skysight-inc/HackerNews huggingface dataset:
Does the npm Security Policy discussed at https://www.npmjs.com/policies/security govern testing of all NodeJS modules that are available via npm, or does this policy relate to the software that provides the operational infrastructure for npm itself?
Unfortunately D doesn't allow substitutions like Perl.
Statistics can absolutely be both racist and inaccurate, because you can choose which numbers to highlight, or how to slice and dice your data. Simpson's Paradox is a perfect example of how you can bucket data to show a trend that is the opposite of reality.
> you basically have built-in Redis with Erlang's ets

The big difference there is if you have a Dockerized app, Redis won't be restart on every deploy but the BEAM will be so you will lose your ETS cache or whatever you're storing.

Now, I know cache is meant to be disposable but this model of using ETS instead of Redis reminds me of a Python or Ruby app storing its cache in memory. I mean, sure you can do it but for the longest time (7-8 years?) the community as a whole kind of landed on keeping that stuff out of your app's process.
Garbage collection via pneumatic tubes
"Coca-Cola, sometimes war"
Is that the Mac way?

This is how you run a third party Firefox binary package downloaded from Mozilla:

tar xJf firefox-x.tar.bz2 ; cd firefox ; ./firefox

Most third-party commercial applications (CAD software etc.) is similar.

Obviously there is room for improvement here, for some basic sandboxing (chroot, dedicated uid and so on) and desktop integration (give the user an icon to click on, links to other applications).

It's just that Snap (and probably Flatpak too) just isn't it. Much too heavyweight and gave the users other things to worry about (disk space, updates, new types of package repositories). Something more fit for Linux culture would probably be closer to a set of best practices (this is what the executable is called, this is where libraries are put, there should be an icon here in this format), and let a thin wrapper handle it all.
> theoricaly

Please, do not use theory as a synonym for hypothesis. Evidence has failed to validate the anarchy hypothesis at scale.
That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.
Interesting point about B2B as a diagnostic process. I reached a similar conclusion organically but didn’t have that language for it. Essentially, I’ve found that saying “based on your description of your challenge, the product I have today isn’t a good fit” buys you a ton of credibility for when you DO have a good solution available.
An appropriate tone would be to press the angle that help is needed and either offer to help patch the applications or mention where contributors can get started.

I get the author's concern but there is nothing useful in this article. It's misleading suggesting that the problem is with flatpak when the problem is that certain applications aren't using its full capabilities, aren't configured correctly and are in need patching. Or in the worst case, might need a redesign to fit the sandboxing model. This needs to happen with any sandbox that uses this model, not just flatpak. There is nothing else that can be done about this short of suggesting users switch to a different sandboxing model like Qubes. (Maybe the blog author can try that too and see how it goes, or could develop their own sandboxing model just to see how hard it is on a complex system like Linux)
That's not very useful way of thinking.

.deb packages format for example are quite uniformly established and provide a lot of interfunctionality on many different systems. Of course you are going to find other obscure systems and even big other ecosystems (RedHat obviously, and derivatives), but the format we are looking for doesn't have to be the single one either. It just has to work well enough and be somewhat universal. .Deb-level of universality would suffice just fine.
> However relying on encryption feels a little repugnant as it relies on transferring trust to a mathematical minority that truly understand it.

Physical locks also rely on a minority that truly understand them. A bit less true now that you can find lockpicking tutorials all over the place, but most people just trust their locksmith, who, in turn, trust lock manufacturers.

> And no encryption has ever gone unbroken with time.

Depends on what you are meaning by "broken" and by "time". For example MD5 is broken for collision, but not for preimage, and some algorithms are broken only in theory. As for time, what do you mean? 5 year, 50 years, the age of the universe? And anyways, it is the same for almost every security measure, including physical locks.

> Should there even be a contrived concept of property in the digital universe?

It is an interesting subject because you are probably going to get very different answers if you are talking about DRM or if you are talking about personal data, even though they are both tied to the concept of property. And in every case, it is backed by law. A burglar is not allowed to steal your stuff because your lock is weak, and picking a lock without permission from the owner is illegal. In the same way distributing copies of copyrighted material is illegal without a license, especially if you crack the DRM, and personal data is protected by law (unless you give a license).
I have literally gotten 4 PRs in previous hacktoberfests with typo fix.

I am internally debating if I should participate in this hacktoberfests given the spams going on
>Common runtimes have un patched security issues.

This is an area where Ubuntu's snap ecosystem does better. Instead of essentially trying to create a meta-distribution, snaps provide a way to run software built for Ubuntu LTS on other distros, at least in theory. They are compiled against Ubuntu LTS runtimes and are built primarily from packages in the Ubuntu LTS repositories. Further, when any Ubuntu based dependencies of snap packages get security updates in the Ubuntu repositories, the owners of said packages are prompted to rebuild their snaps.

