skysight-inc/HackerNews huggingface dataset:
This is a new problem we’re going through. School provides equipment (iPad now, eventually laptop) and charges penalties for breakage whether accidental or negligent.

For a $300 iPad, they charge $100 for the first repair, then $500, then $1000. So these are penalties not repair fees. This iPad is expected to last through elementary school or middle school, so multiple years.

This is hard for an elementary schooler or even middle schooler and the risk of damaging these things, oddly they do not provide cases but allow students to buy their own.

I’d rather go back to paper books that are very hard to damage.

The school hired an “iPad wrangler” and cover their salary through the penalty fines. So it’s more expensive than just buying AppleCare. It’s also worse as it takes forever to get service and it’s faster to just go into an Apple store.

I’m not poor, but don’t have hundreds of dollars. Here’s some examples of charges- 1) iPad doesn’t work, school claims student damaged it but doesn’t know what is broken or what could have caused the failure, penalty charged, iPad replaced, no appeal possible, iPad wrangler (who has no credentials or training or skills in iPads) rules definitively; 2) another student knocks iPad out of hands onto floor breaking, penalty charged to steward not to knocker; 3) stolen, penalty charged

It’s implemented quite stupidly at school with no insurance and no skills for repair. 8+ year olds have a hard time protecting expensive electronics.

Not mention that the devices have spyware reporting all activity, not allowing messaging to parents and guardians, and not providing logs or audit to parents and guardians.

It’s funny that I dreamed of stuff like a Young Lady’s Illustrated Primer and we get this Brazil-like implementation where everything sucks, but digitally.
I collected stats for 83 JavaScript libraries in Q1 2021 and used 17 metrics
There are some venues, e.g. this Asplos workshop: https://nope.pub/
Hey, none taken. I'm happy to receive feedback. If you look at my profile, I still got other projects in case this SwanLove is a stupid idea.

Responding to your point: you don't have to integrate Linkedin to your dating profile in SwanLove. You can integrate Strava account to your dating profile so you can find people who like to run or cycle.

In the future, in SwanLove, you'll have:

https://swan.love/linkedin (for people who want to find mates in Linkedin)

https://swan.love/strava (for people who want to find mates in Strava)

https://swan.love/github (for people who want to find mates in GitHub)

Knowing that your date has a Linkedin profile can give some security to some people. Some people only want to date people with a job.
A human subjects determination isn’t really an approval, just a note that the research isn’t HSR, which it sounds like this wasn’t.
There’s also connectors that wouldn’t be there normally, those connectors also have to be large enough to support the current. Then there’s the plastic lined battery well, as well as the plastic battery case. It’s not as simple as throwing plastic around a battery and calling it a day.
Dd they keep track of and submit a list of additions to revert after they managed to get it added?

From the looks of it they didn't even when it was heading out to stable releases?

That's just using the project with no interest in not causing issues.
The report is split into 6 parts. Each part is dedicated to one of the 6 major categories in Frontend Development:

Frontend Frameworks https://moiva.io/blog/2021-q1-state-of-js-frameworks/

State Management Libraries https://moiva.io/blog/2021-q1-report-state-management/

Testing Libraries and Frameworks https://moiva.io/blog/2021-q1-report-js-testing-libraries/

Build Tools and Module Bundlers https://moiva.io/blog/2021-q1-report-js-build-tools-bundlers...

JAMStack Frameworks + Static Site Generators https://moiva.io/blog/2021-q1-report-js-jamstack/

End-to-End testing frameworks https://moiva.io/blog/2021-q1-report-end-to-end-testing-fram...
>> is the illusion that "anyone can make it"

This has some other implication. Ease of access is a good argument of the coming big decline of football and most active sports in favor of e-sports.

That said, Amazon buying Twitch for <1bn IMO is even a bigger steal than FB buying IG for 1bn
I think SQL gets a lot of undeserved praise that I’m having a difficult time understanding. The only impressive thing about SQL is its prevalence but that’s a pretty poor yardstick unless one thinks that an appeal to popularity is an indicator of quality.

