skysight-inc/HackerNews huggingface dataset:
I don't understand why people keep endlessly complaining about postinstall scripts.

Such 'nagging donation requests' were banned by npm pretty much days after they first appeared, IIRC, and npm itself is literally a tool for installing code to execute later, so there's no security issue here. If someone wanted to embed malware into a package, they wouldn't need postinstall scripts for it.

This is really a complete nothingburger.
A Yoda condition you have meet. https://en.wikipedia.org/wiki/Yoda_conditions The "Advantage" section you must read.
WHO team rejects lab origin of coronavirus, focuses on animals, frozen food
Neither does hosting your code on GitHub. Its issues mechanism is very limited compared to Bugzilla (or JIRA or whatnot). As for CI - GitHub itself doesn't give you CI. Travis does and they've gone mostly/wholly commercial. etc.

I'm just saying you don't need to be fully on GitHub to be visible on GitHub.
In vino veritas. Tipsy vs. whiskey dick. These are so obvious, I don't see why they need mentioning or explanation.
The only situation where our datetime instances deal with timezones is on a one way trip to a user's display, document or email. If you are playing around with parsing timezone strings, you are probably making a huge mistake unless you are parsing someone else's trash data.

I feel the standard interchange format for datetimes really should be 64 bit Unix timestamps. These are trivial to store in any database as a native type, can be compared using the fastest arithmetic instructions possible, and are a locale agnostic representation suitable for direct business logic comparisons.

Trying to carry timezone information around is a mistake. This is state that should be terminated and normalized at both ends, not passed through the system.

The only thing I would store pertaining to timezone is for user profile or server environment configuration. These would be settings in the application that are used to produce locale-specific UI and reports.

There are probably some other use cases I am not thinking of, but that is the extent of how we do it and we have a really complex app that has to serve customers who operate in multiple timezones at once.
While the Elfstedentocht hasn't been held in 24 years, in that period we've had quite a few winters with enough frost to hold smaller, regional tour tour skating events (which can still attract 50,000+ people over the span of a few days). At least twice we came within a few days of organizing the Elfstedentocht. It's enough to keep the spirit alive, and it makes the event itself even more mythical.
Quite the contrary. In the browser, workarounds have always been the other stopgap solutions, like script concatenation, require.js, and bundlers like Webpack.

With ES6 modules, bundlers and transpilers are not mandatory anymore for a large part of modern JS development. This is a good thing, as they were a giant source of complexity.
because without proper incentive mechanism people just use "com.mycompany.greatproduct12345" for everything
> For npm modules that implement a path e.g. `@lib/method`, the import of this currently isn't allowed in node without a flag.

FWIW, (and im sure you know this, just pointing it out for others) @lib/method is not a path - the @ at the beginning indicates the package is namespaced under an org. @lib/method is a full and proper regular package, whereas `lib/method` would be pointing to a path within the lib package.
I Made a QR Code Generator PWA
Creation vs. consumption.
If everyone consumes, who creates ?
And why is everyone pushed towards consumption of content.
Easy vs. hard.
The hard way is the right way.
For the most part this isn't true. The difference is that Americans are more willing to express themselves on these topics than people in some European countries. And I say this as an American who's been living in Europe for over 12 years now.
Damn, if only it were true - MXE is hard to come by these days, you'd have been sitting on a fortune!
I think bitcoin is evil and have from the start. A unit of exchange cannot replace any significant fraction of the financial system, it is crazy to suggest this.
The energy use required to run bitcoin is first reason I consider it bad. The second is that I feel the ethos of bitcoin is naive and antisocial.
https://github.com/slap-editor/slap ?
There is a fallacy in that conclusion though.

When you pay, you may still be a product. There is no (economic) law that dictates that when you pay, your data may not be sold.

Paying customers might dissapear if they find out you make additional profit through datamining or -sales. So there is more incentive not to sell or mine data, but it is no guarantee.

The only guarantee is when technology ensures the service provider does not have the data at all. E.g. through e2e encryption.
I used this version trick in nuget, but the other way around.

To update existing non-maintained public packages, mostly because they were on. Net framework and a lot moved to .net core.

In visual studio you can set the priority of where packages have to be checked. My own package repo has a higher priority.

I never thought about using it as an attack vector though.
IMO, that excuse doesn't hold water on 64 bit machines. On 64 bit machines, not using tagged pointers (using the CPU for fast arithmetic on word sized integers) and instead using the slow branchy sign-magnitude representation that cPython uses for integers is unconscionable, in terms of both performance and memory usage.
I've often wondered about this, even in the accidental case of someone registering a package you use internally.

