skysight-inc/HackerNews huggingface dataset:
My first thought was that it must be Apple.

But the article says,

> In August 2017, U.S. Company Two updated the operating system for its smartphones and other mobile devices, limiting KARMA 2’s functionality.

I didn't find any meaningful security updates by Apple in August 2017: https://support.apple.com/en-us/HT201222 The only one listed on that page was about using HTTP to send analytics data, which I don't think is the one that disabled KARMA 2.

Then I looked at Google. There are multiple RCE vulns with severity Critical during these two months: https://source.android.com/security/bulletin/2016-09-01 and https://source.android.com/security/bulletin/2017-08-01
I had an experience in my first year of grad school that has informed my code reviews and my general attitude toward reviewing others' work ever since.

I was taking a graduate-level introduction to mathematical logic. In the class we learned about a bunch of different propositional axiomatic proof systems, and then we proved properties like soundness and completeness for them. The class was organized around class participation: everyone was required to do at least one proof at the board in front of the class and every session consisted almost entirely of students doing proofs at the board.

I'd been out of school, working, for eight years before grad school and I found this all very intense and unfamiliar. I did my required work at the board, choosing an easy problem, but otherwise mostly sat in the back and watched. There was, however, a cohort of very intense aspiring logicians who sat in the front row and took deep interest in every proof.

One day, a student went up with a particularly challenging problem. From the start it was clear that he was taking an unorthodox approach to the proof. The front row went nuts, interjecting and kibitzing on practically every line, telling the guy different things that he should do instead of whatever it was that he was doing. The guy was a good sport and tried to justify everything and answer all the criticism, but it seemed like he might not get through the proof before the class ended.

The prof who had been watching quietly from the side of the class, let it go on for a while, then stepped out and quieted everyone.

"I need you to remember," he said to the front row, "that we are the audience. It is not our job to prove this theorem; it is this gentleman's job. Our job as the audience is to listen to him, and at the end, decide if we are convinced. He may do things differently that you would have done, but that doesn't matter, as long as in the end we are convinced."

That was twenty-three years ago, but it stuck with me. In programming, there are often many different ways that a problem could be solved, but there is almost never One True Way™, even though there are often many voices that would like to convince you that their way is the right one. My job as a reviewer of code, or really anything, is not to try to get the other person to do what I would have done, but to decide if I'm convinced that the way that they've chosen is good enough, and, if not, to ask for changes that would convince me.

Sure, sometimes a PR is so bad that it needs to be completely rewritten, but in my experience that's rare, and in that case the feedback should probably be given in person and in private or in a friendly, sympathetic group.
> I was mad that, while I spent my nights learning F#, my daughter started calling everyone around “fathers”. And this guy, instead of getting better at his job, went home to his children. And I wanted to punish him.

This reads like American Psycho. I can't believe this guy is for real. You have nothing but your job, so - at your job - you try to make everyone you work with miserable? What? Why?

Have you considered trying to make your life enjoyable ever?
How do you know anyone has natural immunity? There are plenty of anti-vaxx conspiracy nutjobs that would happily lie about it to avoid getting improved 5G.
> Are there technical differences or is it only licensing that's different?

From https://www.oracle.com/java/technologies/javase/17-relnote-i...

-----

Although we have stated the goal to have OpenJDK and Oracle JDK binaries be as close to each other as possible there remain several differences between the two options.

The current differences are:

- Oracle JDK offers "installers" (msi, rpm, deb, etc.) which not only place the JDK binaries in your system but also contain update rules and in some cases handle some common configurations like set common environmental variables (such as, JAVA_HOME in Windows) and establish file associations (such as, use java to launch .jar files). OpenJDK is offered only as compressed archive (tar.gz or .zip).

- Usage Logging is only available in Oracle JDK.

- Oracle JDK requires that third-party cryptographic providers be signed with a Java Cryptography Extension (JCE) Code Signing Certificate. OpenJDK continues allowing the use of unsigned third-party crypto providers.

- The output of java -version is different. Oracle JDK returns java and includes the Oracle-specific identifier. OpenJDK returns OpenJDK and does not include the Oracle-specific identifier.

- Oracle JDK 17 and later is released under the Oracle No-Fee Terms and Conditions License. OpenJDK is released under GPLv2wCP. License files included with each will therefore be different.

- Oracle JDK distributes FreeType under the FreeType license and OpenJDK does so under GPLv2. The contents of \legal\java.desktop\freetype.md is therefore different.

- Oracle JDK has Java cup and steam icons and OpenJDK has Duke icons.

- Oracle JDK source code includes "ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms."

- Source code distributed with OpenJDK refers to the GPL license terms instead.
I'm not asking what is, but why it should be that way. Why should I name my children for the government's convenience? Why are Jürgen, Hafþór, Renée, or Noël unacceptable names?
This except there is no right way and there are 'n' equally good ways of solving any real world problem. It's only worth pointing out flaws if something is genuinely bad and I mean bad. Otherwise you are using a gut opinion to trash someone else's emotional health.