Now let me count the ways in which SQL is bad:

- it composes poorly due to its unwieldy cobolesque syntax

- it is a leaky abstraction revealing a lot of underlying implementation tradeoffs

- it doesn’t properly implement Cobb’s relational model

- it is poorly standardized with a ton of proprietary extensions and alterations present in virtually every implementation

- it is still poorly supported by tools because the model metadata lacks any standard interface to make universal tooling possible

A lot of the praise for SQL is just bandwagon hopping and cargo cult behaviour or a lack of vision by most people of how things could be much better
I found it interesting how everyone agreed that football should not be run solely for profit and fans need to have a say in how clubs are run.
It United both Boris Johnson and Jeremy Corbyn.
But applying the same sentiment to corporations seems controversial.
also, regional fandom is usually tied with local feuds.
European football is community for many people, especially on the local level. The amount of dedication for a club and the community around it is enourmous.

For instance, ultra's defending their stadium and city/town against looters during recent riots in the netherlands[0][1], with members the club willing to "take the hit" in terms of getting fined/arrested.

[0]:https://www.ad.nl/binnenland/voetbalsupporters-als-buurtwach...

[1] https://www.rtlnieuws.nl/nieuws/nederland/artikel/5211010/vo...
Thanks for the link, this is a much clearer example of how prototype pollution can be an important vector.

As another commenter noted, if one can directly inject literal JS code that writes to __proto__, you've already got RCE.

The case where prototype pollution happens without arbitrary RCE looks like:

- User input can set arbitrary fields of an object and its properties, allowing the user to add or alter a field on a `__proto__` that references a widely-shared prototype;

- The existence or value of that field non-locally affects other code which assumes that the prototype is not under user control.
They need to prove it. Talk is cheap and corporate PR is not very reliable source of information.

SpaceX has been known to talk bullshit ... or more charitably, they have been known to mix aspirational language into their projections. Case in point, I saw a TED talk with the SpaceX CEO claiming that rocket-based passenger travel is just around the corner and will be faster and more efficient than airplane travel... a claim that on face value is just stupid, bordering on insane.
They also understood that two big things in Europe are: Sucking it up to the man - UEFA and being jealous.
I can't wait for the Russkies to invade this wretched continent.
Could you elaborate on why you find a real DB overkill for testing purposes?

Typically you would have a set of unit tests which test your code only and use mocks for external dependencies, in this case you would mock Prisma.

Tests involving DB state are not unit tests anymore and require a bit more setup but most frameworks provide a test harness/runner to quickly spin up a part of your app with dependencies resolved (instead of mocked) so you can call controller/handler/service methods directly and verify their behavior.

The boilerplate for this should mostly be limited to switching out an environment variable for the database connection and maybe setup some fixtures. Is this not possible in Prisma?
Zambia – 2021 World Press Freedom Day (Update) – Via Google News
> tried it for 4 years and that's just not the case.

So just fired up a VM with a clean install of Ubuntu.

No VSCode, No Rider.

> wget https://packages.microsoft.com/config/ubuntu/20.10/packages-... -O packages-microsoft-prod.deb

> sudo dpkg -i packages-microsoft-prod.deb

> sudo apt update && sudo apt install apt-transport-https dotnet-sdk-5.0 -y

> mkdir test

> cd test

> dotnet new console --output sample1

> dotnet run --project sample1

This is all on the MS Docs website for getting started.

So I'm really not sure what part you find difficult. Getting hello world is no more difficult than me getting hello world working for golang, nodejs, python.

> For me, even simple things like getting C# aliases working was a pain.

Aliases for what?!?

EDIT: Simplified the commands cos I can't format in comments.
Yes because the analogy doesn’t make sense. Can you explain how the two things are equivalent?
Seems like a bit of a strong response. Universities are large places with lots of professors and people with different ideas, opinions, views, and they don't work in concert, quite the opposite. They're not some corporation with some unified goal or incentives.

I like that. That's what makes universities interesting to me.

