skysight-inc/HackerNews huggingface dataset:
Do they? Their website https://cdnjs.com/libraries says
"Couldn't find the library you're looking for?
You can make a request to have it added on our GitHub repository."

Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695

If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see

-rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh

both which just have the contents "Retesting"
This is America and they’re a corporation. It’s the price of doing business.
A lot of companies are just scared of open source and automatically refuse to be involved in open sourcing any code
As a mac user, I bought an used PC (haswell i7) + used gpu (rx580) for about $500 (last year before hw price crunch though), and it plays everything on 1440p.
"The ayatollahs do not lead a democracy, and do not deserve your sympathetic words. "

I do not have any sympathy for the ayatollahs. I have sympathy for iranian people. That is not the same. But the way I see it, the more outside pressure goes on iran as its whole(and not their government), the more they close ranks, naturally.
During WW2, a good percentage of the developed nations were at war with each other. Nazi Germany declared "total war" when Hitler realised they were losing. Japan refused to quit until they were shown the true power of nuclear weapons. Countless lives were lost and resources consumed. But despite this, 70 years later we are still here and most people in developed nations live very comfortable lives.

Forgive me if I'm a little sceptical about any prediction beyond 5 years...
GPs logic in his post seems sound to me, he said "you get a probability" he didn't say you have to be 100% sure before you can draw any conclusion. I think it is important that we are precise in our language, because any impression can be exploited as a way to undermine the overwhelming evidence, that man-made climate change is real.

Btw, that was part of the my school curriculum in the 90s in Germany, so I can't fathom why there are still so many people in the USA who deny it.

What I am missing is the move to start mitigating climate change as well as trying to prevent its progress. City planning, infrastructure planning, home building has to change in order to prepare for more extreme waether conditions. Even app development should really start to consider whether an always connected cloud is really necessary. Almost, everything our societies rely on has to become more decentralized. Of course we can't simply go back to the state before centralization/globalization because it provided tremendous improvements in efficiency.
echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: https://blog.cloudflare.com/content/images/2019/12/1-with-ar...

from 2019/12/20 cloudflare blog post about cdnjs project: https://blog.cloudflare.com/an-update-on-cdnjs/
Why is it disturbing? Isn't that just a values-neutral outcome, or, are you saying it's disturbing from the perspective of academia?
I believe it's more about gaming on sofa than gaming on train.
Looked cool, until i scrolled further down. Not only is any info lacking on how it's done and what the status is. There are even a bunch of "community projects" listed. Among them "Real Vegan Cheese and Narwhal evolutionary genomics" and "Mushroom Lovers". Not judging those, but that's far off from "let's provide the poor with safe and affordable insulin". Feels dishonest, tbh.
This kind of projects are totally alien for me, because of the paid-by-taxes Healthcare I have in my European country.

Aren’t there any initiatives in some US states to make socialized healthcare?
It really isn't. History is littered with civilizations that were on top, got complacent, and were swallowed by up to that point irrelevant tiny neighbours.

They all had the wealth, the power, the tech. They didn't have the tolerance for short term pain for greater future gains anymore. So they stood there watching how they went down, slowly but surely . And talking a lot.

I would not be surprised if future historians mark the 1990’s as the peak of the US empire
I wonder also if he had the constraints of traditional obligatory schooling, or if he had the freedom of home education to pursue his incredible interest and self-education in piano crafting and entrepreneurial activity?
> Except the first price column clearly shows that is false.

Only if you assume that "number-crunching and brute-forcing" is the only way to the first prize, surely?
No, repo is not tied to AOSP or the Android build system.

As an example, Chromium [0] is a non-AOSP project that also uses repo.