In contrast, it's not clear who is assuming responsibility for maintaining flatpak runtimes like org.gnome.Platform, or what is their support lifecycle. It would be better to promote runtimes based on a well-known distribution's packages, since they would get security updates in accordance with that distribution's security policy. For instance, something like https://developers.redhat.com/blog/2020/08/12/introducing-th... looks more promising from a security point of view.
Valve did exactly that in Steam for Linux at some point. [0]

[0] https://github.com/valvesoftware/steam-for-linux/issues/3671
tar solves that problem too, it's a matter of what type of abstraction is a good fit for the problem at hand.
Enroot sounds interesting:

https://github.com/NVIDIA/enroot

It basically returns containers to their chroot origins, promising "no performance overhead." I'm looking forward to more posts on that.
How is it any better than flatpaks having full access to your home directory? Yet, one of the points of criticism against flatpak is that it doesn't protect the users home directory.

Now, it's certainly debatable if flatpak could or should push more in that direction, like apple did when they introduced the sandbox for app store applications, but flatpak certainly does not have leverage to the same extend as apple has. So it's up to the app to opt in to a suitable sandbox set. It's a sad state of affairs, but I don't see a viable path for the flatpak folks to change that.
Please don't pretend that Australia is free of racism. There are plenty of backwards and indefensible views that are socially acceptable and given plenty of air time in mainstream media: portrayal of Aboriginals as a drain on society, narratives about "African gangs" and the "cashed up Chinese buying properties". These are not niche opinions, they're mainstream.
US President tests positive for coronavirus
The problem with privacy as a concept is that it's ultimately just a metaphor. Privacy can exist in the real world, where our perception is limited by physical distance and obstacles.

In the digital world, however, information has different barriers. We like to recreate the mechanics of physical information rules, like separating chats into "rooms", where you be in a room and see the information being exposed there, or not.

But ultimately, these abstractions only serve us in in terms of usability; they don't share the same implications for information control that they have in the real world. Data in a chat room does not exist only within that room: the "room" itself is ultimately just a view into a much more messy underlying digital data structures. Something you say in a digital closed space can be heard, seen and read by somebody who never once stepped foot into the space.

I don't think "privacy" is still a meaningful concept in the online world. The rules of "online privacy" are fundamentally different to those of the physical world and I would prefer using a different word altogether to make this clear.

A few fundamental questions we need to answer before we can have any meaningful discussion on online privact:

- What is information?

- Is there an "atomic" unit of information?

- When is a non-atomic unit of information "true" or "false"?

- When are two units of information equivalent?

- When are two units of information the same?

- In what ways can we act on information?

- In what ways can information flow through a network?

- What legal connections can exist between a unit of information and a legal entity?

Many of these questions also lead into topics such as copyright and intellectual property, which makes sense given that these are ultimately also frameworks to control the spread of information, just with a different motivation.

Those are my thoughts anyway, and I haven't exactly looked any of that up so there might already be a consensus in philosophy on how to answer some, maybe even all, of those questions.
Thanks for commenting here, I use HA and I will contribute :)
I could essentially do it in my system without any modifications.

I use desktop + laptop hooked up to the same screen and sharing mouse and keyboard through a usb switch. I can toggle between systems with a button on my desk without giving any clues of anything happening.

Completely different machine, so no hopes of ever seing that.
Those SF salary numbers are always so insane, from the point of view of someone in Europe. I never know how to process them.
It is not really a big part of the thesis, rather an observation.

What you say about private communities is also true. However, I was referring more to the fact that everybody seem to nonchalantly use violent words and dangerous statements to express their disagreement, i.e., people are not just wrong, they are evil bastards that must be removed from public life and the nation itself.
The Deepfake Threat Intelligence Platform Is Online
love this product, looking to purchase a subscription to ensure it stays around
I don't get the conception that the top problem our world have is people being judged about what they said.
And that lynch justice is the greatest bane we face.

Don't get me wrong, it's a thing I highly dislike.
But it's a thing I worry the least about.

Right now, we have leaders across the globe that put themselves as representing the victims of mob justice and politically correctness.

But these are the people with power, these leaders. A lot of them, bulsano, and trump, make it a point to say whatever the want. Most of the time knowingly lie and cause harrasment to regular people who oppose them.
These are the one that have real effective power in the world.

All this cancel culture "violence" is a mere slingshot to the literal nuclear weapons
The representatives of their so called victims are holding.

The greatest bane to the world right now is attention theft. It's the news cycle, the constant barrage of irrelevant information. The murder of effective discussion and thought.
It's a totally different concern. I don't understand how PPAs and similar distribution approaches (i.e. native packages with hosted build systems) are getting mingled with flatpak and/or snap sandboxing objectives.

