ratios and bigger blobs (which means lower per-operation costs), but must be balanced with the risk of data loss - what is your strategy here?

2. Will this handle multi-line logs? Say a regex matches part of a multi-line log, will it then return all the lines for that log?

3. Can you add your own labels, or are you limited only to those assigned by Loki?

4. If you are limited to labels assignd by Loki, how will you handle labelling as you expand out of k8s and accept logs for other sources (e.g. syslog)?
It keeps a lot of the garbage away, but you are right it is not foolproof!

But that I can publish a virus to npm and you can download it immediately and that I can't do that with the AppStore is a big difference.
Paid tutorial. Much better than to put all the information in the right order from random places on the net.
It's also more flexible and composable, since checked exceptions aren't quite a proper part of the type system. Consider the case of a higher-order function that wants to derive its exception specification from the function it wraps.
That could also be a good solution ;) haha
That sounds like as good a business plan as any in the cryptocurrency field.
Christmas, Hanukkah and Winter Solstice
If you really want to know more right now, you can read our paper and look at the slides here: https://www.scss.tcd.ie/~andersan/pubs/cgo-2018.html
I find the whole idea of one size fits all processes dubious. I don't have a solution for this and I haven't seen any such process work reliably in large scale projects.

Scrum quite clearly can't tolerate the peculiarities and pressures of a large scale mixed HW-SW projects for instance. Those will turn the whole sprint / PO / independent SW team arrangement into mush.
A long time ago I did some waterfall-RUP mix which didn't feel worse compared to the Scrum I did recently, but it did result in better documentation and traceability.

If I had the chance I would take bits and pieces from several processes and experiment to see which work for a particular company and department, perhaps even at project level. Things that come to mind: Kanban-like task management, regular retrospectives, an exploratory design phase at the beginning, documentation (FFS!), history-based estimation + careful team-private time tracking, a project manager that doesn't also manage the team and doesn't have too much power, regular customer-feedback cycles, CI/CD pipeline, etc.
Hi specialist, thanks for your comment, I would be interested in working more on it and your comment about "hierarchical system of trust" would be awesome to work on!
it's no better for me Japan, Thailand, Indonesia, ... slow, bad signals, stupid captive portals serving no purpose.
Unless you're targeting really deep embedded stuff, C++ is also available on virtually every platform and architecture out there.

And if you are targeting the kind of platform for which there's no C++ compiler, its C implementation is likely to be very idiosyncratic as well, and portable conforming C code might not even compile on it.
Bonds are auctioned off that can be converted 1:1 to coins the next time the supply increases.
I can't believe you got downvoted for basically suggesting to people who think 50% ABV whiskey is too strong to drink shots of it, mix it down with something or just drink beer.

Besides, it's leaving out a lot to say that today's weed is so strong and more so than what hippies had in the 70s. Surely cannabis strains were bred and cultivated back in the day and people with access did get the good stuff as opposed to some seedy mexican brick weed with stems and leaves in it?

If the stuff now is 20% thc and the garbage in the 70s you remember having was 5% just smoke a quarter instead, no big deal. Scales are not illegal nor expensive.

And if you desire a better THC:CBD ratio you only have to choose better, thanks to a regulated market.
You should never need to write one but I think it is still good to learn it. I for one, have never used a hash table or regex (in 30 years!) but I’m sure some developers use them all the time.
Backpropagation – Math Simplified
There's a real fundamental problem with stablecoins: any system that effectively allows decentralized peer-to-peer transmission of money is going to fail one or more anti-money-laundering laws. Stablecoins are fundamentally illegal operations under US law.
It forces anyone trying to use it to contemplate the no-value case.
Yes, so correct franciscop! If there were a better incentive together with a trust system it would relieve the pressure so much of the OSS developers.
> I've come to the conclusion that Agile development processes do not represent a real-world solution.

I think one of the problems regarding this whole discussion, whenever it stirs up, is that Agile (as defined in the original manifesto) is explicitly not about any particular processes, but still most of the critique against Agile seems to actually be against different kinds of "agile processes". The manifesto explicitly states "Individuals and interactions over processes and tools".

