skysight-inc/HackerNews huggingface dataset:
I think the mistake described in this blog post needs a name. Let's call it premature dependence.

Like premature optimization, premature dependence compounds your maintenance burden over time because you predicted a problem which, if you had waited for evidence, would never have materialized.

In premature optimization, you imagine that a simple solution won't perform adequately, so you invest in building a more sophisticated solution up front. In premature dependence, you imagine that a simple implementation won't adequately address your needs, so you bring in a feature-rich dependency right away.

Both are driven by the fact that we spend the vast majority of our time, effort, and emotional energy dealing with rare cases. You don't spend hour after hour, day after day, meeting after stressful meeting talking about the database that scaled fine or the code you wrote once at the beginning of the project and never touched again. If you don't account for how the successful stuff disappears into the background, your model of reality will be skewed by rare traumatic events. (Which is kind of the point, evolutionarily speaking, since it serves as a kind of crude risk analysis, but it's not hard to do risk analysis better than your amygdala does.)

Of course, applying the rule in practice requires judgment. Some problems are inherently difficult; some explosions in complexity are predictable; you don't have to pay long-term costs on POCs and failed experiments; if you say you support ISO-XXXX format then you had better support every obscure corner case; etc. But it's good to keep in mind that the long-term cost of an extra dependency can be greater than the long-term cost of a few hundred lines of unchanging, unit-tested code.
People have been warning about BSafe and Dual_EC_DRBG for years before Snowden came along. Privacy advocates and security professionals had been placing out a blanket warning of "government" snooping for decades before Snowden. Richard Stallman, the guy who wrote most of the Gnu utils back in the days, had been signing his emails with M-x spook, which had been in Emacs since 1988. The Internet started out anti-spook way back in the days.
I have this little handy shell function for that:

semacs () {
emacs --eval "(setq server-name \"$1\")" --daemon
}

`semacs foo` then starts an emacs server named foo and and `emacsclient -s foo -c` attaches to it.
Yeah, we're agreeing. Hope for the best, expect the worst.
GM CFO Dhivya Suryadevara Leaves for SF Company Stripe
Mozilla rose to the top because IE6 was obsolete trash, Opera cost money, and Chrome didn’t exist. The “promise of an open web” didn’t enter into it.
And if my grandmother had wheels she'd be a bicycle.
Privacy nightmare not to mention solution looking for a problem.
A simple example would be an HTTP client. It’s easy to write a naive thing that makes GET requests with no request body, TLS, connection pooling, etc. Why should I use a dependency when I can write it in an afternoon? Well, I used to think that before I tried writing one :) The first draft was easy. Adding features got messy.
> I'm a bit at loss how this improves security or why it is necessary. If the kernel needs an external library as gatekeeper, something fundamentally went wrong.

It's not about defending the kernel from the user mode process. It's a mitigation to make exploiting usermode RCEs like buffer overflows a bit harder by possibly preventing some forms of ASLR bypass.

MS might do it in part for security, but likely aloo to prevent people from relying on unstable implementation details, which makes changing those details harder for MS because they try to avoid breaking popular applications.

> And why would, say a Lisp compiler use the C library

On unix based systems libc doubles as (part of) the OS's API. BSD in particular has no stable syscall interface, code must go through libc. Its libc doesn't even have a stable ABI across major versions, which is annoying if you're not using C. Non C languages are clearly second class citizens on BSD.

Linux on the other hand does have a stable documented syscall interface, so you are allowed to call the kernel directly, without relying on any OS provided usermode libraries.

On Windows it's similar to BSD, but you have to go through different OS provided libraries (at minimum ntdll, usually the Win32 API). At least these have a stable ABI. On Windows libc is little more than just another dll.

> but making this a requirement seems heading the wrong direction.

I disagree. IMO an OS provided dynamically linked library is a great abstraction boundary. It allows the OS to change its kernel interface or even turn operations that previously needed to transition into the kernel into purely usermode functions.

