skysight-inc/HackerNews huggingface dataset:
reading through this I wonder who funded this. it would be more useful to have comparisons across both FOSS and commercial stacks. instead it reads like an amped-up jab against FOSS:

> One reason why open source components are so popular is that 35% of developers consider the availability of full source code to be the most important reason to choose an OS.

...

> There is a wealth of literature pointing at the risks posed by third-party components on enterprise software, including opensource,

^^ here they're linking 3 studies on Springer on why "Open Source is bad for security".

and

> Table 1 lists the stacks that we ultimately selected for our analysis. Note that (1) most of the stacks are close to two decades old, which means that many versions of their code exist, and many devices using the stacks are probably end-of-life; and (2) we only provide examples of notable OSes using the stacks, so the list is far from being exhaustive.

... which in my book is a life-cycle problem. none of these devices were meant to be maintained once online. upstream FOSS devs were likely not asked even if they could provide commercial support.

so it reads like a blame for some very deep fundamental issues (of not being able to upgrade - never mind the lack of the technical process there isn't even a business reason) that is blamed on old vulnerabilities.
The national security concerns are just an excuse to derail the biggest mobile app from China.

TikTok is just short videos. It's not like Facebook or Twitter which are more likely to be used by someone who is an adult.
Probably few people interested in the subject matter here, but as a piece of gentle snark I found this wonderful:

https://www.researchgate.net/publication/342317256_A_systema...
Actually the best way is to allow free use of RHEL for those who don't want to pay for it.
Well, sure. Because people who want to develop products on some platform also want some kind of warranty, which is explicitly not provided.

Google establishes with the public a warranty- and guarantee-free use license. If someone feels they've been harmed by the software, they're prevented by the open source license from suing Google, but they're (more importantly) also giving up their right to sue the individual contributors.

At the same time, vendors want to be able to hold suppliers accountable for support and warranty on products that are supplied. Permitting sublicensing allows Google to sell the software to OEMs and vendors with support agreements that allow those vendors to hold Google responsible for that support (rather than the individual contributors).

There's a lot of complaint about the sublicensing going on, but I think most vendors aren't going to build systems where they can't get support, and I don't think contributors actually want to be liable under tort law for the code they provided for free.

Then again, maybe the objection is to giving code to Google that Google can profit from. I guess that's fair, but you don't _have_ to contribute code and you're also not prevented from sublicensing and trying to turn a profit yourself.

(edit: typo)
> some law that can be used to force TikTok and other companies to respect user privacy and store data safety. The US has basic no laws

What makes you think TikTok / China would abide by such a law, if there was one?
Pretty sure they're just making a joke that a lot of bug bounty programs get tons of bullshit reports from security "researchers" who don't understand what they're doing. They're not actually claiming there's a legitimate issue.
Spotify high quality is 320 kps, if I remember correctly. This should be indistinguishable from lossless unless something is weird with the track.

I've done A/B testing with decent headphones (http://abx.digitalfeed.net/list.html) and not been able to tell the difference. Maybe you can, but I'd bet that most people can't, and in any case the result is far from butchery.
For one, I don’t think we should strive to be more like China. Second if we are going to ban TikTok at least make up some law they are breaking. For all it’s issues, at least there are laws the Chinese can point to for banning Facebook and google. And there are also remedies they can point to to return to China.
Photographers send Sony a7S on a weather balloon to shoot the Aurora Borealis
The idea that tiktok is spaying is pure nonsense with very little evidence. What tiktok is collecting is not more than what Google or Facebook is collecting and that information is not more valuable to China. The Chinese government is less likely to harm you than your own government with that data.

The move to ban tiktok is a signal to US investors to not invest in Chinese tech companies which are making good progress. Sadly, this strategy may not work unless USA is able to bring the entire democratic world with them. I do not see that happening either.
> I am once again puzzled why the largest Linux distribution has such an underwhelming UX for an crucial feature

Are we talking about Ubuntu, or Android? Because honestly in either case... what would you improve? Ubuntu has updates rolled into GNOME's package management frontend and it's seemed to work well, and Android has decent UX around updates (especially with A/B system partitions) although of course it suffers from vendors not actually releasing updates.
Adding Google Calendar to Your Jamstack
Any product which contains an non-removable battery eventually "just dies" whether it costs $550 and is made by Apple or not.

Decades-old Bose QC 15 headphones still work because the battery is replaceable. Pop in some new ear cushions every few years from Amazon and they are like new.