In real world, one of course needs actual processes, and all kinds of consults are trying to ride the wave to lucrative contracts. But since the Agile Manifesto is about values, not processes, you cannot steal it from its creators. You can pervert the meaning and utilize some braindead processes in your company and call them "agile", but that doesn't lessen the worth of the original values.

I know that that's a highly unsatisfactory answer, a kind of a cop-out, but I think applying more to Agile than it's meant to be is part of the problems surrounding it today.

Edit: those "you"s are meant for passive voice. No personal offense or commentary meant.
Most cryptocurrencies are used for speculation. If you want to sell high, buy low you need something to trade against.

Many exchanges, especially those that offer any type of contracts trading, are not under normal financial regulation and to the extent they even offer fiat denominated orderbooks there is a risk premium attached to it. When withdrawals are not guaranteed by by any type of regulatory body people could just as well trade pretend-dollars, and that's basically what stablecoins are.

Be cautious out there. At least these holders got their money back.
I work for an analytics company - that said, their malware example is one unlikely to come up in most user testing. I say most because I’ve seen some do user testing over Skype with the user’s real environment.

Another piece of anecdata, I had a customer experiencing a bug I am confident I wouldn’t have uncovered even with intense technical communication without having session replay... our UI was breaking a POST request for a user and there was seemingly no way for it to do so, it turns out in a number field, Firefox had these up and down arrows to move the number up, but the attribute that received the value when doing this was different from expected when entering the number by keyboard.

Anyways, the scary side of session replay does arguably outweigh the upsides. If you don’t know or care, and even if you do care it’s hard to make sure you never capture things like credit card numbers, etc...

At my current company I’ve helped push a lot of things that make it darn near impossible for us to capture PII, but nothing is perfect.

As someone else in this thread said, it would be nice if someone built an end to end OSS analytics tool that was anonymizes by default, but I think even the concept of anonymization is hard to tackle depending on how one defines anonymous. The set of features one uses, and the frequency and/or order of use can likely be identifying by some definition.

Opt in, for the example I described (bug hunting) would be a totally reasonable use, but I bet you’d have a hard time justifying the cost of such a tool if you use it for such sparse cases, and you lose out on many other serendipitous discoveries. Again, if you think it’s morally wrong, there’s not much to argue with in terms of using such a feature :)
maybe the thinking is that since library functions that you use can also throw exceptions, you should also do that in order to not mix error handling. I don't really get it either though. I just like C more because of its restrictions, and I consider restrictions a virtue if they point you in the right directions (e.g. good and predictable performance).
It's not really well explained in the article, but the argument against Symbols is that you (client code) have to store them somewhere for reuse in different calls.

That is that, you could do...

useState("someID")

...and somewhere else (* or in the same place but on a different call) again...

useState("someID")

...and this indeed refers to the same item. But using a Symbol, you need to first create it, store it somewhere and then use it. That is, you can't do this...

useState(Symbol("someID"))

...because this will fail through different repeated calls. Instead you'd need to first...

let someSymbol = Symbol("someID");

...and then...

useState(someSymbol)

Or, alternatively, use Symbol.for("someID"), which then has both problems: creating the symbol first and clashing of identifiers.

While the article does not explain this clearly, the example used alludes to this in an indirect way.

Personally I do think that this would be a more desirable sacrifice to make than restricting call order, but the React team thinks otherwise, it seems.
Simple, effective, I'm surprised this works in this day and age.
Chinese people doesn't believe "foreigners" can speak Chinese. That's it. He is right, I don't care if you been over there for twenty years.
> My experience is, the more business traveler oriented the hotel, the more likely you'll be charged for WiFi.

I've had the opposite experience. My wife and I usually stay at Hampton Inn or Hilton properties on vacation, two star "business traveler oriented" locations with free breakfast and free low-speed WiFi. It's fast enough for everything except streaming video in HD, and we always bring a Raspberry Pi with a thumb drive full of TV shows and/or movies we want to see while on vacation. Most of the places we've stayed even had free HBO/Showtime for when we want to watch something random.