For example the OS might provide a mutex which in the first version transitions to the kernel on every lock attempt, while later it's replaced by a futex based implementation which only transitions on contented locks.

Or more relevant to the linked article, it allows implementing the same API on a completely different kernel (like Wine does), without increasing the kernel's API surface.
I think lots of subscribers there are from Russia (myself included), Ukraine or other ex-USSR republics. But still.

BTW, it's 1.25m already. Gotta be 1.5m tomorrow. And those users are extremely engaged - view counts on post from just an hour before is north of 0.5m.
> We think we might only need 1% of an external dependency

I've seen the opposite just as often. Someone things an external dependency can just plug in and solve the problem, then 16 hours later they've made the basic thing work with an external dependency with a bunch of internal code on top of it. Now you have a pile of fragile code which breaks when the dependency changes underneath you, you have a bunch of in-house code supporting a thing which might not be getting up-line support anymore, and you still have a bunch of internal code to maintain.

> Case in point: By this criteria, no one needs a grid/datatable library.So we write it "in an afternoon". Then we're asked for an export to Excel. Later on we're asked for pagination with large data sets. And then an export to PDF. How many afternoons did that cost you?

You can always migrate to a library at a later date if the scope changes. More-so, you don't know how the scope is going to change, how do you pick a dependency based on future scope changes?
This is a single binary that is compatible with the python magic wormhole: https://github.com/psanford/wormhole-william
We are having a deck and concrete patio built. That business is swamped with work. Also a shortage of lumber; not from COVID, but due to demand. I suppose being stuck at home, people want to upgrade their house.
Ownership of destructive devices is permitted but you have to pay a hefty fee to get permission. This is the same idea.
A Practical Guide to JWT Authentication with Node.js
Just another example why betting on platform languages always wins long term.
Ask HN: How do I succeed working at a startup?
I accepted an offer recently for a remote software engineer role at a startup with <50 developers. I'm looking for general advice or book recommendations on how to succeed and get promoted in this kind of environment.
> We have mapped out five specific areas to focus on...

Hey Mozilla, that's not how focusing works.
The article also states that this Ecuadorian judge later admitted he had lied about the bribe, and has met with Chevron 30+ times before the trial.
Great rule. I was wondering, how do you manage updating the Jackson JSON parsing package. What if you have 100 such packages and they get updated weekly with breaking changes ?
Salt Bae’s called cops on customer who wouldn’t pay for gold-wrapped steaks
> would you have sacrificed netflix or other stuff and continued to use pure OSS

Yeah, in a heartbeat. I actually never used Netflix and probably never will. I won't be be party to destroying what is good and not-like-TV about the web, for the sake of stuff that is like TV, and usually is less interesting to me than even silence.
> Through a controversial discovery process, Chevron obtained, among other things, Donziger’s private diary entries. But the company’s central piece of evidence was the testimony of their sole witness: Alberto Guerra, a disgraced Ecuadorian judge who’d been removed from the bench over allegations of corruption and who had accepted hundreds of thousands of dollars and other benefits from the company. After meeting with Chevron’s lawyers 53 times, Guerra testified that Donziger and his team had offered the judge in the original trial a $500,000 bribe and had ghostwritten the 2011 decision against Chevron. In a related case three years later, he admitted he had lied in his testimony.

Maybe because of the above?
Peer to peer internet is what is missing I suppose.
I think a store of value is exactly what MicroStrategy (and other large institutional buyers of crypto) are looking for right now.

If it gets to the point where people will be calling on their Bitcoin reserves, the IRS will no longer be a going concern, at least one that anyone will be paying attention to. It's insurance against the collapse of governments, and so any government regulation other than ones affecting its storage & ownership aren't relevant.
Well, my point was more that if a programmer thinks '5 minutes work' it's often 10+ minutes; so when a programmer thinks 'an afternoon', you can possibly lose a week. And then the article really doesn't work.

