skysight-inc/HackerNews huggingface dataset:
Legally, absolutely agree with you. GP's playground analogy was a particularly bad choice in that context.

Socially though - I don't see an issue with holding major projects socially responsible for egregious failure to fix security flaws. Public criticism is part of the open source model, it's the "many eyes" defense in action. Social pressure would be appropriate if Ubuntu just said "ahh, so, a worm is stealing every user's keystrokes. There's a fix for it but we won't merge it because we'd rather spend our time working on PulseAudio and systemd. If users want to use a forked version that will stop the keylogger, they are free to do so, but we make no guarantees our future changes won't break those forks."
> this is so weird to me. i have a really difficult time on hn often because i don't understand why people that claim to be intelligent can't distill out the fundamental/primary issues.

I feel the same way, but not about /u/weberc2's post.

> it's a free/proffered/donation/voluntary/no strings attached piece of code. that is the first thing that defines its use/understanding/existence/ontology whatever other words. everything else is contingent upon that.

This is another of your own axioms. These aren't universal. In particular, if a maintainer states or otherwise implies that his project is secure and suitable for production and then behaves otherwise, criticism is warranted. Even if he doesn't, criticism is still permissible.

> you can debate this point - you can say something about the social contract of open source software and your responsibility to the community if you yourself have benefited from other open source projects and etc but no one is debating this. everyone is debating aposteriori things.

No one is debating this because it's not necessary. The maintainer's explicit assertions about his project (its security, etc) override implicit "social contract" responsibilities.

> if i put a mattress out on the street with a sign "no bed bugs" and you pick it up and it has bed bugs in can you be mad at me? can you take action against me?

Not sure, but I can certainly criticize you.

> i don't know what kind of framework i need to appeal to in order to underscore this issue so that people address it directly instead of things further down the line. i would really appreciate someone showing me how to either do this (put the focus on the thing i'm engaging with) or tell me why i'm wrong for focusing on that.

In general your arguments are based on your own axioms. If your axioms aren't widely-shared, then you will run into these sorts of disagreements.
Yes, but then you have people like the comment I was replying to who say that those tools must be inflexibly fixed when the language ships...and so those languages that expect less from tooling (like Go) are somehow better than those (like Java) that expect more. That the text should speak for itself well enough without tooling.
I have a handful of certs but I can’t remember what they are or where I stored them. I don’t put them on my resume. The courses were great
> "Oh, my credit card information was stolen due to memory issues in this web-service, it's fine though, we didn't pay the guy, so we can't blame him.".

This is a good opportunity for you to read up on the license you explicitly agreed to in order to use said software in order for you to discover that that's precisely what you agree to when you use said software.

You don't owe the maintainer anything, nor does the maintainer owe you anything at all. The project maintainers donated their work to be used freely as is, and that's the full extent of what you are entitled to.
Some of the negatives you've listed come from a "non-remote" culture at the company (2, 3, 5, 7, 8), which can be fixed, with desire (by the company) and effort.

For example, with meetings, you can have a rule like if anyone is attending remotely, everyone attends "remotely" (with a headset and webcam from their desk). If you do use a meeting room, good equipment is essential -- HD audio on a device with good microphones and echo-cancellation, and a camera mounted on the wall.

I've come to the conclusion video is very important for most meetings, especially with more than a couple people, as everyone tends to stay muted to keep background noise down. You can see people nodding in agreement or looking confused, being totally disengaged, looking like they have something to say, smiling at jokes, etc. Without it, it discourages things that help build a healthy team like joking around -- if you crack a joke and it's followed by awkward silence, it's not a good feeling.

My team (distributed across timezones, with over half remote from a home office) does a daily standup every day, using video, and it definitely helps to bring the team together.

Team chat, used properly (hint: Skype is not the right tool, and chat is not a substitute for email or a bug tracker), can also help. Often when a bigger discussion breaks out and people are available (engaged in chat), we'll just start a video chat. It's a lot like the ad-hoc discussions that spring up in an office, but without the forced interruption that in-person presence has.

Fixing all this though really starts with getting the manager(s) on board. If the manager is a "butt-in-seats" type person who can't measure output in anything but number of hours worked, it will probably be an uphill battle.
New chromebooks or used laptops. I recommend used; you get better quality models. Who needs a brand new laptop, anyway?
>I like how police officers in other countries look like normal humans and not stormtroopers. Makes me feel safe.

Yep, I feel exactly the same. The police in Japan look very professional, and not at all like stormtroopers; the shirt and tie they wear just isn't something you'd wear into combat.

See:
https://www.irishtimes.com/polopoly_fs/1.3451993.1523010914!...

Versus:
https://www.wsj.com/articles/americans-respect-for-police-re...

