skysight-inc/HackerNews huggingface dataset:
Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe.

I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library.

(Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)
No, it wouldn't be acceptable
How the VP of Eng at Glitch runs a 40 person team without stifling creativity
A lot of this thread has it wrong, and this wrongness contributes to the problem which led to this.

I have two simple mantras which establish my philosophy here:

1. YOU are responsible for your dependencies.

2. Open source participants are volunteers and owe you nothing.

It was never Nikolay's job to vet actix-web for you, nor did it become his job when the library became popular, nor does invoking "security" change anything in the slightest. Your dependencies are your responsibility. Responding with vitrol, anger, or hate when failing to uphold this responsibility bites you in the ass is just being a jerk.

User entitlement is totally unjustified and will burn out maintainers faster than almost anything else. I don't stand for it. If any other maintainers out there are struggling with this, please send me an email: sir@cmpwn.com. I'm sympathetic to your cause and I can likely lend some pertinent advice.
Use the website PlayOnDocker and run there your experiments with NodeJS, free and out of restrictions. Otherwise, consider buying a VPS or build a VPN at home and doing your experiments on your local server
Some man pages are pretty interesting, like the ones for Perl if you use the language.

You could also become really, really good at using a text editor, it becomes a bit of a game and it's going to be useful for as long as you are planning to type.
Following Cyberpunk delay, CD Projekt Red expects dev team crunch
Similar but distinct from https://en.wikipedia.org/wiki/Microbiologically_induced_calc...
The US voting system of rules and procedures is full of practices which enforce this sort of extreme polarity. One person one vote makes it a two party choice through one person winning all of a persons vote-and thus unites all others through loss. One party take all makes all outside of that Rule united in opposition to the party in power. Etc etc
Hacking and Reverse Engineering Mini Arcade Cabinets
You're welcome; I think it's one of the most important concepts for programming communities to understand. Felt like a revelation when I read it, as someone who was previously very contempt-ful and regrets it.
I have found that using a flag system works wonders. Luxafor makes a USB powered light that I have attached to my station. Green means chat me up. Red means leave me alone. I have it set to an interval of 25 minutes red to 5 minutes green. (Like pomodoro timer). Took some time to get people on board but now its great and has expanded to not only my entire team, but other teams in the org.

Note: not in any way involved with Luxafor. Was given their product by a friend.
That's hardly what happened, though.
Yes, a business owned by shareholders.
But you can estimate it. Record your earnings every day, any compare it by the hour, day, week, and month, as well as miles driven each day. Estimate the total cost of driving (IRS estimate of ~$0.50/mile is a good place to start). Use this simple formula:

(Income - expenses) / hours worked = hourly wage

Is your hourly wage reasonable? If so, it may make sense to optimize away your expenses and generally stay the course. If it's not, would changing your work hours or location make it reasonable?

Unfortunately, I get your feeling that people only look at the income and ignore the rest of the equation (hey, I got $50 tonight! I had to drive 100 miles though...). If you're making $3/trip, you had better drive less than 6 miles or you just lose.
No doubt. I had an IT job that required me to drive around to schools in the city. Well, I didn't have some special parking pass or anything. If I got a ticket, or hit a red light camera, I'd make negative money for the day potentially. I ended up biking everywhere. The traffic in the city was so bad such that there was no time difference anyhow.
Just don't put any personal credentials on those instances (e.g. github tokens, aws access keys, etc). I don't know if it's still the case but when it was first released I was able to mount other container volumes and snag them. (Reported to Docker security)
Remote work is great for a lot of people, but in my case it doesn't. :)

I think leaving a job is often an intersection of many issues. Unfortunately, the remote aspect of the job can become one of them (as can a painful commute for local workers).
Where does 'community' fit into the business picture? There is a corporate owner, and (eventually) there are some kind of advertisers or other customers.

The volunteers who provide the content are not part of the business picture. Possibly if they organized they might be, but currently they're like chickens on a farm.

At one time all that was the obvious inevitable endgame of "walled gardens / web 2.0" That was why these sites were funded by investors.

