skysight-inc/HackerNews huggingface dataset:
No doubt, the version numbers from PHP to Node are weird.

Here's what happened: when we first came to Node back in 2012, Node itself was being very, very cautious about releasing a 1.0 version, something that didn't happen for quite some time after. So the culture was to be conservative with module version numbers, and we felt our first Node release shouldn't be 1.0 or 2.0... and we wound up releasing it as 0.4. Then the second major release on Node, which should if anything have been 3.0, as 0.5.

Then node version numbering got rational, we got serious about semantic versioning, and for our next major rewrite we went to 2.0. Still confusingly close to the old PHP 1.5 version number, but at least it's not a smaller number!

2.x is an LTS (Long Term Support) release, supported through 2023, so we've been iterating on it while maintaining bc. 3.x, which will finally break bc but also be an LTS for quite a while, will be released sometime in 2020.
I really enjoyed this despite insurance usually being billed as dull. A few points I don't see anyone else making:

* Act of war is poorly defined (and gets more poorly defined by the year). Since insurers use this term and (I assume) wrote the contracts, any reasonable question over its definition should be interpreted in the insured favour. That's how most contract law works since otherwise the contract writer has a perverse incentive to make their contract language unclear and then argue definitions and technicalities. That's not just dishonest, it creates unnecessary uncertainty and excess court cases and those cost everyone.

* I was sort of amazed by mention of the presidents pronouncements as if they mattered. Do they matter legally? They shouldn't: presidents are in no way a reliable source of information on geopolitical matters. Quite the opposite, they have the most motive to lie and its literally often illegal to expose that (if an NSA employee leaked classified proof it was NOT the Russians, they'd be imprisoned under the espionage act). Leaving aside the current presidents reliability, Obama pronounced on the Sony hack, blaming North Korea. Almost 5 years later and no evidence has been produced and plenty of people doubt that. Its also worth noting that no president should be empowered to effectively decide billion (trillion?) dollar lawsuits without oversight or scrutiny, they're not kings after all.

* Finally I thought how adult and reasonable Lloyds' response was. Both in settling the claim (assuming they did so for a reasonable fraction of what was owed) and requiring explicit cyber policies going forwards. That's the act of a group that is reasonable and wishes to take a long term, useful, role in the economy. Any bozo can sell "insurance" policies and then quibble over ever claim, the result is people stop buying. But honouring your commitments and correcting yourself going forwards is exactly what we need in insurers. I wonder what can be done to get US Corporate structures to follow a similar model?
And you just invented eBay?
I am wondering, If in 2005 it cost them $5000 to serve 1.4B page views.

Could this be done in 2015 with $2500 / $1000 or even $500.
I would imagine that's pretty common, especially for small helper functions for a very specific task. There might really only be one real logical way of doing it. How many different ways could you really implement leftpad?
Stripe fees are murderous? Stop it.

They're companies. Stripe built exceptional payment processing software that makes it simpler for everyone. They deserve it.
Probably. The whole time I was there, IT was a disaster. I did not know if the people at top were incompetent or they were just woefully underfunded like IT is in many companies. After a billion dollar loss, I would hope Merck came at it from both angles just to be sure.

My favorite memory was a mandatory security training for all employees. They had a couple of slides on how to make a good password, and one recommendation was to use "keyboard encryption". This is a technique to take a bad password like "ClevelandIndians" and shift the keys to the right (or other direction) to get "V;rbr;smfOmfosmd", a supposedly better password. I stood up at the Q&A time and "asked" how this meaningfully improved passwords given that it added at most two bits of entropy. I also responded to the "how was the training" survey with a recommendation to teach people correcthorsebatterystaple-style passwords instead. Colleagues who had been assigned to a later session said that a slide containing the XKCD comic had been inserted into the deck.
A lot of data entry jobs in the early 80's was done on 8-bit computers that wrote the data to 8" floppies that were then read by the mainframe. Some other setups had tape output. I interned at a company that did input to tape, which fed an IBM 4341.