It also helps that police in other countries don't just shoot first and ask questions later, like American police:
https://www.bbc.com/news/av/world-asia-pacific-38534288/wrap...
If they're counting accounts it's definitely much lower. Our firm manages web applications / web services / websites for multiple clients and they all have their own DO account and there isn't 1 developer per account.

We were pretty excited to become part of their partner program but after signing up we realized that if we onboarded new clients we'd have to do it all under a single account, which sadly doesn't work for us because extremely delayed payments are very common, and we'd be fronting hosting costs for everyone.
You think that DO sent out a shill to pretend to be a throwaway to give hackernews confidence in the DO platform?

My read of this is very different than yours: Naive IC who doesn't have optics into the actual mechanization of the business trusting the CTO fully.

I think this message from the CTO is a partial truth as they often are in orgs that aren't extremely internally transparent.

AKA I don't think the "shilling" is working if that's what they were doing.
The comment itself seemed very insightful to me, as we deal with different softwares ever changing tech stacks, the best tool for the job is sometimes the one that the user is comfortable with.
Instagram's Adam Mosseri – This Is the Guy Who’s Taking Away the Likes
I really hope they don't get acquired by one of the big cloud providers.
Wait, so someone disagrees with you, therefore they're opinion is invalid because of NRA propaganda? At least give the person you're responding to the credit to make up their own damn mind.
The original issue was compatibility and interop between two languages with different variance strategies. It's just that those two languages were two versions of the Java language. Calling it a "justification" is also misplaced: baking a variance strategy into the runtime makes the runtime very over-fitted to a particular language; AFAIK this is only done by .NET. So if it's a "justification" it is a very reasonable one. I don't think either of the approaches is a black-and-white mistake, but I personally very much prefer Java's. The loss is a very minor inconvenience (mostly the inability to overload methods with different generic arguments, e.g. foo(List<String> x) and foo(List<Integer> x)), and the gain is that the Java platform is a great compilation target for many different languages. Whether or not those who made this decision had other languages in mind is irrelevant; it's a very good decision, even though some would prefer the opposite one. It's certainly not a mistake and not a hack. It's not a hack because it is a well-known, well-understood, common compilation technique; it's not a mistake because there is no alternative that's clearly better, and many (myself included) think it's significantly better than the alternative chosen by .NET.
Active/fallback?
I think the emotions and really the whole operation of the mental states is reasonable, but not internally logical. They arise in predictable patterns from experiences and so on, but they can very easily override logic. To understand your emotions, you have to see and admit you aren't the nice logical person you might have expected.
Addressing one of your points:

The earth absolutely goes through periods of warming and cooling, and has for billions of years. The issue we're encountering now is the speed of the change. Existing ecosystems can't adapt and move, like they typically do. Human societies also struggle to adapt. We unfortunately deeply depend on stability of climate - our national borders and economies and agricultural systems have a high inertia to change.

I suspect that you don't believe that current CO2 levels actually change the climate noticeably. I'd encourage you, and anyone agreeing with your comments, to spend a bit of time looking at scientific papers that may contradict that view. No politics, no bias, just the data. It doesn't hurt to read opposing views every now and then. I find it rather satisfying.

Some peer reviewed science, just for fun: https://scholar.google.com/scholar_lookup?title=Examining%20...
Both Japan and US/Vacation should have more yearly vacation at least 4-5 weeks. I think it would be very beneficial to general mental health. Also to have less exposure to advertisement which recently has also shown to have a negative effect on health - https://hbr.org/2020/01/advertising-makes-us-unhappy.

It used to be in Japan that you would not leave the office before your manager left whatever time that was.
I didn't mean legal responsibility here (perhaps the example was somewhat poorly chosen), but surely there's some level of responsibility here? Bugs happen, security issues happen, facts of life, but actively rejecting security patches is another level of irresponsibility.
This isn't exactly related, but it's one of my favorite blog posts.

http://www.michaeleisen.org/blog/?p=358
More specifically, a state that 'cheats' can only impact their share of electoral votes, rather than bleed into the popular count of all states' electoral votes.
What is your objection? Do we have a disagreement about licensing, for instance because you'd advocate a copyleft license instead? Or do you disagree with the notion that open source contributors should have the option of opting out of social coding?

Certainly I would expect amyjess and anyone else reading to exercise due skepticism and perform their own research and I respect them enough to expect that they will "consider" my suggestion rather than "blindly" follow it.
I think DO is wanting to go public at some point and needs to get their margins up.
That is why the Apache license has a responsibility disclaimer, that to the extent allowable under law the work is offered with no warranty and no guarantees, not even of correctness or usability for any particularly purpose. Words still mean things, even after we get so used to copying and pasting licenses that we forget that they mean something. If you expect a project maintainer to take responsibility, ask them to use a license where they take responsibility.
There's been a request going for several years now to disable Pull Requests on GitHub[0]. They allow project maintainers to disable Issues, they should also be allowed to disable PRs rather than use automation to close any opened PR. Other SCM products (e.g. GitLab) offer the ability to make PRs available only to project members, or disable them completely.

