skysight-inc/HackerNews huggingface dataset:
I wonder why there is such a focus on this `curl|bash` pattern. Meanwhile most of us are downloading hundreds of thousands of lines of code using all kinds of package managers and I don't see many inspecting all those downloaded files, especially not manually. I don't think anyone would ever get to doing anything other than checking if you really want to verify everything.

I'm not saying that downloading something from your official OS package repositories is the same as downloading a random URL from the internet. The thing I'm more thinking about is language specific package managers such as NPM, Composer and Cargo. Or user repositories, things like AUR, PPAs and non-official apt repositories, where any random person can put something up. The thing for those is that they almost look like they are something official and something to be trusted. Often times they are displayed on an official site, you download them from a trusted URL and they look like they are really secure, even with hashing and things like that built-in. Lots of package managers don't support any way of verifying the identity of the one uploading the files, and even if they do we often import signing keys into our chain of trust without a moment of thought or we don't use the signing mechanism at all.

And with something like NPM packages you are likely to download another few dozen of other packages which you didn't even intent on downloading. You will probably run a lot of code there that could be doing all kinds of horrible things.

At least with `curl|bash` I get some feedback of where the code is originating from, what URL will I be downloading something from and is that some place that I can trust. At least I get somewhat of an identity verification (albeit very very weak) as long as I trust the owner of the site to protect it adequately from preventing unauthorized uploads.
Thanks a lot. This is exactly what one needs to do when using Word Documents in a group setting. Always.

We enforce this and it makes it so much easier for everybody. We also enforce that no one is allowed to mess with the style definitions once they are fixed for the specific project.

It is the same as if one is using code formatting rules and enforces them by configuration of linting tools.

Do some people complain, because they cannot do their personal pet peeve? Sure. Do I care in terms of the greater good for the project or the team? Only in so far as I learn not to want said people in my projects/teams.

Do some people point out specific and relevant flaws in the designe/code/style rules? Sure. Do they count? Hell yes. I love these people in my teams/projects. They know how to understand systems, think systematically and also how to communicate relevant criticism in a productive way.
This should probably be on the wall next to every engineer's desk: https://xkcd.com/1205/
I did, moved all company repos from Gitlab. Also the fact that I found Gitlab extremely buggy, but the design was definitely a factor.
Are you saying sleeping is bad for us?
How do you get rid of Word's insistence to select text that I do not want to be selected?

That is the one feature of Word that drives me nuts as a LaTeX and markdown user. I'm sure there must be a setting to change it somewhere, though. Right?
Our industry has a few standard formats that we rolled our own for. It was a relatively large amount of work.
Oh wow, square pixels. That takes me back. Thank you for the link.
After the successful arrest of this killer, Swedish police applied a similar technique and were, this summer, able to solve one of Sweden's most mysterious murders that had been the second-largest investigation in Sweden's history.

Back in 2004, two people were stabbed in Linköping, in an apparently random attack. The first victim was an elementary schooler, the other a middle-aged woman, and it happened in a quiet residential side street. The police had the murder weapon, the killer's DNA and some witness descriptions, but were unable to find a suspect.

What they did this year was an impressive combination of genealogy research and forensics. The police got permission to query private companies in the US for a DNA profile, so they were able to establish that the killer and certain Americans had a common ancestor. Then they traversed those multiple trees upwards until finding a Swedish family circa 1800 that should be the ancestors of the killer. Finally they traced that family tree back down to modern day and identified a suspect who did in fact turn out to be the killer.

I think that was a fascinating investigation, in how it combined modern high-tech DNA forensics with going through 200 year old church records.
Elasticsearch is a search engine. It is optimised to return the best fitting results to a query at the first page. But if you want to retrieve all results for a query (which is a common usecase for DBs) the performance of elasticsearch will plummet.

For example:
Try to retrieve a list of all the 10000 movies you stored in an Elasticsearch index. You will get the first 100 results easily, but is you scroll through the results, you will notice that elasticsearch will become very slow.

It is not optimized for that use case. Otherwise it would be called ElasticDB.
Every year, I add Gates' recommended books to my reading list. This year, 2020, when the Pandemic hit and our prospective Investor walked off, leaving me with a team I cannot support; I turn to extra reading for support. In early 2020, when I realized I read over 50+ books in 2019, I had decided to read slower, and more picky to digest the books better.

Unfortunately, I ended up reading lot more this year. By GoodReads counts I have already read 70+ books, so, with the re-reads and other physical books, I will be hitting 80+ books this year (I didn't participate in their book count this year).

When I'm anxious, I either read or play chess. If I'm pitching or have an important meeting, I would have likely played few games of chess.
If that is the case, part of the problem is the article's author was comparing a potentially complex example of numbering in Word with a trivial example of numbering in LaTeX. That trivial case in LaTeX led me to question the whole premise of the article since the example seemed to be cherry picking end users who didn't know how to use Word, or at least a case where the person who setup the document didn't know how to use Word and the editors did not have the authority to fix the issue properly.
I dunno, there's plenty of variation if you look at e.g. https://vscodethemes.com/.