That lasted a couple years.
A Refutation of “The Bell Curve”
A Parent's Guide to Sadfishing, Explained by a Teenager
> They weren't a US citizen they where Australian so the judge didn't need probable cause.

This is not true, the warrant served would absolutely have to be signed under a finding of probable cause.

I believe the GP is saying they don't believe the probable cause was valid, not that no probable cause was given.
> "jeIlyfish" (with an upper case I) and "python3-dateutil" (not "dateutil").

Libraries should take lessons from writing safety critical code. If you identify libraries visually by name, the main problems are:

* easily misread characters like 1 (one) and l (lower case L), 0 and O, 2 and Z, 5 and S, or n and h.

* identifier names that differ only by on or few characters, especially if they are long.

It's possible to enforce a set rules that make identifier names are visually distinguishable and string distance measure to check all new libraries that are added against old names.
Agreed, although I think there's more than just a comparing spelling issue here. "dateutil" via pip is installed using "pip install python-dateutil". I can easily see someone thinking "python3-dateutil" is simply a Py3 compatible version of "python-dateutil". The "python3-dateutil" module imported "jeIlyfish" so my guess is that the creator banked more on people installing the fake dateutil library than directly downloading jeIlyfish.
If you like this kind of thing, check out The Development of Doctrine (Newman). Snippet: "It is indeed sometimes said that the stream is clearest near the spring. Whatever use may fairly be made of this image, it does not apply to the history of a philosophy or belief, which on the contrary is more equable, and purer, and stronger, when its bed has become deep, and broad, and full."
If only they could add the when construct, similar to kotlin.
It's really something they got right and is in some ways more powerful than rust match.
I programmed and earned a living with this technology 1965-1980. I don't miss it. I wrote a 4,000-card Assembler program that required two metal trays to transport.

Did anyone else "insert" and "delete" columns by pressing down on one card in the keypunch while duplicating? This enable one card to advance while keeping the other in place.

We invented the "240-column" card at the insurance company where I worked. We stored three digits per column (four bits per digit times three equals twelve rows). Being the 70's (0111), our cards looked like lace doilies.
But you forget that to Patrick Bateman the (so called) greater good and broad knowledge expansion or other humanity-propelling criteria weren't nearly as relevant as the question if Patrick Bateman appeared successful.

The image of Patrick Bateman was more important to Patrick Bateman than Einstein or his accomplishments.
I cut my teeth on 40 columns on an Apple II+. It took a couple years before I had the money to buy a VidEx 80-column card (and two more until I got an Apple //e)
What's the insult you're referring to? Can you write it here..?

Cool, then you can see that they're not comparable.
> I really hesitate to do this, as I hate linking or even acknowledging them

They get the most hate for their best reporting, not their worst.

The translation is very bad, and looks almost word for word to the Latin. I'm a little surprised not to see a schoolmaster's corrections on it. I wonder what she conceived this document as.
Ironically jellyfish is the one library which can help you with that task: doing approximate and phonetic matching of strings.
Tips for Building Your First Computer (From Someone Who Just Did)
Yeah, I was a bit harsh. But they already posted an announcement post about their Christmas calendar: https://news.ycombinator.com/item?id=21700759 I don't see the need to go into individual posts on top of it.

In the end, I just think there are better channels for getting started with programming in a particular language then this site.
This is currently only implemented in FreeBSD? No other distro uses this?
Gabapentin use in suicide attempts in US significantly increased since 2013
Sure, but GP's argument was about job titles, not about what work you're doing.
A scribe would have had better Latin.
You can't even write the insult you're talking about, how can you compare with "pedo guy", who no one has a problem writing anywhere?

Obviously they're a bad comparison.
How about programming in Assembler with a maximum of four characters per label or variable name?
In many cases unpatched systems automatically fail GxP by not being patched but pharmaceutical organisations still run operations like it's the 90s and they just don't acknowledge the problems. Have worked in pharma IT for 10 years.
Heisenbug – A bug that disappears or alters behavior when one attempts to study
"Solid SELinux policy" is really the hard part there.