Don't expect these $550 headphones to be working 10 years after purchase.
Yes, with great pain, backing a graph database. Powering billions of dollars in revenue.
This entire comment thread is an example of information asymmetry. Lot of people here, especially Americans that should care about their country's sovereignty and safety, would actually agree to the ban if they knew that Tiktok is a propaganda tool that is influencing your children and is also a data mining paradise that can be weaponized to enhance data collection for targeting dissidents or other nefarious purposes. The fact is, not enough people in this country understand that China is an adversary, not a friend to the US. In fact, "adversary" is putting it lightly. This is not a partisan issue and it is not a "Trump hates China" issue.
Problem is Adobe's minimum contract length is a year. The monthly price quote is that price divided into months. After a year or two you could have afforded to outright buy it under the old regime.
For me, the ability to switch between audio on all my devices instantly. Listening on my mac, answer a call on my iPhone automatically. I realize this is a niche use case, but would be really nice for me.

The ability to just take them off and have them pause is icing on the cake as well.

If other headphones have these features, I'm open to them.
You must understand that America's goal is not to protect Americans' privacy. It is to protect its own monopoly on violations of Americans' privacy.
Make that a trio.
What will change...? A lot of F500 companies have a lot of infrastructure and changes are not fast.. HPC industry is another one of those. Unless you mean startups?
If anyone's interested, I'm particularly proud of my SVG animations in this readme:

https://github.com/boemska/create-sas-app
GitHub have the gall talking about accessibility while flinging their octotentacles, dragging users screaming down to the firey pits of JavaScript hell.
I think you are describing this behavior: https://support.apple.com/guide/iphone/switch-airpods-automa...

You can turn it off by doing this:

"To turn off automatic switching, go to Settings > Bluetooth, tap the Actions Available button next to the name of your AirPods, tap Connect to This iPhone, then tap When Last Connected to This iPhone."
If your argument is that there are better 'rating' algorithms than ELO which can be used. Sure, go ahead and use them. I wasn't championing ELO specifically. I meant any rating algorithm which can theoretically rank individuals. Obviously, no solution of ranking individuals on the concept of wins/losses is going to be perfect. Btw, I had the luck of implementing the bayesian Trueskill system you mentioned in some product I worked on.

> Do you still feel sure whether this seems like an appropriate class of algorithms to leverage for dating? Assuming of course that users want to find partners, as opposed to good opponents.

Imagine there being `n` heterosexual males and `n` heterosexual females on a dating platform. If all have to be paired as couples and if we can rank them by their 'popularity'. Don't you think most at the first glance would be more comfortable picking someone about their rating or higher? Just look at the skew of likes people get depending on their attractiveness from old OkCupid blogs.

In dating apps, the rating most likely comes from the person's looks. Does that mean they are good matches? No way of knowing this. But does that mean they are more likely to swipe on each other? Probably yes. We can show them people at random but that doesn't mean that they will swipe on someone whom they don't consider to be at least in the same ballpark as them on attractiveness.

The only way we can get better potential partners is if we have a lot of potential data about every user not limited to just looks. Also, even in that case if the other person is not on the same scale on attractiveness, the other person will have to take a leap of faith on whatever matching system they have.(which if you go by social experiments, people don't do)

Considering how much data FB has about users through their platforms, they are the ones who truly can come close to matching people on common interests but I am not sure how successful even their dating venture has been.
I wouldn't say it's a useless project per se. But the usefulness of it is certainly yet to be determined.
Ask HN: How far and detailed you design the Software before coding commences?
I have seen or (rather) heard about various degrees of effort into pre-designing software, from waterfall and formally validated specification down to starting to write the program before even hammering a basic specification (hack, as they put it).

So my question boils down this:

1- How much design is essential beforehand?

2- How much design is to be performed at the re-engineering and refactoring of code?

3- How much of design is delegated to the developers implementing code and how much is done by the tech lead, engineer?

I would very much appreciate any resources, examples of work done. For example I looked at: https://news.ycombinator.com/item?id=23915521
Also used in Watchmen (2009) to great effect
Yeah, I don't want to get dragged into the whole debate about headphone jacks again, but as long as someone else is saying it... headphones worked! They always worked. You plugged them in and they reliably made sound, everywhere, with high-quality audio. This comment is surreal.

And yes, I get that a lot of people do want to use wireless headphones. I'm not here to argue about that, there are legitimate reasons why people want to get rid of wires. And I also get that these headphones are filled with other features like auto-pausing, noise cancelation. There are reasons someone might look at those features and think they're worth the price. But still -- to see the primary reaction be that the important part is "just working" still feels kind of validating to all of the people who originally called out Bluetooth headphones as a step backwards from where we were.

I remember getting a lot of pushback from people who were all telling me that wireless headphones were going to get really cheap, and most of the growing pains were already over, and we were all just being ludites. But what am I supposed to think when I look at your high-tech future world, and the most popular comment is someone saying that they'll drop 550 dollars on a pair of headphones before they've even heard them, even though they'll only last 3-5 years before the battery dies -- just because it's worth that much money to have a device that reliably plays sound? How am I supposed to look at that and not come to the conclusion that the wireless market is still wildly inferior to the cheap, reliable, high-quality audio devices that came before?