That said, on an operating system level (both mobile and desktop) you will have apps that use the same color schemes because they're dictated by the OS, e.g. https://developer.apple.com/design/human-interface-guideline...
The Xiaomi and Huawei phones offer much better values than the Pixel 4a, unless you put an enormous value on the software update situation (which of course is perfectly reasonable).
The malicious actor would simply edit the install script to comment out the checksum verification step, since they already own the script.
I think the mix of font colours is also a problem on the diffs alongside the dark green, which makes it really hard to see what's going on. I've switched back to light mode for reviewing PRs
Actually, blood pressure is the determiner of whether high intake of salt is bad for you.

High sodium intake is only associated with increased risk in people with high blood pressure. However, having too little sodium is associated with increased risk regardless of blood pressure. Source: https://www.thelancet.com/journals/lancet/article/PIIS0140-6...
Use containers for CI, run local, do merges on maintainers machine. Push to master once local CI passes.
As a software engineer who didn't read almost any books about software engineering I have a question: How did reading any books about SWE changed the way you work?

I found that reading books on other subjects (from non-fiction I've read some biographies, some economics books, the usual suspects like Sapiens and such). I find that knowing a bit about everything is mainly a good way to keep conversations going because it enables you to chip in on many different subjects while otherwise it might be hard to find a common interest.

It also helps to see some issues that one might overlook. An example would be American Kingpin which shows how a good technical idea with no moral oversight might end up creating something that ultimately makes world a little bit worse.
I usually just select the qr code in the terminal to invert it and then scan it :)
https://hyper.is/ is a full fledged terminal based on web technology, if that can help.
Except if you're using Homebrew where nothing is signed, so signing is not as ubiquitous as you seem to think.

But signing is largely a moot point as people will follow the instructions on the website where a clever attacker would simply create their own cryptographic keys sign it and provide instructions for adding it to your keychain to the compromised website. Public key crypto does not solve establishing trust for an actor. It can only do so through delegation which as we have seen with the deprecation of EV certificates (CAs no longer being trusted to establish the identity of legal persons) is not something that is easy to get right.

Certainly it is better to trust the maintainers of your operating system/package manager than a random website. However they only sign things where they have done due-diligence on the project, which is a slow process, too slow for projects with faster release cycle such as Docker or Rust.
My employer's Outlook does have a button for a competing meeting service. (WebEx)

Some people are starting to use Teams for their meetings now because some of them like it better than WebEx, but it is exactly the same amount of effort to schedule either of them directly from Outlook.
Good question! I'd say, ultimate task is to achieve both, but what is fully achievable atm is to get the right recipe structure. The idea of "validity" is very hard to evaluate and often has high regional and personal variance, but many teams around the world are working on this problem at the moment!
Etsy isn't money losing.
"Tower, I've lost three engines and a tail rotor."

"Copy, cleared to land 28R"
I mean, I'd still want engineers using the real value in important situations, but that margin of error is acceptable for any circle I need to measure.
Reading immersive fiction makes me significantly more productive. I believe there are two main benefits: 1) It hones my ability to stay focused, and 2) It exercises the world-simulation part of my brain, which I use heavily for understanding problems and visualizing solutions.

Whenever I go more than a few weeks or so without reading fiction, I tend to notice a drop in my productivity and problem-solving ability. Binge-reading a good book fixes it every time.
There are more people with disabilities than there are people who intentionally turn off Javascript. And those with disabilities don't have them by choice.

To be honest, stop whining and deal with the consequences of your own personal choices.
Is there a way to pre-approve cookies for all sites? The law to require those pop ups has done more to ruin the web for me than ads have (since you can block ads).
On a similar theme, try A Journal of the Plague Year, The Decameron, and Plague Ship.

https://standardebooks.org/ebooks/daniel-defoe/a-journal-of-...

https://standardebooks.org/ebooks/giovanni-boccaccio/the-dec...

https://standardebooks.org/ebooks/andre-norton/plague-ship
They aren't emojis. Standard ASCII.
I see you have confused wealth and wages. Bezo's famously takes a salary of just over 80K, which is lower than many of the programmers working for Amazon

Also the idea that current system is " built on theft by the richest" is just asinine and ridiculous
One way to limit this would be to add IP resolved through an approved resolver to a temporarily allowlist for a firewall. The firewall would default-deny outbound network requests. Allowlisted IP would be permitted, but be removed from the list after the TTL for the DNS request expires.

Of course, you'd have to add in some permanent exceptions once you realize just how much hardware and software implodes as a result of this.