[0] https://chromium.googlesource.com/chromiumos/docs/+/HEAD/dev...
Honestly, I'd prefer the Steam Deck over my phone, simply because it's a dedicated gaming device with integrated controls. I'm always forgetting my gamepad and I hate fiddling with putting the phone in the holder. It's just so awkward. A gaming device in the form of a tablet like the Switch is so much more convenient.
The DNS zone text file format is the most horrific, loosely specified thing to parse

I did some experiments a number of years ago and found almost none of the DNS server software out there parses zone files the same, particularly surrounding parenthesis, line wrapping, and unknown record types.
That may be true now, but things have settled down a lot in general these last ten years or so. Before that things were often in a state of flux and things definitely broke on Arch regularly. The point is, Arch itself does nothing to give you stability. What you're seeing is just that the packages you're using are stable and bleeding edge doesn't mean what it once did.
IIRC ikea uses about 2% of global lumber production. I don't know how that stacks up to others, but it is definitely one of the larger consumers.
Because you are not using a smoke absorber to pull it away. Anyone that does a lot of soldering should have one:

https://www.amazon.com/s?k=soldering+smoke&ref=nb_sb_noss_2

I suspect the actual answer to your question is the updraft around your body due to body heat. Bodies have heat plumes, bacterial plumes, CO2 plumes, DNA plumes, virus plumes, and more.
5+7=12 thus divisible by 3 and not prime
I'd be willing to bet that any open source alternative approach to insulin manufacturing that gets any traction would have drug companies quickly lobbying governments to license insulin production, or they'd launch ads campaigns about the dangers of "socialist insulin", or something. They'll do their best to kill off the competition no matter what.

Insulin is cheap to manufacture. Around the world in countries that have regulated drug pricing it's also cheap to buy. The best (as in proven-to-work) way to reduce the price in places where it's expensive is to stop drug companies charging whatever they want.
Problem is the process that brings those heads on the sticks. It often involves death & destruction of plenty other people and infrastructure.
Does watching an anti-procrastination video course count as procrastination?

But in all seriousness, great work!
And you think the people in the 3/4th are going to let you do that? Because I'm guessing that the 3/4th doesn't include you and your loved ones.
The vulnerability is the ability to poison the cache of some popular library once I steam the WORKERS_KV token. I could choose the most popular library, say Bootstrap, and change it to something else. People who loaded the script with SRI on browsers that support SRI would notice a problem, but could still target millions of others.
While the time to build is certainly true, is the cost truly more expensive than that of effects of climate change? I suspect not.
That's what FDM 3d prints look like. You could of course sand the whole thing smooth but that rather defeats the purpose of 3d printing it in the first place.
The eagle and the rabbit America, China and the race to the Moon
Yeah I was thinking that. So you have a mortgage on it or did you inherit it? If the latter, think pretty hard before you sell it, that is a crazy luxury that a lot of people will never be afforded.
I used to be excited about learning new languages, but a few years ago I lost interest and decided to consolidate on just one language. That language was C++.

C++ gets you most of the way to Python, which is as high as you can go (cue Smug Lisp Weenies with "muh macros"). So stop futzing around, and just use C++.

All these other plethora of languages are all well and good, and I'm sure they all have their secret sauce, but is their secret sauce tasty enough to justify a switch?

Unless a language consistently allows you to do in 1 line of code what others can do in 10, then there's little point to them.

Having said that, I have recently been poking my nose into Ada for use in microcontrollers. Their notion of "tasks" seemed quite interesting. A version for AVR didn't really seem to be any better than C, just with a different syntax. The one for the Raspberry Pi Pico didn't support tasks, which took a lot off the shine about the prospect of switching to Ada for me. Maybe it's too early days for the Pico, though.

I also had a quick try at Julia, as I was interested in trying out some DSP. There seemed to be some nice features about it. It seemed quite good at arrays. You can read a binary file very easily and convert it to a different type if required. So it is still on my radar.

I use Python for quick-and-dirty stuff.