[0] https://github.com/dear-github/dear-github/issues/84
Ask HN: How to stimulate a toddler's brain/STEM?
I have an 18 month-old son, and I'm looking for ideas to stimulate and support his STEM-ish skills as he grows. He already has his number train legos, a bead maze, and an abacus but I'm sure that there's many more great toys, activities and techniques I haven't thought of.

I'm especially interested in hearing from other parents, so please highlight that fact in your responses.

(Posting anonymously to preserve my and my son's privacy)
T-Rex Run Hack – Chrome Dinosaur Game
Seriously, you can just fork the source repo and do what ever you want with them, and pull from your repo.
Apple's touchpads are nothing special, at least these days where you can easily get a high quality touchpad on pretty much anything but the cheapest laptops available. It's actually how macOS handles touchpads that makes them feel special.

However, apparently Pinebook's one is actually pretty problematic and needs some firmware updates to work better.
I would feel sad for the creator but after reading more about this it feels like they were clearly acting with malicious intentions, such as removing a bug report from months ago because someone mentioned it in an article, or being rude to contributors.

I do not believe that anyone is entitled to free features/bugfixes/etc on foss projects but apparently this is not what happened in this case.
Chief of Space Operations
They most certainly are, especially given the managed products DO has introduced recently (object storage, DB, Kubernetes, and load balancer). They definitely want a slice of Amazon's pie.
Enjoyed the article. Thanks for write up.

4GB RAM sounds terrible even for browsing and basic tasks.

I'm looking to switching to one of those devices in future, so far on trusted Thinkpad x230 (no FHD, $150 USD) for travel purposes.

Can anyone comment on "no NPM yet that I know of though" ?

Does node development work normally ?
I believe the Rust community has been trying to draw a line somewhat short of where systemd discourse ended up.
Well at least with MLM there is some sort of product changing hands (knives, essential oils, etc.) Here, as far as I can tell, the purpose of the business is to create more businesses that create more businesses, etc. (but there is no actual product).
I’m replying to your message using software written in C, so do you think that it might be a little bit unfair to call it “broken”?

I suppose I’d agree if you’re making a general argument that most of the software we use is broken to some degree, but it has an entirely different meaning to directly tell someone “Your library is broken”.
I feel like in the dot-com crash it was technologists who got hit the worst. Most other industries were unscathed, or very little scathed for a short time. But in tech it was like winter for about 3 years.
Airbnb Imagines a ‘Stakeholder’ World
> Python is my language of choice, so posting projects means publishing the source code.

Technically you could just post the .pyc bytecode as long as you didn't care about it working on anything but CPython and compatible implementations.
Read the license, it frames the project exactly.
Yes, that was my point. The market investments are not what is driving the pension's long term value. The underwriting by the state is what makes it valuable. The markets are simply an avenue for growth, or as was the case in the past, losses...
Lora in Multipath: Theory vs. Experiment
One of our big conference rooms has a couple remote mics on either end of the table, and I've been on the remote end when people have had a sidebar conversation hovered directly over one of them. Even though they were talking quietly, for everyone remote they were totally drowning out the main conversation.
> How are they going to do that?

U.S. jurisdiction extends on its territory and across the U.S. dollar. If a Chinese company wants to sell to no American companies and never use dollars, they're free to ignore American law.

More pointedly, we've gone through this before. With the USSR. Competitive markets develop better than command-driven ones.
So they should spam people rather than let people do searches and arrive at their site?

And that is just Basecamp. There are many other businesses whose best strategy is to "play ball" with the dominant companies. But they are at their mercy.

Many people (including myself) feel that this isn't healthy competition nor is socially optimal.

Regardless, my point was that you advocated a strategy that only works if all the small companies are cooperating....in other words, a game theoretically unsound strategy.
Do you have any recommendations for someone earlier in their career (<50 yo) to avoid or minimize ageism? Go into management? Be prepared to pick a new career?
> I think one of the easiest wins here would be what some US startups with unlimited leave were practicing: a required minimum of days off.