I don't like the standard here of of penalizing or lumping everyone there together, regardless of they contribute in the past, now, in the future or not.
Their research could have been an advisory email or a blogpost for the maintainers without the nasty experiments. If they really cared for OSS they would have have collaborated with the maintainers and persuaded them to use their software tools for patch work. There is research for good of all and there is research for selfish gains. I am convinced this is the later.
You're assuming developed world demographics in your answer, which isn't accurate for countries like South Africa with relatively young populations.

Fully one fifth of South Africa's COVID-19 deaths were in the 50-59 age bracket, which includes many key experienced and highly-skilled personnel.

Another ten percent were between 40 and 49.

Sure, 44% of those who died were 60+ but to assume that had less economic impact is also incorrect: In the most hard-hit areas many of the primary caregivers for children are in that age group as grandparents who were forced to care for their grandchildren after AIDS wiped out so many of their children. COVID-19 has now left many kids double-orphaned, first with the deaths of their parents from AIDS and now the deaths of their grandparents from COVID-19.
MAUI is open source, check their code

Apple mentioned in their WWDC how they embraced data oriented code for SwiftUI wich gave them great performance by default
And now all their patches are getting reverted because nobody trusts them to have been made in good faith, so their list of resolved bugs goes to 0.
Dirac's String Trick
I'd be curious how this compares with the encoding_rs crate (https://github.com/hsivonen/encoding_rs), which also offers UTF-8 validation (among many other things).
Interesting -- I actually haven't had as many problems as you have with TypeORM -- it's just mostly worked. Then again, maybe I'm a rare case, because I basically ignore the ORM side and use a little repository pattern, the query builder, and write my own migrations in SQL (as in all the migrations are `await queryRunner.query(...);`).

It's been excellent for me -- I ignore the bad abstractions, have a good underlying database (postgres), and drop down to parametrized raw SQL whenever I need to, it's held up extraordinarily well I think.

Could you expand on some specific issues/frustrations? Just curious about the side I'm clearly not seeing.
What's the most recommended .net equivalent
How thorough is IRB review? My gut feeling is that these are not necessarily the most conscientious or informed bodies. Add into the mix a proposal that conceals the true nature of what's happening.

(All of this ASSUMING that the intent was as described in the thread.)
As a casual programmer, I've used WinForms successfully to write both trivial and somewhat complex GUI tools. I've never been able to use WPF to write anything useful, I just couldn't scrape together the patience required to adapt to it.
Isn't that pretty much always the dilemma with database stuff and testing?

On the one hand, you can wrap your DB operations in some kind of mockable interface(s), and then test your business logic.

On the other hand, you really need to test that the actual SQL ops work anyway- what if you screwed up a foreign key constraint?- that wouldn't show up in your business logic tests or your in-memory SQLite or whatever.
This is not responsible research. This is similar to initiating fluid mechanics experiments on the wings of a Lufthansa A320 in flight to Frankfurt with a load of Austrians.

There are a lot of people to feel bad for, but none is at the University of Minnesota. Think of the Austrians.
Looks very powerful! Will check it out, this might be the excuse I need to dive more into Rust.
Interestingly, that paper states that they introduced 3 patches with bugs, but after acceptance, they immediately notified the maintainers and replaced the patches with correct, bug-free ones. So they claim the bugs never hit any git tree. They also state that their research had passed the university IRB. I don't know if that research relates to what they are doing now, though.
> You do not experiment on people without their consent. This is in fact the very FIRST point of the Nuremberg code:

> 1. The voluntary consent of the human subject is absolutely essential.

Which is rather useless, as for many experiments to work, participants have to either be lied to, or kept in the dark as to the nature of the experiment, so whatever “consent” they give is not informed consent. They simply consent to “participate in an experiment” without being informed as to the qualities thereof so that they truly know what they are signing up for.

Of course, it's quite common in the U.S.A. to perform practice medical checkups on patients who are going under narcosis for an unrelated operations, and they never consented to that, but the hospitals and physicians that partake in that are not sanctioned as it's “tradition”.