When I pip install paramiko, I do, in fact, want it to have access to my SSH keys. When I pip install ansible, I want ansible to be able to shell out to OpenSSH to use my keys. If I write custom Python code that calls gpg, I want that custom code to be able to load libraries that I've pip installed without the gpg subprocess being blocked from loading my keys. If I have a backup client in Python, and I tell it to back up my entire home directory, I want it backing up my entire home directory including private keys.

If I wanted an OS where I couldn't install arbitrary code and have it get to all my files for my own good, I'd use iOS. (I do, in fact, use iOS on my phone because I sometimes want this. But when I'm writing Python code, I don't.)

SELinux has been able to solve the problem of "if a policy says X can't get to Y, prevent X from getting to Y" for years. Regular UNIX permissions have been doing the same for decades. (Yes, SELinux and regular UNIX permissions take a different approach / let you write the policy differently, but that's the problem they're fundamentally solving; given a clear description of who to deny access to, deny this access.) Neither SELinux nor UNIX permissions nor anything else has solved the problem of "Actually, in this circumstance I mean for X to get to Y, but in that circumstance I don't, and this is obvious to a human but there's no clear programmable distinction between the cases."

To be clear - I think there is potentially something of a hybrid approach between the status quo and what newer OSes do. For instance, imagine if each virtualenv were its own sandboxed environment (which could be "SELinux context" or could just be "UNIX user account") and so if you're writing code in one project, things you pip install have access to that code but not your whole user account. I'm just saying that SELinux hasn't magically solved this problem because all it provides is tools you could use to solve it, not a solution itself.
Very cool! I am curious about the technical limitations of the duration of the audio files. Any way to overcome that? (Besides internally splitting them)
Calculate the Value of Your Data to the Stock Market
Monitoring isn't really a solution, it just lets you know you need to make new keys and gives you a point in time to figure out if they were used after being compromised
There's a bit more to it as "dateutil" is actually installed via "pip install python-dateutil", not simply "pip install dateutil". If someone was to see "python3-dateutil", there's every chance they think it's the same module but with Python3 compatibility.
This is not really ok. There must be a clear contact point for the affected people (not only namecheap).

Also it was very bad on the transparency front. If they are taking down a domain, the operation is not secret anymore, so they can tell why. No telling you is bullshit.

That being a German operation, I would expect much better on the democratic handling of it. And it being an international operation, India should have complained that it was badly done too. What would happen if namecheap didn't care?
DirectX 12 vs. DirectX 11: Why DX12 Is a Big Deal for PC Gamers?
Provided in return for a competitive advantage and a reduction in network neutrality.
Butiq_BLESSING
Climate Change Is Accelerating: ‘Things Are Getting Worse’
We just recently launched a free tool that helps python developers prevent exactly these type of issues.

Feel free to check it out:
https://trustd.dev

we work preventatively, so as you download packages, the tool will analyse it and tell you of any issues found.

We’re looking to collaborate with devs to work out what features should be next.
I'm not sure whether I'm missing your point or you're repeating mine. Caring about job titles for their own sake strikes me as narcissistic.
The fuel cell remark confused me, being followed later by mention of turbos. What is the fuel cell for?
Build React Native WordPress App [Free eBook]
>But if they go to pypi, it won't have many installs

If people are using number of installs as a safety metric, can't blackhats game that by having a bot install the package many times?
Norton is sad, because isn't their security team excellent at reporting vulnerabilities?
My request for every rich text WYSIWYG editor is as follows: please never change the text style of my cursor unless I explicitly say so. Regardless of the cursor's location.

Toggling bold should function identically to toggling caps lock: if I press the bold button, any letters I type should be bold until I press the bold button again. Caps lock does not disable itself when I click into a non-all-caps block of text, and neither should bold.