Any examples of companies that are doing this? I haven't heard of many, at least in the SF Bay Area.
Similar burnout happened with Ecstatic, a very popular Node.js static file serving library.

https://github.com/jfhbrook/node-ecstatic/issues/259
That’s a chilling title. How long before we have terrorists doing something similar over a crowd of people? It’s also very hard to track down the perpetrator.
The user wants the best product for their needs. If Basecamp only survives because its users don’t know about alternatives, then it’s not a very good business. This is actual competition: building the best product and letting the customers decide what they prefer. They already know about Basecamp in this scenario so seeing ads for other products will only let them make a more informed choice. The competitors, after all, are betting their advertising budget on the opinion that their product is better. It’s not free.
I would argue that monopolies have a detrimental effect on innovation, as they kill disruptive new technologies in favor of their established services. Having a strong anti-competitive policy may help us excel over China.
Exactly. Mid-50-something here. Currently looking for work in this "negative unemployment" environment. It's going to take a while, I think, just like it did last time I was out of work 3 years ago (took 9 months to find another gig then, though I have to admit I can afford to by picky).
Yes, when you build this: https://github.com/riscv/riscv-gnu-toolchain

You can configure it with the extensions your system will support. The minimal is RV32I and RV64I. It will be full-length instructions which are easy to parse and no extras.

./configure --prefix=$HOME/riscv --with-arch=rv32i --with-abi=ilp32

I'm sure you can build a C standard library with these options as well, so you won't be as limited as you think.

System calls are done through the ECALL instruction, and while it's mandatory, you don't really have to implement it.
Ok so the intermediary nodes are the concatenation of the children, that's what I missed. Thanks a lot for the details, and even more for the rest of your work !
Yup, I was laid off from my company a week ago, and they just chopped another 25 heads this morning.
They said the gangs buy the pork, not buying and selling futures...
> No, the attempt to make somebody do what you want by brigading is what's attempting to exert force and what's rude.

Unless the critics are engaging in threats, intimidation, and/or violence, we're talking about criticism and not force.

> Criticism isn't "force" or "attempted force". If you think criticism is rude, that's fine. Hypocritical, but fine.

No, the attempt to make somebody do what you want by brigading is what's attempting to exert force and what's rude.

> The author of the package didn't force their code onto the users.

No one is arguing this. Weird straw man.

> The authors of the criticism forced their criticism on him by throwing it his way in the form of bug reports etc. even when it was clear that there's no interest in it.

Wow. I really didn't anticipate the "bug reports == force" equivalence.
A small part of the problem is that the omakase options do change over time with changes in threat models and knowledge of vulnerabilities. One example is the recent push away from the NIST Curves to the more open knowledge Curve 25519, in part because of reasonable concerns that the NIST Curves were backdoored by NSA for easier cryptoanalysis. So you still need "low level" a la carte tools underlying and backing the omakase experiences.

Part of the problem of the Windows CryptoAPI in question is that it has to serve "both customers", the omakase sort that need the best option, and the a la carte needs to higher level tools serving as the omakase option. That is, for some traditional/legacy C/C++ users that CrpytoAPI is about as high level as they will get, and it's up to the documentation to steer its consumers to the best omakase options. But crypto32.dll also is the low-level backend of tools like WinRT's Windows.Security.Cryptography and .NET's System.Security.Cryptography (on Windows).

The push towards omakase and somewhat getting applications away from micromanaging the a la carte stuff, definitely seems the smart path. Handling the onion of it all in what needs to be supported at a low level to keep the high level omakase shop running smooth seems like it still has a lot of pitfalls.
I'm always curious to what extent work hours correlate with productivity. I think it was patio11 who shared his story of a salaryman co-worker fixing his bike in his cubicle on a Saturday he was "working" in the office.

And while I haven't seen first-hand the Japanese style overwork, I have seen Silicon Valley startup "overwork" up close and have similar concerns. My pet theory is that in early-stage startups it's so unclear what is actually valuable and productive work that the overwork becomes a proxy for productivity.
curious what makes you bullish?

i'm a total outsider but it does feel like the walls are closing around smaller players as the big get bigger.
DuckDuckGo Lite
From the technical specs it looks like it is powered via a 5V port: "Barrel Power (5V 3A) Port"

That would mean that you could plug in a battery powered portable USB charger (power bank) to increase its capacity perhaps. If 10000mAh at 5V gets you 8 hours then you you could easily extend the capacity with a couple power banks.
I have built some other GNU packages without issue. In particular, I remember having easy success with CLISP. But at the same time, I have not needed to try to build a lot of packages, as many are available as pre-built binaries already.
Bet CEO is getting a raise
The digital clock from a Soyuz spacecraft
Seriously, your best bet (and the advice I would give my 20-something year old self) is to SAVE AS MUCH MONEY AS YOU POSSIBLY CAN. And then save more than that. Try to be financially independent by 50. If you can do that then you won't have to worry about ageism. You'll be able to be picky about the kinds of jobs you take.

From a practical standpoint that means don't buy status symbol products (cars, fancy phones, etc) - stick to practical (I drive a '98 Civic that cost me $2400 - great, reliable car). If you buy a house, buy a very practical one in a more affordable neighborhood. Learn to do your own maintenance. Keep your expenses as low as possible. If you don't have a Roth IRA start one today and begin fully funding it. If your work offers a Roth 401k option put some money in there too if you can.

And of course, always be learning new things.