It's been however many years since Apple's removal of the headphone jack and practically every high-end Android manufacturer has since copied them. And what we see is headphones that are specifically designed to work with one brand of phone/computer, that are outrageously expensive, and apparently that expense is justified to some people because the entire rest of the market is filled with options that have minor-to-major irritations during daily use.
I'm a big fan of the various "gradual" approaches so this paper really caught my eye.

Gradualizing the Calculus of Inductive Constructions (https://hal.archives-ouvertes.fr/hal-02896776/)

I'm not sure if this is precisely the direction things should go in order to improve the utilisation of specification within software development but it's a very important contribution. As yet my favourite development style has been with F-star but F-star also leaves me a bit in a lurch when the automatic system isn't able to find the answer. Too much hinting in the case of hard proofs.

Eventually there will be a system that lets you turn the crank up on specification late in the game, allows lots of the assertions to be discharged automatically, and then finally saddles you with the remaining proof obligations in a powerful proof assistant.
Consider downgrading to CentOS 7. It should work for 4 more years.
I guess it'll make a comeback.
Thanks! I think you really hit the nail on the head. In a twitter thread I talk about how Nomad 1.0 represents us implementing the "table stakes", the base foundation, for an orchestrator. However, I think what you're noticing is how the table stakes have changed from 5 years ago: orchestrators need hosted options. k8s has push-button support from every major cloud. We can't just ignore that.

And we aren't ignoring that. I have no idea what I can say publicly, so I'll just link to what our cofounder/CTO has already said:

> And hosted Nomad clusters are on the way

https://twitter.com/mitchellh/status/1334198278225682434
Most of it is from a record breaking BFCM. People shopped online instead of going to the mall. Network is over capacity. UPS is hit the hardest because they took new business in without having the capacity. Capacity goes like this. Carrier has X capacity. At 2X capacity stuff starts to fall apart which is your normal BFCM. We’re at 8X capacity. Stuff is just sitting in trailers and probably won’t get handled till next week that’s if you can get your stuff picked up.
They only offered that as an olive branch to all the people that disliked the perpetual licensing scheme. I don't hold a lot of hope for more widespread adoption as the beancounters most likely perceive it as leaving money on the table.
"Read-committed isolation" is not a meaningful implementation of transactions. If you can't do read, then a write, while guaranteeing the database didn't change in between, then you don't really have transactions.
I get this use case, but I'm always suspicious how useful the workflow such "integration" supports may be. I have a feeling a lot of folks who flit between multiple devices are staying occupied to avoid doing difficult or onerous work.

In other words, the real "productivity" hack is to not support a dilute workflow. One will save a _lot_ more time that way compared to some device interoperability.
Not really a football fan... care to explain?
That's a reasonable perspective, but often it's one-sided. Both Fedex and UPS suspended their on-time guarantee, for example, but they haven't reduced their fees. Meanwhile, it's been a boon for the stock price of Fedex (up 100% from a year ago) and UPS (33%)
But LEAP is only supported for 36 months? https://en.opensuse.org/Lifetime

That's pretty weak sauce even compared to the five years Debian and Ubuntu offer. And Debian actually supports all their packages, unlike Ubuntu which tricks people into installing unpatched garbage from 'universe'
Short answer: you write your consumer's state into the same DB as you're writing the side-effects to, in the same transaction.

Long answer: say your consumer is a service with a SQL DB -- if you want to process Event(offset=123), you need to 1. start a transaction, 2. write a record in your DB logging that you've consumed offset=123, 3. write your data for the side-effect, 4. commit your transaction. (Reverse 2 and 3 if you prefer; it shouldn't make a difference). If your side-effect write fails (say your DB goes down) then your transaction will be broken, your side-effect won't be readable outside the transaction, and the update to the consumer offset pointer also won't get persisted. Next loop around on your consumer's event loop, you'll start at the same offset and retry the same transaction.
I found one years ago that I didn't report. When I issued Ctrl-D on the interactive TeX prompt to bail out, it failed to issue a newline, leaving the operating system prompt juxtaposed to the right of the TeX prompt.

According to ISO C, "[w]hether the last line [of a text stream] requires a terminating new-line character is implementation-defined", so terminating the program without the last character written to stdout (a text stream) being a newline is not maximally portable.

That's a peculiar and possibly unique situation in the standard: whether or not a requirement exists is implementation-defined. Logically, that is as good as it being required, since any implementation can make it required. Those not making it required are just supplying a documented extension in place of undefined behavior.
No. But one could use a smart contract to strongly disincentivize themselves from uncovering their own treasure.

E.g. Smart contract sends 20% of total treasure (in cryptocurrency) back to the hider each year until the treasure is withdrawn. Treasure can only be withdrawn by the finder address linked to the paper wallet (private key) that was hidden. When it is withdrawn, it sends the finder 15% of the remaining treasure each year, to an address of their choosing.