Nevertheless, C++ is basically unbeatable generally.
Yes! at the moment we support Opensea, Rarible, Foundation and HEN and we will keep adding more according to user's demand
I intend to buy and use it as a mobile workstation for programming, since it has a x86 chip, 16Gb Ram, Linux-compatible gfx chip, decent amount of storage. Basically this will fill the void left by the Nokia N900 for a lot of us. It being able to run steam/games is secondary for me.

Or, if AMD would please get on with it and release a small form factor like the Intel Nuc, that would be great. But this device does have a screen attached to it and a battery, so it would work fine as a nuc for me.

Super excited!
2Dgameartguru – Refining a game character in Inkscape [part1]
They almost certainly have this data already. I live in Dresden, a city in East Germany that also has its fair share of floods from the Elbe river [1]. The city has an interactive map where you can display flood maps for various levels. It actually has an English version as well, so you guys can try it if you want: Go to [2], switch to English in the upper right corner if it does not autoselect English for you, enter "flood" in the search box and select one of the overlays like "at 900 cm at Dresden Gauge".

[1] The last "Jahrhunderthochwasser", floods of the century, were in 2002, 2006 and 2013, so yeah, that label does not stand up to scrutiny anymore.

[2] https://stadtplan.dresden.de/
Absurdly expensive internal mmc memory in comparison to SSD
Perfect, now I can procrastinate in front of a video by pretending I'm working on not procrastinating.
But we won't have 50 more years of complacent oil usage without alternatives. Oil at 75 dollars a barrel is expensive enough that renewables are profitable, so by the time supply becomes a problem and prices rise even more, renewables will be available in quantity to cover for it. Before, probably.
Oops, thought this was an "ask HN".
Another one that fits that description would be Martin Molin of Wintergatan, who's currently on a multi-year quest to build a concert-suitable programmable marble music instrument. He's been detailing the build and concept process on YouTube.
I think the issue is that a lot of devs won't care, they are contractors and some project leader calls and says something is down, they see a failed hash, download it again and restart.. and the hash check in the first place was probably a copy/paste from a SO question..

I'm sorry for the cynicism but I'm pretty sure this is the reality for the bulk of internet companies out there.. :/
https://en.wikipedia.org/wiki/Shure_SM57
Previous discussion: https://news.ycombinator.com/item?id=27661637
Everyone seem to forget the fact that, if you are able to pay just for the sake of privacy, your data is now even more valuable, since you signal that you have disposable income to spend on things that "common folk" can not afford to.

Advertisers want to target you specifically. The better idea should be to feed them incorrect information and intentionally poison the data.
Photoshopping Drawing into Reality. This Digital Artist Is Amazing
It will fill the void that was left by the Nokia N900. Still miss that thing's slide out keyboard.. soft rubber buttons.
Obscurity isn’t a substitute for security. You still need to have proper authentication and authorization in place.
I'd say it depends on whether you're doing it instead of something productive, or in your free time/leisure.

And thanks! It's just the beginning, more updates coming - both on the content side and the interactive side.
I've bought many many games on GOG for years because of this. Lately, GOG games come in installers made out of 20 or so parts which take ages to download manually. The only real way to download their games is by using their GOG Galaxy Client. Not that much better than Steam, which on the other hand has fantastic Linux support, while GOG can't be bothered to port their GOG Galaxy client to Linux.

Luckily Lutris allows me to somehow compensate for GOG's lack of interest in Linux, but still, I feel they really do not care about the DRM thing.
I agree, Medium is pretty annoying to use as a reader. And for some strange reason, it doesn't work with Firefox's "reader view". I don't understand why people keep using this platform.
I’ve worked at startups where a third of the workforce share the same Bay Area high school alma matter. The scale of the ecosystem is without compare.
Such a map could and should be used to inform the building of new houses and zones for houses in the long term. I am living just 100 km away from that area and the risk of flooding was one factor I considered when buying my current house. (Spoiler it is near the top of small hill with a slow rising slope)
I've now memorized 10247, the second-lowest over 5 digits. Everyone else get in line.
Bigotry and Diversity at Rome
They do but from what I can tell it's not really their focus
Please could you expand? Without substance, there’s nothing here that defends your position.
> I am definitely not self-sufficient (especially not socially)! I could maybe take care of my family for one calendar year (one growing season and one winter), but it's a maybe.