And yeah, I would and do write leftpad myself it it's not in the stdlib. But if there is a large library full of similar (string) functions that I might need, I would include that library. Not a singular dependency for this type of function.
And therefore not from a "tech lead" title.

Edit: I'm saying this because I decided to stop being "tech lead" recently, precisely because of the problem of responsibility without authority.

Yes, people respect me and my decisions, up to a point (we have several very competent people and we don't always all agree) . They did that before I was tech lead and to the exact same amount after. My work did not change one iota compared to what I was doing before. But suddenly I got blamed for some things that I had no power to prevent.

That's just not healthy.
Which countries have tried to distribute wealth? Most countries that people usually claim that about have actually done the opposite - they were trying to put the jack boot to a few million people's necks, and found that claims about redistribution of wealth can win you enough followers to actually do that. This is certainly true of Lenin and Stalin and Mao.
TikTok Tracked User Data Using Tactic Banned by Google
But we don't value things solely based on their natural resource composition; we pay far more for "labor" and other intangibles.

As a result of the above, the value of a natural resource changes over time. For example, natural resources used in electronics and batteries are relatively more expensive now than they were 100 years ago.

So, you can be technically correct by saying that wealth is zero-sum, but that's pretty much the same thing as saying "the world's 'wealth' traded for natural resources sums up to 100% of all natural resources"
Google funded Mozilla mostly by buying traffic for Search and Ads.

Google makes money from advertising, not browsers. Firefox doesn't hurt Google.
Great start here and a very compelling intro post. A couple of things I wondered about and didn't see answers to:

1. How ambitious is Bevy as an engine? Do you see it as aimed squarely at the casual-game space like ggez, or do you think it could eventually compete with Godot, growing more advanced features like GI? (I appreciate that competing with Unreal is probably, well, Unrealistic for the forseeable future.)

2. You talk a lot about keeping the build light, which is great to hear. Does this extend to deployment too? What kind of binary filesizes are you looking at for a "hello, world" game?
The G3 definitely, it was marketed, and marketed heavily, to the average person in the days of a beige box and computers being complex boring office tools.
>Not only must you compensate your talent at the top of the market and then some (including generous equity)

How is that actionable advice for companies competing with the richest companies in tech? You can indeed (hopefully) do the other things you say but you may simply not be able to afford to compensate them at top of market if that market includes Google or Netflix.
> Search compliance requirements

What is this?
“Space is big. You just won't believe how vastly, hugely, mind-bogglingly big it is. I mean, you may think it's a long way down the road to the chemist's, but that's just peanuts to space.”

― Douglas Adams, The Hitchhiker's Guide to the Galaxy

When talking about interstellar distances people just aren't equipped to think about the scales involved. They're so far outside of the scale of human experience that our brain really struggles to understand the magnitude of the problem.

We're talking about billions of dollars to set up a short term test camp on Mars, and by interstellar standards that is close to nothing.
Show HN: Convert your website into native Android and iOS app by filling form
> and it's not really a full language

Both DQL and HQL are complete query languages.
Wow this is incredible for multiple reasons. I'm also working on a dating app and pondered this "security/content" issue, and I am also a victim of spinal damage. I had cervical myelopathy in 2018 and had to have an emergency fusion on C5-C7. I still experience various neurological issues for which they can't trace (they claim it's not related to the spine issues), but causes symptoms very similar to multiple sclerosis (although that's been ruled out). Your condition looks and sounds even more serious than that. I'm sorry you've gone through so much. I hope your health improves and I wish you success!
> Mozilla sees itself as an Internet company.