And I know it's not perfect, but in Python if you use Poetry means you get a poetry.lock file with package hashes built in, so that's something.
Marketing companies are already side-stepping this. They already recommend (require?) customers that I work for create aliases/CNAMEs under the website domain precisely so they can plant first-party cookies on the site.
Show HN: I've made 10 Telegram channels where juniors can find remote jobs
Hmm, your applications don't have user input asking for a time?
Gamers often complain how they become free QA testers if they buy a game in the first few months after release as most games are full of bugs (hi Bethesda!) but it is way worse in things like JavaScript libraries etc. It's as if finished have become a foreign word to most developers. Look at the resent story about Linux stable kernels that have had more than 255 minor releases and think how much of a shit show it would have been if they added features too like most developers do. The excellent small stable tools of Unix should have taught us something.
Inserting hard line breaks when word wrapping is quite annoying too, and that's the default. I've seen a lot of people break config files because they didn't start it with -w.
Yeah, I do the same. I feel the thing that's missing is navigate to definitions/declarations (cmd+])
Qualitatively, I notice depressed people tend to read, write, and philosophize more. I think it partially explains the phenomenon of post-drinking philosophizing at 3 am since EtOH is ultimately a depressant and often amplified by tiredness, and also EtOh seems to promote socializing, Although hangovers are temporary depressive dips where reading, writing, and philosophizing may not be the first thought.. at least not until the bathroom, nsaids, and coffee.
Are there many package manager that do not have either pre-, post- or build scripts or plugins allowing arbitrary code execution during build?

pkg managers that do have that: cargo (build.rs), pip (setup.py), npm (install scripts), apt/rpm/pacman (postinstall hooks)

Maybe the only exceptions are Go and Java package managers?
Note that the quote originates from the 90's, way before ad tech as it is currently known. Advertising is a bit like finance. There exists an important, tiny core that is surrounded by a massive amount of activity whose societal benefit is doubtful at best.
Not defending/attacking the phrase "disastrously bad", but I'm not sure its a fair argument to say "the docs explain it", if the behavior isn't what a "reasonable" person would expect. Writing software that deletes your files (when you expect, say, the weather report) isn't excused if they write in the docs "oh this weather software randomly deletes files for no reason".

In this specific case though, even those docs do not explain what happens if the value is "invalid"!
China birthrate slumps as experts blame changing attitudes
My sister obviously thinks the “spam” button is the same as “delete email” button. Every once in awhile I get the Google apps for domains notification “tons of spam has been marked”.
Are we game yet? – A guide to the Rust game development ecosystem
“install” and “execute later” don’t always involve the same permissions. If you apply restrictive sandboxes your code, package managers that aren’t designed to be able to download untrusted code are annoying. Of course, this problem isn’t unique to npm. (It’s actually the opposite – all you need to do with npm is --ignore-scripts, whereas pretty much every other popular package manager I use just makes it impossible.)

And yes, you want to sandbox the install too anyway, but it at least needs permissions enough to do its job, i.e. interact with the network somehow. (Although I’m working on a tool to make that fully deterministic so it can never exfiltrate anything.)

There’s also the possibility that there’s no “execute” step at all, like installing a dependency tree just to inspect source, or in theory being able to skip auditing unused code paths.
will this get rid of the dreaded cookie popup dialog?

or is that GDPR nonsense still going to make those persist?
MLA is a standard, not the only standard. Just becase a significant portion of universities/academic instituitions have adopted it as their standard doesn't make it the worldwide standard at all. It doesn't even make it the standard for all academia.

Further Esquire is not an acadmic journal so should probably conform to a more widerly used understanding of how quotes are recorded/put in context.
https://gitlab.gnome.org/users/sign_in even allows you to login with a GitLab account. Which ironically isn't possible on these other two.
Yeah, that's a public job.
Repeated viewing of these kinds of ads is precisely what introduces the insecurity in people that makes them seek out the kinds of products being advertised. It's the same thing with skinny models and anorexia in girls.

Advertising is the cause of the 'problem' that they can conveniently solve. Besides some of these 'cures' for baldness have alarming side effects and there should be regulations around advertisement for these products. https://www.reuters.com/article/us-merck-propecia-suicide-ex...
That explains why at a place I worked we had multiple github orgs for different subteams, and/or they were really cheap ... yeah confused now.
Has this been fixed already? I can easily find those products (associated with 'BeltBro' seller).
https://www.amazon.com/s?k=beltbro
Fantastic <3
A hit of 25-50% of revenue would certainly have hurt, but probably not killed Facebook.