Did this stop being obvious at some point since AOL and Yahoo went out of fashion? I'm sorry if I sound bleak, but this kind of horrorshow is a known problem.
Well, that is the way it seems to work out. The divorce rate here is very, very low. However, when people move back, they get caught up in the same (high) divorce rate of the place where they are moving to. In my opinion, family breakdown is very contagious. That is why married people better stay away from divorced ones. Well, that is how it works here. Divorcees are no longer accepted in the community. I think that this approach makes sense, simply, because it works.
The larger pity, to me, seems to be the maintainer's decision to not only quit the project, but to take down the repo with the intent to delete it:

https://github.com/actix/actix-web

I get it, they feel personally harassed and slighted. And it's their project, they can do with it what they like. But it still feels like the decision is motivated more by spite than by a desire to simply wash one's hand of the project. Surely there are not hostile developers who would've been willing to take over the maintainer role.
Ask HN: ML Comparing Adversarial ML libaries - Foolbox & IBM ART
Hi HN,
We are doing a project to compare Foolbox and IBM's adversarial robustness toolbox. What we are planning is to compare both the libraries implementation of attacks common in both. So we take attack X and see how IBM and Foolbox compares. We are looking at two metrics:
1. Time taken by each library to generate adversarials for the same attack
2. Accuracy of the original model on the adversarials
Are there any other metrics that are interesting for this?
What makes me sad is that someone spent a huge amount of time making something, working on something, supporting something. If you don't like that something, then use something else or write your own thing. I don't get how there is some responsibility of maintainers to turn a passion project into anything other than what they want?! Fork.
It's a good question. I'm involved in a large open source project that attracts some of this kind of attention. Because of the project's age, much of our infrastructure is old, which actually sort-of works to our advantage here. If you want to be a jerk to us, you need to go find our mailing lists and figure out how to send an email, or register a Bugzilla account and go file some troll bug. Much more effort than posting "You Suck" on GitHub or whatever. The barriers are insulating, which has pros and cons.

The other part that works well for me is disassociating your self from your project. Set strict hours for when you will work on the project, and don't work on it outside of them. Note that checking issue emails counts as work; remove your "work" email from your phone. I'm lucky enough to be a paid developer for the project, so I can clearly define my working hours as when I'm in the office, and ignore issues when I'm not at the office. But even for personal projects, there's no need to respond to issues within hours, or even days, if doing so is burning you out.

And the obvious answer that applies to anyone who creates anything online: Don't Read The Comments. In this case, that means Reddit. Reddit is a cesspool of uninformed users giving maximum visibility to whatever is most appealing to other uninformed users; not a good place to get useful feedback. Find spaces that are supportive and provide useful feedback, cultivate them, and spend your time there.
Read man pages!

These constitute a rabbit hole of extremely interesting documentation. They will help you improve as a developer, and more importantly broaden your horizons beyond what you ever thought was possible. Enjoy!
I agree with what another person has said on github- the rust community on reddit is incredibly toxic. The last time such a thing happened, there were losers who made personal attacks on Nikolay. Then Nikolay showed up in comments being angry that he had helped that particular loser only a few days back.

Its easy to create blog posts and comments about RIIR, its not easy to actually write code.

If anybody actually wants to fix this issue and prevent it from happening again, I'd start by instantly banning /r/rust users for 3 days anytime they do a circlejerk.
We're not expecting a warranty and we're not asking for damages.

It's not really surprising that the Rust community is made out of people who've chosen to take extra effort in security, and that they wouldn't tolerate a cavalier attitude to it. It's disappointing that this was expressed in an unconstructive way.
That situation is a little different for a number of reasons, but the broad strokes are the same.

Sam tweeted at me recently about this situation: https://twitter.com/sstephenson/status/1167856878673694728
Firejail: Sandboxing on Linux
Ask HN: What is your favorite podcast?
I am trying to improve my spoken English, therefore I am looking for some podcasts to listen while traveling.
No More Coding from Scratch? (2006)
I dont know what people expected from him, he was working 12 hour days already. If they didn't like it then they could just try to help him out instead of tearing down the work he was doing. Did he not accept PR's because he didn't have time to get to them all? Either way, writing an article further isolating him for all his work isn't going to make the situation better.
You can probably download the videos with youtube-dl and reupload them to archive.org.
I think there might be some cultural aspects at play here too as far as communication style.
Ask HN: How to keep your computer organized while trying different software?
I like to experiment and try out different software packages, languages, ect. Over time, my MacBook became a holy mess of abandoned dot files, forgotten directories. The useful stuffs gets lost in the piles. There's gotta be a better way to stay organized while trying new shiny things.

What's your strategy or method to keep your rig clean and organized over time?
> ..[Cloudflare] has the ability to monitor and alter traffic

> ..inspections into TLS traffic..

> SSH is not inspected by CF, despite being proxied by them

> HTTPS will be terminated by Cloudflare (and re-encrypted when talking to our origin)

As someone who works on the web and does use Cloudflare, I guess I knew these facts, but I must admit I have some doubts about the security and privacy implications, what they mean in practice.

It comes down to trust, and while I believe CF is an excellent actor in regards to privacy, this need for trusting a third-party makes me uneasy.

If CF (or anyone really) is in the middle, then couldn't we say that SSH and HTTPS are not (or less) secure?
> yet they don't incarcerate as many people as the US.