Conversely, for our fifth anniversary we stayed at a luxury suite for the weekend, and we had to pay for any WiFi whatsoever, and for breakfast (admittedly a much nicer breakfast experience than other hotels).
I expect they already offer more and better differentiation to not be too terrified of this. I work for an analytics company and when our core features are copied by larger companies it’s pretty exciting and is a driver of innovation for ourselves.
Don't use setjmp/longjmp unless you can guarantee that you own all frames between one and the other (i.e. don't use it as a public error reporting API in a library, for example). They don't play well with C++, and really anything else that needs to unwind the stack. Those who write R extensions in C++ know how messy it can be.
Compare the price and quality of Comcast internet in the US with internet in Canada.
My experience as a business traveler is basically: 5-10 years ago I had to pay really expensive Wifi, today I haven't paid any Wifi for a long time.
There is no malice on part of the algorithms, but I'm sure you can see how it would appear that way and make someone feel bad. Even people unintentionally hurt others feelings all the time, but their not having malice does not invalidate the way they made the other feel.

Would you say the same about the situation in the linked article?
In this case, "Taylor Swift" is probably shorthand referring to the loosely defined "Taylor Swift" organization, which consists of a staff of probably dozens if not hundreds of employees/contractors dedicated to making the shows, album releases, social media, etc. happen, rather than "Taylor Alison Swift", the private individual.
I guess. Ime. all project are are combination of waterfall and agile. Wrt. infrastructure the initial architecture plan needs to be almost all-encompassing. On the other hand you need to be able to react to new information and changing circumstances.
Being religious with methodology is going to backfire 99% of the time.
If you are a software developer, you have no excuse not buying a Linux compatible machine and using it as your daily driver. It really isn't that hard. I "downgraded" from a MacBook Pro 2017 non-touchbar because I realised I fundamentally disagree with Apple and the direction of our monoculture. Ironically I bought a second hand Levono ThinkPad Carbon X1 gen3, which was originally IBM, which Apple claim are 1984 dictators. How times have changed.
Im nearly completely free of Apples ecosystem, thank god.
You could share your computer‘s Internet connection via Bluetooth.

I find reverse-tethering quite useful when the WiFi provider limits access to one device at a time. With iOS devices I also have the option to use my Mac‘s connection over USB.
"defer" or equivalent is another major missing piece.
wo yao yi bei pi jiu...
The first commit for LXD on github is from November 2014:

commit 3153b57369b7cf3e96979897c335a5c1d69e7f07
Author: Stéphane Graber
Date: Wed Nov 5 10:09:28 2014 -0500

Add licensing and contributing guidelines

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Source: https://github.com/lxc/lxd

There is a migration path from LXC to LXD and probably the OP migrated at some point in time.
If we presume that taxes are set to the level required to provide agreed-upon levels of service (roads, safety, schools, etc) and a new company gets to pay less taxes per capita, what happens now as the citywide average tax income per head starts to decline due to sweetheart tax breaks?

Additional tax income needs to cover the additional demand for services, otherwise it's a net loss for the community's standard of living.
Database News Review: Consistency, Cloud, JIT
Headline blaming Apple and then, in the 8th paragraph,

> At this point, it’s somewhat unclear exactly as to why NVIDIA GPU support isn’t present in Mojave
Thank you, that makes it a bit clearer.
i didn't know that. thank you! that's going to be a huge help, because like some others here, i have hundreds of tabs open and am often searching for one that i knew i had already opened.
<Insert the long list of arguments about Internet (especially _fast_ Internet) not being as ubiquitous as living in SV could make you think.>

That behind us, there's also a matter of reliability and control. Services live much shorter than data they process; given today's trend, I wouldn't expect an online-only paper to be available after 5-10 years. Having a self-contained bundle would let me archive it independently, and would prevent any third parties from being able to interfere with my reading/exploration.
Whilst I agree with you that this isn't the best use of exceptions, one reason to use them this way might be because exceptions (generally) don't cost anything on the success path. if statements do.

Of course exceptions cost a lot more on the failure path, but that's not generally the priority.
I said rent, I should have used the word borrow.
Swiss banks have been hiding assets of people worldwide and many nations consider that a crime. So yes, if you're helping Americans cheat on their taxes, you're going to get arrested.

So the 'advisory' would be: don't break laws.