This would be annoying sometimes, but it would help far more often than it would hurt. For some reason, however, nobody does it this way.
I'm pretty sure they would be in the UK. There have been convictions where idiots took pictures of their speedo then posted them on social media.
> “When all is said and done, there will be three kinds of reactions to an achievement of this kind. One will be outright indignation that anyone would endanger public safety by traveling at such speeds... To date, no one has been killed or seriously injured doing a Cannonball or setting a cross-country record in the U.S., but American motorists don't expect such high speeds, and truckers usually resent it. There's potential for disaster.”

> “The other responses will be from another crowd—Cannonballers and motorheads of all stripes who believe that driving skill, and not traffic law, is more beneficial to actual safety than simply slowing down. From this side of the aisle there will be unadulterated joy that such a cross-country time has been posted, as well as begrudging appreciation from former record holders and disappointed fanatics who may have been planning record runs of their own...”

> Was it a good idea? No. It never has been and it never will be. But like Everest, it presents itself as a risky challenge that is, to some, irresistible.

To those who think it was irresponsible to attempt such a feat, a lot of what we do as humans—at our best—is frankly irresponsible. Humans acting perfectly responsibly, obeying all the laws of their local jurisdiction, never willing to put themselves and even perhaps others in harms way, and worried more about their carbon footprint than whether they can accomplish some mythical (to them) feat...

I imagine that without the traits that lead to these types of attempts, and without a society that is willing to at least tolerate (if not celebrate) their achievements, we would lose out on a lot of inventions, discoveries, freedoms and social progress that stems from people with the same basic instinct to leave a dent.
I think it's not really about the rational/analyzing part of the brain being involved here.

A lot of phobias have "involuntary" reactions, so, for me, it doesn't matter that I know the picture can't hurt me- I still get the negative reaction to it every time and no amount of rational thinking or understanding has any effect.

It's something more primal than that.
Concussion slows transfer of information across corpus callosum within brain
Apple fails to end MacBook 'butterfly' keyboard class action lawsuit
> ... a fishing expedition?

Maybe we should call it a phishing expedition?
Continuous Alignment of Product Management
When I first realized that any and all code that I execute, has read/write permissions to most of my filesystem, it blew my mind. The OS grants every process its own unique virtual-memory-space, specifically to prevent malicious/accidental interference with other processes. It seems like the file-system really should operate on a similar principle as well. Every application should run in a sandboxed environment by default, with exceptions being granted by the user for specific applications that actually do need access to the entire file system.
I'm not saying lock in doesn't exist. But I can't really envision how you would design a full cloud offering without vendor lock in of some sort?

I believe this is what Rackspace was attempting a while ago -- leveraging OpenStack to provide cloud services, so you'd be free from lockin in the sense that you could move to some other OpenStack compatible provider.
Probably much more than the average person. The first time the guy claimed the package was not received so he sent more. This was the friends brother that introduced us to Warcraft 3 and flashing xboxes to play burned games. He was not a sociable person.

If you’ve ever seen the WOW episode of South Park he was the elite guy they were trying to stop.
Encryption does not equal privacy. Some amount of metadata would be required to know if the data is the type of data we want to make a model for. How would data cleaning or feature selection work?
Market Niches for Blockchain Ecosystems
Economy editions are nice, but only make up a tiny fraction of what's out there to consume. Again, $4 is great for a relatively rich nation like India, but what about Eritrea?

Maybe that was a little flippant, but The Law in a big rich country is pretty meaningless to someone trying to make a better life for themselves in a poor country.
Given the proliferation of different flavored gins[1] I think it's possible no one actually likes the taste of gin. There are hundreds of flavors on Amazon.co.uk[2].

[1] https://www.amazon.co.uk/s?k=gin&rh=n%3A340834031%2Cn%3A3598...

[2] Amazon.com doesn't sell beer or spirits. Weird.
Not a fuel cell in the electrochemical sense, but one to store additional gasoline for extending the car's range.
Yeah, I've made several 20-22 hour trips from Chicago to a fishing cabin 8 hours north of Winnipeg, and it's HARD to keep your average speed north of 50. If you make a stop for gas or food, you can literally watch your overall average drop by a few MPH.
Don’t install packages with large numbers of dependancies (for me, this is more than 2.)