That people will find a workaround is absolutely true. I once worked on a system to order mobile phone subscription from a website that only worked on IE6. So we had a website that accepted orders from customers, created jobs that would be sent to one of 10 VMs that ran IE6, where a watir script would steer IE6 to enter the order into the old website.

It's the most horrible hack I ever worked on, but it worked.
No, this is not an issue for this particular event. The last time we came close was 2012, but even then the ice was only 10 or 12cm thick on large parts of the route. This is most emphatically the result of a changing climate. On eleven of the fifteen occurrences of this event the ice measured 25cm of thickness.
Yeah, I’d say not all rules in pyupgrade are universally popular. Fortunately I seldom see it used as a CI checker or pre-commit hook, and much more often used as a one-off transition tool with output manually reviewed instead (more like 2to3 than black).
Hey! I run 50+ Telegram channels where remote jobs are posted every day (https://t.me/NoiceJobs)

Some people told me that the jobs posted are too senior for them and they'd like some channels with more junior jobs.

I think getting a remote job as a junior may not be the best in terms of the rate of learning when you can't still figure out things fast on your own. But office jobs are also a no-no given the current COVID state of affairs, so I thought this could help some people.

Let me know what you think. Cheers! Xoel
A growing share of lung cancer cases is turning up in an unexpected population
Golang linear partition library
Note that at least on Linux, deploying a keylogger to exfiltrate the password for a SSH key is not hard either. Even if a keylogger is somehow not possible, you can probably still replace key binaries with patched versions or change desktop shortcuts to launch modified programs.
But you dont have a right to everyone else's business. Police frequently deal with people in their worst, and yet some feel so entitled to seeing these situations they have nothing to do with as though it were just a drama on Netflix.

Example: https://www.portlandoregon.gov/police/news/read.cfm?id=28147...

The mother of the affected was telling people to go away, but they were so desperate to push their own agenda they ignored it. The BWC videos are on YouTube.
Justin Atkin on his Thought Emporium Youtube channel: https://www.youtube.com/watch?v=C7TwBUxxIC0 and the followup https://www.youtube.com/watch?v=3BA5bw1EV5I
It's absolutely right to criticize insane behavior even if said behavior is documented. LOL "helpfully" being substituted to the output is absolutely insane.
Ethics aside, that's a clever hack, an elegant way for one broken system to exploit another broken system.
Probably, it's more fun to play with syscall filtering in containers or with fuzzers than to review side-channels or educating coworkers. Therefore, security theater.
The old system of scoring points allowed for some occasional retirements: only 11 best results out of 16 races counted towards the championship. These days all results count, and the difference between 1st and 2nd place is smaller (9 or 10 points vs 6 before, 25 vs 18 now), so drivers are less incentivized to take a risky pass for the win. That is one part of why Formula 1 is so boring now.

The other part is a Draconian ban on in-season testing, which makes it far harder for lagging teams to catch up: previously teams could develop their cars mid-season, now whoever has the best car in March wins the championship.
Why would it be a retroactive law?

A new Act of Parliament would be needed anyway to establish the United Republic, it could be included in that. Perhaps as a 100% wealth tax on the first X people in line to the throne, or similar.
There are people working on layering the data better. I was at a talk about this at two State of the Map conferences. I don't have links or names ready, on mobile, sorry.

The idea, in my words, is to have a standard on how to link between layers: how to merge them, so to say.

That way, a routing app for a car would only need the roads and their features layers. But the search engine for tourists needs the poi layer and not all the road details.

A 'live' layer for e.g. traffic density could then be a neat commercial product for OSM consumers. But without standards to link your layer to, say, the OSM streets, it is almost impossible to offer and process such a layer.
Criminals stole over USD 100M in cryptocurrencies by hijacking phone numbers
> the title of 'most popular televised sporting event in the Netherlands' definitely goes to the football world championship

Source? The last Elfstedentocht in 1997 had 9.2 million people watching it [1], while the semi-final of the Dutch national team in the world cup in 2014 had 9.1 million people watching it [2], and population had grown by ~1.5 million people in between.

[1] https://nl.wikipedia.org/wiki/Vijftiende_Elfstedentocht#Reco...
[2] https://kijkonderzoek.nl/component/kijkcijfers/file,j1-6-1-p
> There are actually two timezones that are canonically named "CST", and they're 14 hours apart!