Know well that so-called “human rights” have always been, and shall always be, a show of air that lack substance.
i'm also having this issue since today, it's the first time i ever saw this and i've never seen a cookie related issue that basically creates an infinite loop of adding "http://imgur.com/(null)://" to the address bar until the browser just stops it.

the site is offline acording to "IsItDownRightNow.com" so i assume something just broke on their end
Apple Now Selling More M1 Macs Than Intel-Based Models, Says Tim Cook
>This post does not deserve to be flagged.

You start with "I know this is going to be contentious", you know this is flamebait.
From the researchers:

> In the past several years, we devote most of our time to improving the Linux kernel, and
we have found and fixed more than one thousand kernel bugs; the extensive bug finding and fixing
experience also allowed us to observe issues with the patching process and motivated us to improve it. Thus, we consider ourselves security researchers as well as OSS contributors. We respect OSS volunteers and honor their efforts.

https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

It feels to me you have jumped to an untenable conclusion without even considering their point of view.
Static contents made dynamic for your web app, like magic
> If the conclusion is "well, you can get access to the water supply and the only means to prevent it is to closely guard every brook, lake and river, needing half the population as guards".

I don't think that was the conclusion.
> Such as? Should we assume that every patch was submitted in bad faith and tries to sneakily introduce bugs?

I’m not a maintainer but naively I would have thought that the answer to this is “Yes”.

I didn’t mean any disrespect. I didn’t write “I can’t believe they haven’t implemented a perfect technical process that fully prevents these attacks”.

I just asked if there are any ideas being discussed.

Two things can be true at the same time: 1. What the “researchers” did was unethical. 2. They uncovered security flaws.
Football club - a collective enterprise rooted in a society run in the service of collective goals.

A large corporation - a collective enterprise rooted in a society run in the service of collective goals.
Wow, shocking and completely unethical by that professor.
I agree with this, and it's interesting how many open source tools there are that create these graphs and charts, store tons of data, etc. All with a mostly "eyes on glass" bent, which doesn't scale terribly well.

When, really, what's more important is actionable events, correlation, duplicate suppression, escalating notifications, etc. Something like what "Netcool Omnibus" and other commercial software does. Isolate actionable problems and make sure somebody owns the problem.

But for reasons I don't understand, there isn't much in the open source world in that space.
> It's a specific threat model they were exploring: a malicious actor introducing vulnerability on purpose.

But does that matter? We can imagine that the error-prone developer who submitted the buggy patch just had a different mindset. Nothing about the patch changes. In fact, a malicious actor is explicitly trying to act like an error-prone developer and would (if skilled) be indistinguishable from one. So we'd expect the maintainer response to be the same.
> they didn’t do anyone harm.

Several of the patches are claimed to have landed in stable. Also, distributions and others (like the grsecurity people) pick up lkml patches that are not included in stable but might have security benefits. So even just publishing such a patch is harmful. Also, fixes were only provided to the maintainers privately as it seems, and unsuccessfully. Or not at all.

> If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors?

Exactly the same way as without that "research".

If you try to pry open my car door, I'll drag you to the next police station. "I'm just researching the security of car doors" won't help you.
Nice article, you could also just use https://github.com/formium/tsdx
Kids use the real remove in our house..
and so was 66Mhz 486 processors and RAM measured in KB and MB. things change.
Playing the devil's advocate:

Football has its roots in amateur and local associations with little or nothing to do with profit.

In fact, only in the 1990s (with the explosion of cable TV and sports channels) did it started becoming a huge industry.

Corporations do not share the same pedigree, so they aren't "betraying" their roots.
I am happy that we have a discussion on the subject. Its rare nowadays. We all share bits of personal and professional true, which is what makes HN a priceless place.

"Another possibility is that most founders have so little knowledge of good design and what it can do that most of them don't even consider whether it can be used to their advantage. I suspect there is some truth in both of these theories."

Commoditisation of design elements is a chance for startups to hire qualified designer from the start. In hands of a good designer, commoditisation is a prototype tool, not final point of implementation.