Don’t install packages you haven’t at least been to the website for and preferably couldn’t build yourself.

Libraries and package managers help us work together, they’re not excuses for not thinking.
Like I said, it tried to be an answer to similar problems, yet it failed. By the logic of C-for-all creators, Cyclone falls into the “evolutionary approach” group. Why Cyclone did not succeed in spite of “revolutionary” languages with similar aims gaining traction is what I don’t quite understand. I have never had any occasion to try Cyclone though, so I’m only basing my assumptions on what other people were saying about it. Still, its design appeals more to me than, for example, Rust, because ability to include C headers directly is IMO the very essential thing necessary to productively rewrite an old codebase.
HackerOne breach lets outside hacker read customers’ private bug reports
refueling time is a huge impediment. Adding tens of gallons of capacity [in this context 'fuel cell' is 'extra gas tank'] prevents tens of minutes spent at 0mph.
I used to congratulate myself for a Portland - Seattle run in two hours, back in the '80s. I never was able to account for seeing a full moon dead ahead, on a slower run.
Take a look at the other articles from the same author where he investigated some popular anti-virus products. In particular Kaspersky is/was a mess:

- https://palant.de/2019/08/19/kaspersky-in-the-middle-what-co...

- https://palant.de/2019/11/25/kaspersky-the-art-of-keeping-yo...

- https://palant.de/2019/11/26/internal-kaspersky-api-exposed-...

- https://palant.de/2019/11/27/assorted-kaspersky-vulnerabilit...

McAfee:

- https://palant.de/2019/12/02/rendering-mcafee-web-protection...

And I expect that he will publish more articles in the future.

If you want to use anti-virus I would stick to their on-access scanning and stay away from their web protection...
I would have thought kaffir would be far more common to hear in Musk's childhood S Africa than nigger.

All three strike me as lowest possible level insult for which there is no justification. Thankfully most of the world's moved on a bit in the last 30 years...
This will keep happening, and not only will SSH And GPG keys be the target, but any interesting data will be stolen.

And the problem is much larger than these typosquatting attacks. Abandoned Github projects taken over my malicious users, rogue Maven/npm/PyPI/what have you repositories, hacked accounts on any website that is used for distributing programs, feature branches in open source projecs that are automatically built on CI servers in side corporate networks, the possibilities to grab data and send it to somewhere on the internet are endless.

One security measure that somehow grew out of fashion over the last years, is at least on application servers, to disallow any outgoing network traffic, especially to the internet (at least any cloud environment I see nowadays allows it by default). This would largely prevent these sorts of attacks from being able to actually send anything out, but also prevent XXE attacks from happening, prevent reverse connections to an attacker host from being set up, make SSRF attacks harder to verify, and so on.

I strongly recommend whitelisting only the network traffic that your application actually needs.
Why doesn't the US value the elderly?
SimilarWeb have similar extensions doing essentially the same thing. this stuff has been going on for well over 5 years but Google has done nothing about it.
"Fuel cell" in this context, is another name for "fuel tank." They added an auxiliary fuel tank in the trunk (boot) of the car.
I've used nsshell to great effect on multiple projects, highly recommend it (but an encrypted option would be great rook). I've also written a more heavy handed asymmetrically encrypted DNS C2 https://github.com/BishopFox/sliver
Why? An acre of land converted _permanently_ from field/desert/parking lot to forest translates to X tons of carbon permanently removed from the atmosphere.
These people are assholes endangering others in the public roads.
C# Concurrency Patterns Using Channels
I thought the point of Monopoly is to learn that monopolies are not fun, or fair
China < West because of things that can happen to you after you are arrested. Especially things like fair trial, organ harvesting, etc.
When you're going over 100mph you drain fuel incredibly fast.