Yup. If you say CST do you mean China Standard Time or Central Standard Time? The answer will depend on where you live in the world. There are others that share the same abbreviation as well. But CST is the one that constantly causes trouble in daily life. Just say no.
This was inevitable from the moment we let build systems and runtime systems fetch things automatically and unsupervised from public repos. This is the simplest and most blatant approach yet, but taking ownership of existing projects and adding malicious code is an ongoing problem. Even deleting a public project can have the effect of a DOS attack.

When I first used maven, I was appalled by how hard it was to prevent it from accessing maven central. And horrified to see karaf trying to resolve jars from maven central at run time. What a horrible set of defaults. This behaviour should be opt-in, disabled by default, not opt-out through hard to discover and harder to verify configuration settings.
Lakes can also be subject to tsunamis https://en.wikipedia.org/wiki/Tauredunum_event
Dystopian like the movie Brazil isn't it? Arbitrary, automatous machinations lacking in human supervision, with anonymous accusations believed automatically, convicted instantly, and banishment forever.
PGP signing of packages should be table stakes for publishing to a public repository. If unsigned packages are accepted by a public repository to reduce friction for newbies, such packages should be hidden by default.

Then, build tools should be configurable such that they only pull in dependencies signed by PGP keys drawn from a whitelist.

Finally, companies need to maintain private repositories of vetted dependencies and avoid pulling from public repositories by default — and this requirement needs to be configurable from the project's build spec and captured in version control.
Before about 1920, many US cities had their own time. Since then, there are far fewer time zones, mostly uniform across states, and named after a large city. Similarly in other countries. The large version of the database is only needed if you're trying to print very old dates.
Letting google be in charge of this is completely insane.

Current Wild West situation isn’t great but nominating a global king to make the rules doesn’t seem much better. Especially one who’s business model is literally the biggest conflict of interest possible of all the parties you could nominate.
100%. Coming up with a common pattern for deploying multiple languages is a nightmare for us. Different groups also have different patterns, all internal.

Using Docker, it doesn't matter if its Go, Python, Java, you start it with the same commands. Running in a Docker container also means you have the same platform for local development and each environment.

It also means that you can incrementally upgrade the Java version each application runs on. Not so bad for Java, but for something like Python it makes it easy and consistent.
After seeing how much money was printed and pumped into business, its no wonder stock market is going up.

I was worried it will cause some inflation runaway effect fueled by the pandemic instability. But no. Despite what we have been taught - "You cannot just print money" - nothing happened.

It really got me thinking either nobody has any idea whats going on and they just keep pushing the limits or we are at the bring of monetary crash.
This made me think that VS Code should really just have a "View Github Repository" option where you paste the URL and it opens something like this, except in the normal desktop app. If you want to be elaborate you could even have support for making changes.
We also have multiple orgs, but we hit the requirement that you only have one bot account. It would be super nice if GitHub allowed much tighter scoping for PATs.

I don’t know how many GitHub orgs the Linux Foundation has, but... hundreds? Having one bit account with wide permissions is a non starter
In 1940 the ice had a record 41cm of thickness, in 1941 and 1942 the winters were harsh and the thickness of the ice was not a concern either. Only in 1917 was the ice on the thin side at 15cm, which is the minimal thickness for the event to be considered still today.

The standards haven't changed much. The climate has.
Amazon became almost useless for many types of articles. For any type of item, there are 10-20 resellers selling the exact same cheap item, just with different color and branding. It's essentially become an expensive dollar store.

I've abandoned Amazon because of that, until they finally add a "no third party sellers" option. And also a "don't show items we don't actually send to your country" option.
> I realize it's complicated, but there are things that make me worry the future of the internet might not be so great.

The solution isn't easy, but it's simple: stop using Amazon (specially AWS), Google (specially AdSense), etc. Once they lose half their annual revenue, they'll start taking things seriously.
>The Crown by the action of the Governor-General did, there's no indication that the Queen had any direct involvement.

.. yet.

And, that is precisely the problem with her powers. She can keep anything secret that she desires, including war crimes.
Keep editing, we will wait. Eventually you containerize the container and realize that only a single if is enough for everyone.
If Firefox and Safari implement this API but set it to return a hardcoded generic set of "interests" for everyone, that seems like a pretty good outcome to me. Chrome users can "enjoy" personalized ads and everyone else gets better privacy.

I don't object to seeing adverts, I do object to having all my personal data hoovered up by ad-brokers.
As others mention, consider if you want kids or not.

It is much more difficult to keep up (physically and mentally) with a 3 year old at 50ish than at 30ish.

If you do want it, it's a kind of trap[1] to delay because "the time is not right". It may never be "right", since it is a life changing event.

[1] - except in extreme circumstances, of course.
Tableau is one of my favorites