You can distribute open source software via flatpak or snap. And you can create a build system that takes open source software as a source and creates a flatpak or snap distribution.

It's totally possible to hide a backdoor in an open source software.

A working sandbox will prevent certain attacks to your system, whether it was built from an open source or not. This already works on most (all?) mobile operating systems.
> Then you have the interface side which writes firmware codes for these chips ( SSD controler ). These are more like your typical software engineering, you will need at least BC degreee and well verse in C/C++. But usually it's hard to get in with a BC degree unless you are recommended by one of the employee.

Idk how one gets in at all seeming as how the few jobs I've seen in this sort of function want a decade of experience writing firmware for the same class of device as whatever the company is doing.
> but still average over random choices your algorithm makes

Worst-case complexity is usually defined on Turing Machines or Von Neumann machines. In these models, algorithms cannot make "random choices", they are deterministic.

If you want to use a different computation model, you have to explicitly define it.
array.includes() is an O(n) method in the size of the array.

isVowel(c) implemented using array.includes() on a fixed size array is O(1) operation - it does not depend on the size of its input.

You can see this more clearly by asking what complexity does array.all(isVowel) have? Well, for each character in array, it needs to do 5 comparisons. So, for n characters it will do 5 * n operations. So, it is in O(n). This also proves that isVowel() is an O(1) operation.

Now, if we were to think about comparing to all vowels in all languages, you can also say that isVowel() is O(n) complexity in the number of vowels. The above analysis would show that array.all(isVowel) is O(n * m), with n being the number of characters in array and m being the number of vowels we are considering. Even this though is pretty strange, since Big O complexity analysis is only relevant if you are interested in the growth of n and m, which is unlikely for the number of vowels.
People are saying the system is racist.

Surely that means that information generated by the system is also going to be influenced by that racism?

If we over-police, over-charge, over-prosecute, and over-convict one group of people then the system will generate "facts" that tell us this group of people commit more crime. Obviously we don't know if that group of people do commit more crime because we're relying on broken data.
A Survival Guide to Being a Woman on the Internet
I think he's just saving on keystokes because those Model M's are getting hard to find.
I found also interesting information about best practices in healthcare technology implementation https://www.n-ix.com/7-best-practices-in-healthcare-technolo...
> Are these features lacking?

I mean they are lacking if we don't use Flatpack or an alternative so we have to either use it or invent something better.

> Seriously though, I am not sure how most of Gimp, VSCodium, PyCharm, Octave, Inkscape, Audacity or VLC will be useful to me or anybody else without host fs access.

I don't need any of these to access anything outside a specific directory (or a small selection of such, but I don't need them to access the full home dir, let alone the full root fs, even for reading). Hopefully flatseal can do this.
Location: Barcelona, Spain

Remote: 100%

Willing to relocate: No

Technologies: ReactJS, React Native, Ruby On Rails.

Résumé/CV: https://alamedadev.com

Email: hola@alamedadev.com
How about James Damore's views at Google?

Obviously a lot of staff disagreed with him, but the way they treated him could in no way be described as "inclusive". How would a situation like that be handled?
I want to argue that data gathering (in total) cannot be more valuable than selling stuff (in total), but I think that relies on a naive “pyramid” model of the economy. If I try to model this statement with actors (agents), I think it’s possible to build a set of mutually re-enforcing markets, where the value of data gathering for advertising is actually more valuable in aggregate than the “stuff” being advertised!
To an electronic engineer a frequency generator in fact is a clock.
when was the last time you fully audited a ppa? Like the source, that it builds from the canonical source, all patches it applies, all install scripts it packages and all changes it actually does? The trustworthiness of the ppa author. I know that I at best do cursory checks based on the reputation the author or the source linking to the PPA have, but I'm aware that this is a honor based system, and open source is practically irrelevant to that.
It might happen though. Look how Git made a neat change in the CVS domain.

Admittedly, it takes people aware of the issues with the current stack, and the ability to take a different successful approach.

Those behind Wayland were competent about X11, as far as I know. But for some reasons, adoption of Wayland is still scarce.
I don't really have a recipe, as such. I usually mix, say, 100g of dark rye flour, 200g of hard white flour and 200g of wholemeal, einkorn, barley or spelt flour with a big dollop of my sourdough and add water until I feel it's right. I leave it for a couple of hours to autolyse (normally done before adding yeast, but I find that's too much hassle to mix in the sourdough later) then give it a good knead for 10-15 minutes. I let it sit overnight, say 12 hours, to rise in a covered glass bowl, then I take it out of the bowl very carefully (because it's a big sponge of dough at that point) and bake it at 230 degrees C (which just happens to be the maximum temperature in my mini-oven) until it makes a hollow sound when I hit it with a wooden spoon (about 60 minutes, it's a weak oven). I let it sit for 20 minutes before cutting into it. And avoid putting any pictures on Instagram whatsoever, very important for the success of the bake, that :P

My flour proportions are completely non-standard, I fear, that is I don't follow any standard baker's percentages or anything. In general, I make it up as I go along, so I'm most likely doing something at least unorthodox. But it seems to be working, probably because it's hard to make really bad bread with good, organic, wholemeal flours.