I don't think Mozilla sees themselves as a "company". Their philosophical core is as a foundation promoting core believes. The title of their website is "Internet for people, not profit" and their recruiting pitch is "We're on a mission. Join us".
I rather take the afternoon for dealing with business related stuff, documentation, unit tests, architecture diagrams, improving the CI/CD pipeline.
In many ways the borrow checker is a tool for enforcing safe mutation of values. As a side effect it happens to prevent entire classes of memory bugs, but it also prevents many bugs that aren't related to memory safety. Historically that side effect was the motivation for designing and implementing it, but in practice it's useful as a general guide for writing rigorous and correct software. As a result, I don't think the borrow checker as silly in this context as you're suggesting.
I mean... this depends. I use Rails mostly in my work, and in recent years I’ve pared down the libraries I would use (ie. that will go into the Gemfile). I generally stay away from any other externalities beside this list of libraries, and so I make it so that they’re almost “my own.” Seems to be a good balance between getting too dependency dependent vs veering off to reinvent the wheel.
You have discovered websites that don’t demand JS! Seriously though I have JS disabled (FireFox ext. to turn back on per site) and the amount of broken or blank pages is saddening.
"Search is hard" deliberately misses the point. This isn't about whether search is hard it's about whether decoupling search engine from search index is hard - whether the APIs used by one could be used by others.

This trick you're echoing is, incidentally, used every single time a government comes looking at unbundling opporunities. I remember distinctly how Microsoft claimed it was "too hard" to decouple office from windows. The banks in the UK made the same claim. They were all equally ridiculous and all equally self serving. There is a lot of precedent here.

Google will pretend that it is "impossibly hard" to expose their internal APIs as well, just as every other company did. It would be surprising if they didn't.

Search is hard, yes. A lot harder than exposing APIs, isn't it?
Nice! I was wondering before whether Eliza, the 17th century spy girl from Neal Stephenson's "Baroque Cycle", was inspired by historical examples. It seems that was the case.
>if the people writing the code are being murdered

Source?
That press release had words. That's important
How does Netflix hurt not-Netflix?
Doesn’t google activately invest in these do monopoly reasons? Surely Safari and Chrome based off WebKit aren’t enough?
Obviously each situation is unique, however, I’ve been burned more often by trying to clean up hand rolled out code than using a library.

I can recall quite a few instances where engineers, even experienced ones, went down this path ended up trying to reinvent such age old technologies as version control system, web server, just to name two.
> I think there's a very good argument they the center of the open consumer internet is the browser, and that soloing functionality off of that (even if the particular thing you are promoting happens to be an open solution) ends up just reinforcing the trend toward balkanization of the internet into domains of disconnected functionality mostly ruled by proprietary apps and services.

That seems like the exact same argument people said with IE6.
What about the system we had between WWII and Reaganomics, when not only was income inequality smaller, but most of computing was also invented (using state money)?
For anyone looking for an Elm like experience but without the limitation imposed by its creator, take a look at Elmish, a port of the Elm architecture in F#.

Advantages: You can use F# on the front and backend. Pretty good js interop with a lot of opportunities to shoot yourself in the foot.

Disadvantages: You will probably need to use the Elm docs/tutorials to learn about Elmish.
You're right. Phoneix/Firebird were basically a clone of the obviously-best-to-copy Opera features but without the ad bar, with a more native-feeling UI, and maybe (IIRC?) even lighter and faster to launch. Built-in popup blocking, very lightweight and snappy, tabs, free, no ad bar. Those were the selling points, and aside from the last two and slightly odd-feeling UI widgets, Opera had them already.

We lost "lightweight and snappy" way back in FF 2.0, and every browser blocks pop-ups now. Today's equivalent would be making ad blocking built-in and on by default, which it isn't. The advertising and constant "we updated!" tabs opening up (yeah, great, I don't give a shit, stop telling me) are at least as annoying as Opera's adbar was, IMO. Hopefully we get a spin-off browser eventually that gets back to FF's roots, and then eventually eats it, like FF did Mozilla Browser.
The greatest lesson I took from the book was "no mode switch".

This is an excellent principle for software development as well IMO.
No, this article is not about that. WeChat ban is about national security - privacy, because Americans are having their data mined.