The problem is that they are not willing to pay for "design", because they undervalue the work of designers and don't understand how critical is for their products in competitive market in which everyone uses the same UI libraries, the same "best practices", the same PM mantras.
Recent sales: Nyan Cat ($590K), Grumpy Cat ($100K), Overly Attached Girlfriend ($459K), Leave Britney Alone ($43K), Bad Luck Brian ($45K), Success Kid ($35K), Annoying Orange ($???)

Emergence of Uniswap (trading) and Arweave (cloud) services are also bullish indicators ;)
It doesn't matter, native code doesn't make your program automatically faster, C# code is hard to aot compile, lot of things happen at runtime and Xamarin uses a lot of that

Also abuse of abstraction layers is what makes your programs slow, most of the time, wich Xamarin and now MAUI does a lot too, that's what you get for abusing OOP

In server they could get away with it thanks to their JIT, since they don't care about cold start

But in AOT scenarios, you depend a lot on the quality of the AOT compiler, how well it does optimizations, and how well your code is written to facilitates good optimizations

Again, MAUI is open source, check their code, you'll understand what i mean by "the code is just slow"

People always forget what they program for, mobile devices are constrained devices with constrained resources

Pumping your desktop PC and claiming your benchmark does well doesn't automatically translate to better perf on mobile

Then people wonder why their app drain the battery so fast, and you get 1 star reviews as a result, people doesn't care, that is why i leave 1 star reviews, most of the time
Except BSD games :p.
>Whats being done to address those issues?

Moving to rust to limit the scope of possible bugs.
Lots of people have talked eloquantly about the monetary greed the Super League entailed, but I think it misses the wider point, Kronke (et al) have long been pushing for a _redistribution of power_ in football, away from the 'leagues' (e.g. the Premier League, La Liga, UEFA) to the clubs and owners themselves. Which is the now the canonical model for US sports, where they're most comfortable.

Another example of this is last year's "Project Big Picture"[0] in the Premier League, which was mostly led by the same owners with the same motivations.

As an illustrive example, take the NFL where Roger Goodell's purpose is to serve the leagues owners. He's an instrument of their will and so's steered the NFL in a direction that benefits them the most (e.g. Goodell will always pick the path that gets them the most money). The Premier League on the other hand takes decisions that are seen by big club owners as precisely _against_ their interests (e.g. distributing TV money from foreign TV deals equally to all clubs when they claim >80% of matches watched outside the UK are of the 5-6 big clubs, the classic but reductive 'No one in Malaysia wants to watch Bolton play')

[0]: https://www.bbc.co.uk/sport/africa/54510898
>Are you saying that despite this, these malicious commits made it to production?

Vulnerable commits reached stable trees as per the maintainers in the above email exchange, though the vulnerabilities may not have been released to users yet.

The researchers themselves acknowledge the patches were accepted in the above email exchange, so it's hard to believe that they're being honest or are fully aware of their ethics violations/vulnerability introductions and that they would've prevented the patches from being released without gkh's intervention.
You haven't mentioned the best query builder I've ever used - Elixir's Ecto. I encourage to give both Elixir and Ecto a try as they're worth learning.
I never said they can not stop reviewing the code.
They can do whatever the heck they want. I'm not gonna tell a volunteer what they can and can not do. They just as much dont need anyone's consent to ignore submits as thous who submitting dont need their consent. Its voluntary, if you dont see a benefit you are free to stop, not free to tell other volunteers what to do and not to do.
The Mozilla release notes:https://www.mozilla.org/en-US/firefox/89.0beta/releasenotes/

I wonder what this means:

"Changed: Introducing a non-native implementation of web form controls, which delivers a new modern design and some improvements to page load performance. Watch for layout bugs in web pages that make assumptions about the dimensions or styling of form controls."

A very visible change is the default styling of the form elements (input, button): more rounded, with a strong double blue outline when focused. I wonder if this is supposed to reflect the style changes of the UI itself.