Edit: really sorry for the vagueness of the recipe. This is how I cook, in general, making it up as I go along. I like to surprise myself, I guess.
It's an audio interview, right at the very top of the article.
What is "SKITG"?
Why not live in a tax arbitrage area like the wa side of hood river or Vancouver wa. You could basically pay no income tax then do most of your shopping in Oregon for no sales tax. You would come our way ahead and it’s a lot cheaper
> A whole new Twitter account @shitoberfest was created to track this

Not looking to discount the severity of the problem in terms of productive time lost, but the use of the word "whole" there wins my overstatement of the year award.
My argument is that without privacy we cannot build and defend other rights. Privacy allows to define private, social and public spaces with different rules. Without privacy your private stuff can be shared with the public. You could lose your jobs because you said something that your community does not approve.
Privay in the modern world is like borders. Without borders we cannot really decide which laws to apply, because anybody could come in and go, so it would become impossible to enforce any kind of law.
You don't understand how something running as root with full access to your entire filesystem is worse than something that has access to your home directory?
Why do applications have to be installed from strangers?

If you're unfamiliar with computers then you should only use things sandboxed as heavily as web pages or native apps that have been carefully reviewed by operating system maintainers.

If you know enough to make a useful decision on the safety of an app than you can probably build it yourself from github.

This practice of flinging binaries around is only useful for "software markets" and almost always seems to end up distributing the most pathological garbage possible.
You still needed override constructor with makeObservable(this). This is too far from the grace of decorators. It make me sad.
I’m guessing this means half its size along one dimension - if I have a square of side length 2, I can break it into 4 unit squares (or 2 rectangles as you said).
I agree that if the fast solution is 10x the code then maybe choose another solution. In this case all 6 solutions are basically the same amount of code.

There's absolutely no reason to choose the slowest solution.

50% can easily be the difference between some VSCode extension making it sluggish vs not.

Further, in my experience slow solutions will eventually come back to bite you.

One I saw recenty. see if 2 arrays contain the same elements. The "simple" solution is sort copies of the arrays, concat them into strings, compare the strings. It looks simple but it's around 1000x slower than pretty much any normal but not 1 line solution. 1000x won't matter when you're testing your 5 element arrays in your unit test but it will matter then your users start using larger arrays.
Japan seemed to me a case study in hiding sociocultural problems with https://en.wikipedia.org/wiki/Appeal_to_tradition and specifically some sort of perverse derivative of Confucianism. Korea has the same problem. It's a dead-end culture: China and Vietnam finally threw off the shackles in the 20th century at great cost, but Northeast Asia's sociocultural and political economies are apparently still largely running on ideas generated by a 5th century upwardly mobile accountant.
Thanks for posting those links. I admit I haven't got around to reading Solove's work yet, but a friend gave a brief explanation of his taxonomy to me a while back. From memory, there's a key diagram covering activities that are affected by privacy like data collection, processing and dissemination. I'll follow those links and have a read.
It is too much. I was trying to fit the sentiment into the HN title character limit. :)
There is a live discussion on this here
https://www.youtube.com/watch?v=1HbfTCJ-Yqo
Probably “SKin In The Game”
That can be fixed by capping wagers across the site, leveling the playing field.
.deb is a format in the same way that .tar.gz is a format. If Fedora or Arch used .deb the problem would no better because each distro has its own package names, its own package versions, and its own downstream patches.
Facebook sues two Chrome extension makers for scraping user data
Obviously. Buе this principle should not be followed fanatically. In the real world there are cases when a new standard can be introduced for good and take over. You just have to thing twice before inventing a wheel - to make sure it's going to be sooooo much better that it's worth it.

In this actual situation we have ther isn't going to be "14 standards" because there is no standard (for packages of this kind) so far, only a number of candidates. The first one to be good enough will become the first standard.
Points on those site are meaningless.
Facebook sues two companies engaged in data scraping operations
I think it’s referring to the fact that the big asteroid could fit four medium asteroids in terms of area, while only two medium asteroids come out when it gets destroyed.

This is the same for medium to small asteroids.

In the comparison image from one large to four small asteroid you can see the reduction in total area of the asteroids.