This way, it’s almost never worth it for the hider to uncover their own treasure
I agree with you. Smart people with dark traits become really good at painting their objectives in moral, altruistic terms. They tend to limit the display of their "dark traits" through actions to infrequent events where they stand to gain significantly and will suffer the least blowback.

This is because they understand that most people build trust by observing small actions. So the smart+dark personality combos follow the script until they can make a move where it really counts. And when they do pounce, they're good at subsequently coloring what they did through a kinder lens.

These people would be nearly impossible to pick out in a survey, because they make it their business to be impossible to pick out.
Given a 64-bit variable, you can fill it with 64 bits of value, or 64 bits of pointer to some value elsewhere.

With your scheme that would be 63 (which I'm not objecting to).

Pointers are already special-cased to only contain 0 already. There's no use-case for having 63 bits of pointer and an extra bit saying "ignore the other 63 bits".

As for the value case, I think the argument is pretty similar. Why store 63 bits of value if the 64th bit says to ignore them?

If you're not talking memory layouts and are looking at adding an extra field to a struct/class. Take you value field - if it's not initialised yet, and null doesn't exist, then what is its state?
> The substantive points of practical difference are far less important

IMO the substantive points of practical difference are vastly important: the obligations of GPLv3 vs Apache 2.0 are not the same...

The whole document is a side-discussion never addressing the changes in obligations. It's about the supposed predominance of license-signaling over what is actually written and wanted by licenses. It even randomly talks about AGPL at one point, without any specific reason for doing that, except somehow qualifying it as a "pariah" license, maybe in an attempt to associate the GPL a little with that derogative qualification.

This reads as if they do not actually give a fuck about the actual effects of the various license but only about second order effects caused by some mainly folklore signaling. The first sentence of "Why Shift Licenses" could even be taken directly as an argument for not doing it. I find the whole thing extremely sad.
Harris is a nice example of why "smart people" need to be very careful. Being "smart" in this sense usually also means you are very good at rationalising your beliefs.
Unfortunately your average consumer is not going to miss the inclusion of a 3.5 mm audio jack, but it really sucks if you're a musician.

There are a bunch of really good soft synthesizer apps for iOS that work with a midi keyboard but Bluetooth latency makes them virtually unplayable. With a standard 3.5 mm jack it's not an issue. You can buy a dongle but that's just one more piece of complexity.
Huawei has tested facial recognition software that could send 'Uighur alarms'
Is your audio system ready for lossless sound?
Redhat is a fully-owned subsidiary of IBM.

IBM is open source friendly, but the days of RH being an "all open source company" ended in July 2019.
> If your company only runs one database.

I think the same argument can be made with "only one Kafka cluster" and "only one blockchain".
Have there been any examples of an exploitable crash handler? E.g. a process traps SIGSEGV to print a backtrace upon NULL dereference, and then that signal handler is itself somehow exploitable?
One problem is the current administration has very little credibility. To say “we have a tonne of evidence, we just can’t show you. Trust us”, just doesn’t cut it anymore because we know how much this administration lies.

This isn’t an attempt to make this political. But credibility matters and being able to claim the moral high ground matters.
Perhaps a bit cliche, but I started on a "Great Russian novels" marathon at the start of the year and have read all of Dostoevsky and Tolstoy.

Brothers Karamazov was my favorite. I liked ''War and Peace too', and can somewhat understand why they call 'Anna Karenina' one of the best books ever written.

Just recently, I finished 'Doctor Zhivago', and 'Fathers and Sons', and 'The Master and Margarita'. I thought they were all brilliant.

Since the year is coming to and end, I hope to reread VS Naipaul's 'A House for Mr Biswas'. It's my favorite novel and I keep coming back to it again and again.
I think allowing scripts and stuff in SVGs was a huge mistake that is why they are still not widely supported yet. For example you can't upload or send SVGs as images in typical messaging services or image sharing sited, in part because it would be a security vulnerability.

But as a consequence now we (still) have no easily portable vector format :'(
>This is huge and awesome good news.

So why the negativity at this "huge and awesome good news"?
Spotify: The story from 0 to 1M users
Personally I switched to the GIMP. I'm kind of proud I haven't felt the need to reinstall PS yet
>The new Edge, Opera, and Brave are based on Chromium

Largely because Google has pushed enough complexity into the browser that maintaining a browser engine is unaffordable, so you use Chrome as is.

Have any of these projects successfully managed to contribute meaningfully, or are they just adding alternative window trimming to chrome?
Announcing Nginx Plus R23
Please stop the open-washing: v1 was available under the BSD open source license, v2 is not. You are making a fool of your company by acting as if open source is not important.
They need work to give their thousands of devs