For what it’s worth, the fact that you’re denying being self-sufficient, tells me that you’re not a nutjob, no matter what other people say.
Well, hopefully not pretending!
But yeah, I'm aware of the potential paradox. As far as procrastination goes, a 5 min (finite) video that gives you some practical tips is better than any infinite scrolling platform.
> The Rodney King beating was in 1991.

Sure, but it was portrayable as an isolated, extreme incident because similar events captured on video rather than by word of mouth and the mass violence resulting from the media attention to it made it less, rather than more, likely that similar incidence, even if similarly captured, would get similar attention from the oligopoly establishment media while it had no mass grassroots alternative.

So, unless you mean that to support GPs point, I’m not sure why you point it out.

> Pretending like nobody was aware is just a convenient narrative for people who have made race relations a bigger part of their politics in the recent years.

Whites who weren't personally perpetrators or direct witnesses of racist acts (and even those that were occasional witnesses) were less likely to be aware of the spectrum of racist harassment and violence experienced by Blacks in the US before universal omnipresent cameras and grassroots media to distribute and virally redistribute recordings made the aggregate of individual instances that would have largely never been recorded previously and most of which, even if they had been recorded would have either been individually too minor for the news to cover at all or to inflammatory to cover in an unfiltered way.
I'm going to use it as a (mobile NUC with screen + battery) and use it for programming etc.. not going to buy it for gaming at all. Having an amd machine with 16Gb ram + nvme storage + linux - perfect setup for day to day coding!

And will buy it as a thank you to Valve for supporting us all these years. I think this will pay off for them in the long run.
Well done Canada

India donated around 60 million before it's recent wave

https://www.wsj.com/articles/india-starts-covid-19-vaccine-d...
You're looking at the result for aesthetic value not Platonism.

And by the measure of "most" meaning majority it would still be most.
I think that big diverse countries like the USA will be able to cope better than small countries. So places like Fiji are probably more exposed than many imagine.
I was curious if the offending commit is still there but I didn't see anything that looked like it: https://github.com/cdnjs/cdnjs/commits/master?after=6901ec10...

That commit log should give you a better sense of what happened if you (like me) didn't understand how cdnjs works. Apparently robocdnjs will just pull arbitrary packages and unzip and commit them into the cdnjs repo which then gets served all over the internet. Crazy!
Thanks! I'll check that. That's a 404 page. I guess I shouldn't have made a bash-style 404 page with a mock command...
why is comment this downvoted?
I scanned through the site and their first post was in 2015 and has news articles posted about the company with titles like: "The Community Labs Built on Silicon Valley’s Junk: Trash from biotech startups are citizen scientists’ treasure" and "The Rogue Experimenters". Also, lots of posts about wanting interns. This doesn't give me a good feeling.
Team A creates a patent covering X.
Team B licenses Team As patent and creates a patent covering X+A.

Turns out everyone who does X also needs to do A, to the extent X is X+A, so everyone needs to license both patents.
It is definitely a step in the right direction, but given the current demand the development is too slow.

Just look at China, with ~50 nuclear plants (just 5% of energy production), while they have thousands of coal plants. It's practically impossible that they can shift to a reusable carbon-neutral energy production methods.

Also, China can build a hundred coal plants in a year, but there's no way it can do that with nuclear.

The realistic picture is that growth cannot be sustained and there will be dire consequences due to other factors too.