The only sanctions levied because "they are owned by Communists who have over a million people in forced re-education camps" have been on 11 Chinese suppliers that have been barred from obtaining some US licenses.

So you have to accept that pretty absolutely nothing is happening because of that, and thats what you are going to have to tell your children when they are old enough to ask.
RSExecute: I've got Microsoft Scripting Libary 1.0a

> Copyright 1999 Microsoft Corporation. All Rights Reserved.

Versions above are from the article [1].

XML Data Islands network requests:

<OBJECT width=0 height=0
classid="clsid:550dda30-0541-11d2-9ca9-0060b0ec3d39"
id="xmldso">
</OBJECT>
<SCRIPT for=window event=onload>
var doc = xmldso.XMLDocument;
doc.load("books.xml");

JSONP: I've referred it as an idea of loading data in remote <script> callback.

>>>> You could even do that before XmlHttpRequest

MSXML is just a widely deployed ActiveX control, not part of the browser like favicon. Anyone could implement it or java applet.

[1] https://daurril.org/wrox/ASPToday/990930-191.htm
I think the distinction between natural rights vs legal rights comes into play here. Society has changed a lot in the time since the Constitution was written, and government isn't exactly incentivized to limit its own power in ways that reflect these changes.
Certainly not in rayiners golden era. Slavery wasn't abolished through democracy and civil rights were won 60 years after the end of rayiners golden era.
To some extent, that is true regarding my personal preferences, but being in tech and writing code for over 20 years teaches you a few things. Developers should be more picky about tools they adopt without becoming too cynical or dismissive of new technology. Every so often you have to go through your technology shed and be sure you aren't being biased towards existing comfortable tools. It's nice to work out of your comfort zone and learn new things, but it's also nice to be very efficient at problem solving. When I feel a new tool or technology crosses a threshold from hype to having proved its value I tend to take it seriously and learn it. I try to avoid getting sucked into tech stacks that I don't think will make it. Some times I am wrong, but usually not. I could have made my description of technology more generic, but in general, things like Django/Rails/Postgres/MySQL/NodeJS/Redis are battle proven technology that won't let you down. IMO that is the hardest part about being a lead engineer / CTO -- knowing when to say Yes and No to given technology stacks :)
I certainly don't think the corporate doublespeak is reason to switch to Chrome, but I do think the corporate doublespeak in this announcement is just awful.

When you're doing a layoff, just announce the layoff, show compassion to the affected employees, and if you want to announce other changes, do it in a separate announcement. Putting stuff about the fight against systemic racism in the opening paragraph of a layoff announcement is just inviting a tidal wave of eye rolls.
Frameworks like this and other similar non-standard approaches like Elixir Phoenix and LiveView are awesome, however, I'm still lost as to how one should go about styling and / or dynamically structuring styling?

Does anyone have recommendations for guides or simple approaches that only focus on the pure UI side of the problem. I've never really "had" to learn JS and honestly every time I have to dip my toes in it leaves a very bad taste in my mouth.
No, even technically, it is wrong.

Here is a Google example from when I lived in China: Google was at the time competing with Baidu over the search image market in China. My home internet was fast and with great quality. Only Google image search results had very often problems loading image previews. Its not that it "didn't work". It just failed "a little", maybe half the images in the results pag didn't load. So Google image search wasn't really blocked. It could have been total coincidence that it was like that for years and only for Google image search. The site that was coincidentally competing over the lead in the Chinese search market against a Chinese company. After some weeks, I started using Baidu image search, even though their result quality was worse. But at least it worked. I am sure many people in China did. That's "competition" in China.
Does the Mozilla foundation fund browser development?
I’m not going to argue that our political and social economic systems don’t have flaws. I do think directly merging political and economic power into the same institutions would only make it worse.
Biden Picks Harris for VP
Yes, this would be a case of (IMO fully justified) pirate radio.