This is hardly the only comparison you should make. In terms of legal protection the US is much better than Japan when you are under arrest.
Singapore has public housing, subsidized healthcare, public schools, mandatory military service and public transportation.

Also living on any sort of low wage is massivly uncomfortable. Just affording air conditioning is difficult.

Even people with great jobs end up living with multiple generations of family in tiny apartments.
> The opposite is true. Unlike in electronics, construction, shipbuilding, you can write a shitty software and patch the hell out of it after release most of the time with the few exceptions.

What happens in software is what the market wants. You cannot claim that something is better if it is better at doing something that the industry doesn't want (and even that you can't show). It's like the Betamax vs. VHS: Betamax was better at some metric that few if anyone cared about, but VHS was better at what people actually cared about.

> Java was successful because

Java was (and is) successful because it was (and is) a very good product with good backing. At the time, other companies, like Microsoft, Borland, IBM and others that few now remember also heavily pushed other products, and they didn't do as well. I am not claiming that Java is the best possible programming environment, but it is pretty funny to claim that some specific platform/language is better with absolutely nothing to support that claim.
From what sklabnik's post says, patches were submitted but the author wasn't really receptive to them.
Define "normal people". From what I remember of the emails that were obtained about this, the server was wiped as part of a post-compromise remediation plan by university IT security staff.
Biggest Myths about Homelessness in America
A similar disclaimer is contained in the GPLv2 and therefore applies to the Linux kernel. Does that mean we can not impose any expectations regarding security on its maintainers either?

Why can't we have legal disclaimers like this so that the legal system with its tech-oblivious case law and multi-million-dollar penalties is prevented from interfering while also retaining softer sanctions such as the threat of community ostracism/obnoxious messages to incentivise some degree of quality?
Actually just to nitpick, even if we could find one string theory that works, remember that it's "only" math. Meaning that it could totally work to describe a phenomenon without having any physical reality to it.

Even if it predicts observation, like Bohr's model of the atom did, you have some degree of abstraction between the model and the physical implementation, so to speak.

And that's the ultimate problem of string theories: even if we crack some math model, if it can't be observed directly, we just don't know. Quantum mechanics currently sit in-between the purely theoretical (where we do have a model that works, minus gravity, if applicable at that level) and the barely observable (we can infer, a lot, but not much in the way of actually seeing things; although I think nowadays we've crossed that bridge anecdotally enough to be confident but don't quote me on that).

Therefore, string theory models may require higher dimensions in the math to hack the problem, but it doesn't mean these actually exist — like Clifford's algebra, Geometric Algebra, you reason with 4-dimensions to treat 2D (x, y) problems, and 8-dimensions to treat 3D problems — but that's just the math, and the beauty of that is indeed to "unify" other algebras which become essentially subsets.

It's really important to keep that in mind when "gunning for" string theories, or seeing them as "explicative", interpretable. They're really not, at least not now, and possibly ever due to their construction. In truth, it's more about brute-forcing the issue (kinda like current deep learning?), hence the wild ranges of "possible solutions", from 11 to 26 dimensions (some go in the hundreds in suggestion) because they're basically trying to use computers to identify dimensions wherein our universe "fits" quite well, and derive what we don't know (e.g. quantum gravity, or whatever that means in the "promised dimension level"). At a "basic principle" level, that's what string theories are after. It's pure math, it's crazy smart, it's really elegant and almost godly, noble because it requires the state of the art of our evolution and technology; but like quantum mechanics the "interpretation" will not be delivered with the equation, and it may never mean anything to us.
I am not aware of anyone bringing legal liability into this situation, in any form.
Iran vs. U.S., the Cyber Front Explained
I have literally never felt "judged by the CoC police" in any project that has one. I have no idea why you would ever feel that way. Pretty much every CoC says "do not be a raging asshole". I am fully capable of not being a raging asshole, and if I slip up and am, I would be happy to be told off for it.
Definitely agreed. A cheaper car can be a better deal, however anyone who's poor isn't necessarily going to have the resources (time, secondary transportation, and $650 for a water pump repair) to manage it safely.

A financially well-off family may have multiple cars, a garage, and some spare time. They can incur the risk of an old cheap car much more easily.
It's noteworthy that Luxafor supports Windows only. Mac is coming "soon", and no mention of Linux. I'd expect a large portion of hackernews readers to be Linux users.
> However, that doesn't mean there wasn't a problem. There was a ton of negativity around "unsafe" when the author first released the code, and it has kind of become a meme at this point. If a project consistently uses code in an unsafe way, is it really worth spending your time vetting it for your production use case? There are plenty of web severs out there, pick one that aligns with your goals.