Some expected, like peer-to-peer applications, though those allow you to define an outbound ephemeral port range you can limit them to (except perhaps for some poor implementations in commercial game launchers trying to offload bandwidth costs). So some are fairly easy to define.

Others you'll have to log and see. Like your Google Home hardware..

I got some minis and disabled the mics since they had hardware switches. I hacked around a bit emulate sending them audio programmatically and discovered they use external DNS and therefore couldn't resolve the local network web server hosting the audio clips I wanted to play. So I had to permanent-lease the hostname's IP and give it an IP address.. They were already bypassing local DNS blockers years ago.
There's no reason why your ears can't be more limited than wireless digital input.
> RedHat and Kubernetes essentially deprecating Docker (and adding unbelievable amounts of code to replace it as infrastructure) just means a central entity calls the shots now.

Err, the concept of containers aren't being deprecated. At first, Kubernetes only supported Docker. This was considered a negative monopoly, so they defined the CRI (Container Runtime Interface) and started shifting towards that. Now they're just taking the sensible step of deprecating the old specific support for Docker. Docker is still free to implement CRI (and IIRC there have been motions towards this). Containerd (Docker's underlying runtime) already supports it today.

Your Docker images will also keep working. Even if Docker doesn't end up implementing CRI, both containerd and CRI-O use the same container format, and are compatible with your existing images.
https://docs.repl.it/repls/embed This site lets you embed some REPLs
Absolutely. A couple of years ago when my son was really into Beyblade Burst, I wrote a little script that displayed Beyblade codes in the terminal (they're not QR but a different kind of 2D black-and-white "barcodes"). The Android app would scan those just fine.
Previous discussion on:
https://news.ycombinator.com/item?id=18450425
Pfft, that would be a Useless Use of Cat[1].

[1]http://porkmail.org/era/unix/award.html#cat
The free RHEL development license doesn't allow for even a whim of something that could be considered production usage.

So you can't make a proof of concept with the RHEL developer license in which you let "the business", customers, etc. toy around for a while.
That was my first thought too. Someone can return legit script when it is not "curl | bash" and return a malicious one otherwise.
Well, not much worse than all the other fancy JS ways to build a page that everyone and his mother are using today. They are all headache inducingly bad.
I swear this whole thread could be best described as:

"Geeks that have read 2000 man pages about LaTex and have never bothered to browse Word docs complain about missing feature in Word that is actually in Word since the last millenium" :-))
Sure, but your "here" isn't in the US.
Niger Delta: Resource Control Agitation Takes New Twist
Web search as it should be
Yes markets tend to underprice and then overprice, then maybe drift down to a sensible valuation over time as companies grow. So perhaps we'll just see some stagnation in the stock price but there's no sign of it yet. This does feel like a speculative bubble and we've reached the FOMO stage where people think things are overvalued but invest anyway, because everyone else is.

25% of the S&P is in the largest 5 companies (all tech), market cap to GDP is at an all time high of 183.7% for the US. US assets in particular seems overvalued to me at present and heavily distorted by the massive QE programs that have been running since 2008 and gone into overdrive this year.
Please let us know what you think of the french! We know there are some minor things that we are currently still working on fixing, e.g. improved accent recognition, but we'd love to hear your feedback to learn and adapt.
Ask HN: Why can't we replace instructions in a binary for different ISAs?
I know this may sound really naive but I'm new to low level programming. I was wondering if the binaries that we build use a certain set of instructions to talk to CPU (amd64, arm64 etc), why can't we edit the binary and change the calls to make the call in the certain ISA we want?

I know that's possible with recompiling from the source code, for example with Go, but I was wondering why can't we do this for arbitrary binaries? Are the calls not apparent in the binary form? From what I can tell Rosetta 2 does a similar thing when you run amd64 app on M1 for the first time[1]. What prevents us to have such a tool for all architectures? For example, I'd like to run an arbitrary amd64 binary on a RISC-V core without recompiling the source code.

[1]: https://www.computerworld.com/article/3597949/everything-you-need-to-know-about-rosetta-2-on-apple-silicon-macs.html
I like this idea. I'm sick of wading through thousands of products with fake reviews when shopping for something outside my field of expertise. Amazon's own recommendation ("Amazon's choice", iirc) is just algorithmic bullshit and the ratings cannot be trusted.

Give me a shop that gives me a couple of hand-selected products for any given category and makes absolutely sure that I do not get counterfeit products. Couple that with great and personal service and I'm happy to pay a premium over Amazon.
Ahh yes, the moronic modern monetary policy of money printer go brrrrrr

Where people seem to believe we can just create new currency from thin air in infinite quantity and it will have no negative effects

This will lead the US losing its status as a World Reserve Currency, this will devalue the dollar, and at some point cause the US to have to issue a new US Dollar replacing the old one and wiping out all savings, investments, etc.

but Socialist never do have a good grasp on economics
It was also to do with cleaner energy generation and taking advantage of natural gas resources in North Sea. Dash to Gas was a major enabler of the switch away from coal in the 90s.
His father died in 2020. Most people that are being a jerk on the internet would say that counts.
Features matter though: the biggest problem I have with what's out there is I can't establish an ambient trust relationship and let people pull my location from me on demand.