(climate change, migration, wet bulb temperatures, crop failures, people being too good at capitalism, etc.)
but this implies they own one of the repositories in https://cdnjs.com/libraries?
One prediction: there will be a Steam Deck 2, but we'll never see a Steam Deck 3.
I think it's a tool for ADHD? It's quite adorable.
Only 14 away from a prime though
FAA orders checks on 9,300 Boeing 737 planes for possible switch failures
Actually, yes. It's had almost 13 years to prove itself as a store of value, medium of exchange, and/or unit of account. It has failed to do that in any functioning economy because despite all the hype, it's remained worse than what we already have.

The fact that after all this time proponents are celebrating it being made legal tender in a tiny dysfunctional country is a very good sign of how the horizons have narrowed. After 13 years of the web no arguments about "potential" were even needed - the evidence was embedded in all our lives.
I've led an engineering team and worked with many vendors. Some while working at a $1bn company and some while working at an early stage startup.

At the $1bn company I would get vendor responses quickly, because we paid for enterprise support. At the scrappy startup I just got used to responses coming a day or so later (especially since I was working with USA vendors while I was based in Taiwan).

If a customer wants a 1-2 hour response time they'll pay much more for it.
I dont really think history shows that. The "greedy people" can keep power for very long and it takes special circumstances for the overthrow - and overthrow usually means instability with a lot of death, torture and pain for everyone.
Thanks a lot! (I am Enygmator, the author of the post)
I find it so heartening to discover that there's #qemu on oftc. I will most certainly contact you on oftc, as having someone to help me make sense of QEMU (once in a while) would be great!
P.S.: I didn't know anything about OFTC until today. I am an amateur.
That doesn’t make much difference to Rewe or Sainsbury’s where the largest packs have 16, and even the 4-packs were absent from the shelves.
Facebook blocks Gaza's Shehab News Agency from its platform
Initially, I had the same thought, then it (embarrassingly) struck me that this could help people across the globe that don't have access to inulin. It's an amazing initiative that I will donate to, but it genuinely disgust me that it had to come to this. The greed involved by the global healthcare industry that led to someone having to create this project is unconscionable.
The problem is defining “greed”.

It feels like when I want more stuff per unit time/effort, I’m just “trying to support my family and build a better life for my children”. But when other people do the same, it’s “greedy”.
Is there any definition of “greedy” we could use for the purposes of this discussion that would apply yo all humans equally?
>What other conclusion could you come to apart from a CDN breach?

"Ah fuck, hundreds of users are suddenly calling/emailing/tweeting at us saying they can't load the site, and I see a bunch of errors in the console while testing from a fresh browser. Looks like it's only affecting browsers that don't currently have this CDN JS file in cache. The CDN must have broke something, but things seem to work okay when including the script with a standard script tag. I'll just remove this SRI attribute thing for now to stop the bleeding."

Or, if they have a bit more knowledge/do a bit more research:

"Looks they might have pushed a change that minifies the JS file slightly differently or something, or maybe the script got upgraded to patch some issue? And I guess the change probably broke the SRI thing? I don't know if the file is going to change again in the near future so I'll just remove this annoying thing for now until they provide some recommendations." (Or: "I'll just hash the current version of the file and change it to that, and prepare to change it again ASAP if the errors re-appear.")

Someone more experienced/knowledgeable would obviously not operate that way, but given how popular cdnjs is, seems fairly likely at least a few administrators would do something like that. Especially if they don't fully understand what the intitialism really means or what a hash is or how integrity is defined in this context and what the implications might be. Their instinct might just be to see something breaking the site for lots of users and to "fix the problem" as quickly and easily as possible.
Short, concise and excellent without much to add in my opinion.
Congress does not.

https://www.congress.gov/bill/117th-congress/senate-bill/126...

The CHIPS Act is not USICA. That $52B number comes from USICA, which has not yet passed the House. I was being deferential earlier out of politeness but you didn't take the hint and look it up. Here is some light reading on it:

https://www.engadget.com/senate-usica-endless-frontier-act-0...

https://www.theverge.com/2021/6/8/22457293/semiconductor-chi...
lol yeah. This might be the first PC-like device with a hardware root of trust that isn't completely broken (like intel's)