Should people wait until credit-card data or PII is leaked due to security vulnerabilities? The problem with security is that it impacts more than just the programmers using the framework, it impacts everyone. Does the author deserve the nastiness? No. Do security issues need to be reported, and if not fixed, called out? Yes, for big and advertised projects issues like that need to be reported. If not, there will be users that would naively expect the web-framework they're using to be somewhat secure.

The framework had a professional looking website advertising the project, it had good documentation, a user-friendly API. It advertised a actix open-source community. Had over a million downloads. I would say that expecting actix to be run like a somewhat professional project is not a strange assumption.

The way it was called out was pretty terrible though, and I doubt anyone is happy with what happened.
It brings up the question — as a developer, how can you best set boundaries on your customers so that you can have some degree of control over the toxicity of the culture that you're exposed to when interacting with them?

Personally, I don't think you really can. I think the best thing to do from a developer/maintainer perspective is to identify toxic communities and do you're best to ignore them entirely. That's probably the best long-term approach from a mental health standpoint.

Especially when it comes to social media sites like Reddit, once a community turns hostile there really isn't anything you can do to turn it around.
I don’t have the full picture here, but the source article implies that folks weren’t just complaining, but also offering PRs to fix the issues, which were rejected. That feels less like entitlement to me and more like bad stewardship of the project, but again, most of my info is biased by source article.
If they have that many controls at the desktop, emailing code to a personal address is not going to go well.
More like you should be expected, as a user, to look at the code youre using and determine if it fits your set of criteria. If you dont think its updated enough, or the authors free labor isnt fast enough for your needs, then dont use it. You come off super entitled and arent the only one. This is the kinda stuff thats making me start my new projects closed source instead of open by default.
I'm not sure what do you mean, since AFAIK they don't have any "native" chat, everything is cross-chat ?
Write only ?
Contact-centric would be a nice goal, but the best you can do is probably Android-style "Contacts" ?
You can search for this information. Here’s a sample which talks about Chelsea Clinton’s take: https://www.politico.com/magazine/story/2015/09/hillary-clin...
This is a sad day for Rust. Situations can spiral out of control. Who started it? Who escalated it? You can't really define these because communication is sloppy and difficult, especially when there are cultural and language barriers involved. The only way to not get these situations to spiral out of control are a thick skin, forgiveness, and assuming noble intent.

There have been times on here where I see discussions around `unsafe` as if it was a curse. I think the discussions, over time, have gotten more nuanced which helps.

I also wonder if expectations were unclear. It now sounds like the focus of Actix was on performance and creativity / cleverness and not on being a mature product. I never heard that before. Maybe even the author didn't even originally articulate it so clearly but discovered it through these discussions.

Going forward, I hope someone archives their clones of actix and that people fork that and get it moving forward as a product. I hope people don't take a religious view of removing `unsafe` during the fork but instead follow best practices (benchmark to confirm the need, abstract it to test it, offer a feature flag for the paranoid to disable as much of it as possible).
Ranking individual pages is vitally important in the website traffic game.

Suppose Mozilla's goal for its blog is to generate a lot of organic traffic so that people are aware of Moz Corp's continuing development efforts. If that were the case, individual ranking of pages matters.

A domain name has a certain "rank," that's based entirely on on-page SEO -- or all of the indexed pages and site as a whole -- and off-page SEO -- or all of the domains and pages that link to it.

One of the algos in determining on-page SEO is cumulative ranking of all pages under that domain. That is, a single page's ranking is not an isolated variable based purely on that page and its content alone. The other pages that fall under that same domain impact every other page on said domain.

If Mozilla published a poorly SEO'ed blog article, that would negatively affect the ranking of all other articles under the blog.mozilla.org name -- and more severely any other pages that link to it or are linked inside of it.

That's only the first part. Suppose they wanted to generate traffic for this individual press release? Then that's a whole nother ball of wax.
Maybe you can connect your phone to your monitor? At least Samsungs have a desktop-like interface. Don't have much experience with it, but if you got a browser with unrestricted internet, you can do pretty much everything.
It does if you’re part of the moral panic that deems substances “evil” and thinks they should all be banned. You know, the same people who would rather kids die than have access to testing services because it might encourage some of them.
>Politicians dress up impeccably and speak beautiful language at the center stage - to conduct this dick measuring contest.

Let's change the narrative then. A dick measuring contest in terms of public privacy.

Cambridge, MA is heading in the same direction: https://www.boston.com/news/local-news/2020/01/14/cambridge-...
Is it possible to use larger chunks of data when working with packets from the kernel?
> At the same time, you should be expecting to do as little as possible for your compensation.

As little as possible within some allotted time, or spending as little time as possible?

The first one sounds miserable.
drivers make $400-500 per week in tips. you can buy a car for that.

> Why should they work for you when they could work there (Aldi)

Why work for Aldi when they can work for Dangus?