I could honestly ditch the periodic updates component of this, provided "request location" was always available.
> they'll describe something that makes it clear they haven't tried any Linux distro in a long time.

I use Linux for work.

In Ubuntu 20 air pod pros still don’t pair properly - I can use the earphones but not the headset microphone.

Then there are minor annoyances like plugging in an
external monitor and keyboard to a closed laptop (thinkpad) and not having it wake up (need to open and close the case), or closing the case but then the power management doesn’t work properly so if it’s not plugged in to power, then when I open it the next day the battery is drained and the laptop has shutdown - losing any unsaved state.

Finally (and this is the main one preventing me from using Linux on my personal laptop) Chinese fonts on Linux are awful. Not only are the default fonts ugly but applications do a poor job of rendering them, often getting baselines offsets between subsequent characters wrong, making characters on the same line jump around.

It’s altogether a subpar experience especially compared to macOS.
I've read this post time and time again. But I'd like to mention, for me learnable programming is and has been firing up a debugger. I'm learning 3 things because of it:

1. See how state changes

2. See what hidden state there is

3. See how state changes if I interact with it. E.g. in C by changing register values or variables. In Python by changing variables.
You could as well send a different response the second time some IP+user-agent visits the resource. That would be almost as effective.

Just download the script, inspect the code, run the code.
Really? My wife sells on Etsy in the UK and gets her money the next day. She needs to wait a week or so for Stripe payouts on her website.
> we run the risk of creating separate product areas and none of them working well together

or, have mandated open apis that _force_ products to integrate.

That's what the web is today (mostly). Links, and embedable content (like frames). APIs and data.

The reason companies don't do this - as demonstrated fairly recently by google with their removal of xmpp protocols from google chat - is that open apis prevent lock. Open apis allows others to compete, and it is not in the interest of the existing incumbent.

IBM made a crucial mistake that apple didn't make when IBM opened the specs for their IBM compatible machines and drove down the price of PCs to what you see today - otherwise, i would predict that PCs would be just as expensive and incompatible as apple computers were.
There's an (apparently untranslatable) word in German for people who are only interested in amassing knowledge in their own domain and totally ignorant of anything else: "Fachidiot" (see also https://english.stackexchange.com/questions/327748/is-there-...) - it's not really a flattering term. So, in my book, expanding your horizons is a good thing. Of course, Sherlock Holmes would disapprove (https://news.ycombinator.com/item?id=3605300).
I use the "I don't care about cookies" Firefox add-on:

https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
Hawaiian will always win for me
I think that the advantage of this approach is that same output can be consumed either by browser or an API consumer.
That's not quite the case. The blocks are available in the Miscellaneous Symbols and Arrows section of Unicode. That's usually rendered as plain text (although not ASCII).

But they're also paired with Variation Selector 16 (https://emojipedia.org/variation-selector-16/) which gives them an Emoji presentation on most modern systems.
How to Build Brand Trust Through Social Media
I purposefully used the word 'efficient' in my original post. Of course you can find cycles many ways, but floyd's (or similar) are not acceptably fast and never can be in general.
If you would like to try out an independent ODoH proxy with Cloudflare DNS, I added ODoH proxying to my DoH server last night - instructions on using it are here: https://padlock.argh.in/2020/12/08/odoh.html
Open source framework for federated learning in Rust
Help me build this repo of security tools mapped to the NIST CSF
Maybe it is because the website owner has full authority to change anything at their discression, while git packages usually exists in an ecosystem that can be observed and tracked.
Rapid genomics strategy developed to trace coronavirus
https://xtermjs.org/ This sounds like a go-to product
Monitor PyTorch and TensorFlow model training on mobile phones
Just to add: Before this breakthrough, Police had gathered the DNA from about 6000 people via voluntary interrogations without any match. They even collected DNA form mothers of men who had killed themselves (and matched the description/profile etc) in the years after the murder.

In fact, they had actually sent a letter to the murder asking for a sample in the months before starting the new approach, but he didn't show up and they hadn't gotten to taking it further.

So in the end, they might have had a chance of solving it the traditional way. But at the same time, it takes a lot of evidence in Sweden to forcibly collect a DNA sample, which probably is not so easy for a 16 year old case.
Reading technical books has helped me pass some interviews and improve my programming skills. It also helps me learn new languages (Go) and do some personal projects. No personal project has helped me get a job though...

Usually the part of out-of-scope of software is dealt by product managers. Maybe it is a problem of working in a big corporation?