Yay! you found an edge case that breaks a piece of code that will never get hit while the other million and 1 edge cases that haven't been found are still out there. Yet you drag it out from the dark and show it off for all to see like some damn trophy. Yay! look I am great I found one more thing wrong than the other guy. No matter that we are all swimming in a sea of wrong and every one is completely clueless. Only slightly less clueless than those who don't even realise they don't have a clue.

It follows from a simple argument - every programmer and every company has a different view of 'good'. I've seen it, I've worked in many. Just as every religion cannot be right, every weird view on correct programming style cannot be correct.
I can recommend similar, but locally running tool, `ssh-audit`:
https://github.com/jtesta/ssh-audit

Disclaimer: I'm not associated in any way
> The way businesses and the private economy in general are structured today seems to have arisen organically, though, it wasn't masterminded and imposed on anyone.

Simplest counter example is labor unions. There was in fact a huge campaign to dismantle labor union power in the United States. Look at the way labor power was limited by state force in the 1947 Taft Hartley Act for one example:

https://en.wikipedia.org/wiki/Taft%E2%80%93Hartley_Act

Meanwhile in Germany every big company legally must have representatives from the union on the board of directors. A lot has happened since Adam Smith and some of it was "masterminded" on both sides. For example the "organic" work day was 14 hours long until labor activists fought and in some cases died for the 8 hour work day. We have made many decisions about the structure of businesses in USA and unfortunately much of it favors the accumulation of power at the top to the detriment of most people.

Finally, we must recognize that no matter what structure we have, we can always imagine better ones. And we can apply the same effort and pressure to make change as has happened in the past.
Maybe Kite could consider introducing the unique label kitegraph,
a bit like Go being searchable as golang
How much better is Google? Sure you can buy kindle books on android but they have done many a shady practice. There is always pinephone :)

https://en.m.wikipedia.org/wiki/Criticism_of_Google
Write Epic Shit
It's a blessing...a majority would destroy what they get, or use it to hurt this country.
Yes exactly. With transparency and predefined incentives, you can now make informed rational decisions about what company you want to work for based on how you feel their values (and yes, what you're describing are essentially values) align with your own and with where you feel you'll be successful.

If you think about this over a long enough timescale, and believe in something like the efficient market hypothesis, companies will converge on near-optimal structures that pay for the performance that is valued in their niche, and individual will be able to make informed decisions to work with companies that will pay them based on their strengths.

Note that I'm not saying that a company can't ever change its compensation and performance evaluation, so if LoC is a bad metric, over time I'd expect companies to move away from it as they find it to be gamed. But like, I'm not going to stop a company from picking a bad metric, or claim that transparency is bad because companies can make bad decisions. Companies can make equally bad decisions today, and you won't know.
Those crashes were just on our unit tests, creating linking and destroying large volumes of objects, throwing them in a thread for some basic compute then writing results to disk. I agree its really about the gc, but the new ones just never seemed to beat the setup we have on 8, and there is only so much time that can be devoted to making things that work, work on "new shiney".

java after 8 is just mayhem, before it was easy, oracle for some things, ibm for others.

now there are new long term releases faster than we can test them, they fail at least one of the unit tests that all pass on 8, and openjdk is missing half the really nice stuff that was once free.

>submit a bug report
but to who and under what title? Oracle, IBM, openjdk?

e.g. "none of the corba stuff works anymore because its not part of 'new java'" is whose fault?
Haha. I love that. Fuck it I'm gonna buy it too!

I played piano for 9 years as a child, and then stopped when I went to college (because no piano). But I taught myself to play guitar in (boredom + found guitar and music know-how). But I'm in my mid 40s now and have done very little musically in 20 years. I really really really want to play more music, but I'll probably end up saying that on my deathbed (in past tense). Maybe downloading this thing and plugging a guitar or piano up to a computer will change that.
Ah, okay, my apologies :) I read that as a synonym for "mcmansion".
A bad PR can mean soo many different things.

Ranging from "I wouldn't have implemented it that way" to "this opens up a huge security hole".

Security issues shouldn't be allowed in. But a lot of "maintainability" issues have negligible if any gains, and real costs like

it takes time to fix

could introduce new bugs

creates bad feelings between coworkers
How can there be moon dust if there’s no atmospere? Is it from asteroid collisions kicking up dust?
9/11 every two days.

https://www.axios.com/covid-deaths-september-11-8b2b230f-9dd...
I really haven't coded for long compared to some.

I always look at code reviews or just reading / talking about each other's code as a way for us to just get on the same page about how we do things. Make everyone's life easier. "Hey man when we're looping through that thing here is how we usually do it." "Ok cool, I'll do that." Or maybe we have a discussion on why I did it differently this time and how we might address that.

Much of the time I don't "care" or feel strongly what the change or answer is. If we're all doing the same thing / spot a bug sooner, it's just easier for everyone.

But it seems code reviews to some are this sort of battle / proving ground / have a lot of elements of status. I don't get that...
Ok -- I agree exponentially was the wrong adjective, but I think linearly is wrong too, because the number of EVs being produced now (mostly because of TSLA) is not keeping pace with the chargers. You notice this because lines at TSLA chargers are common on the east coast. The competing charging networks in the US suck, and if TSLA opens up their network to non-TSLAs, this will just get worse.

I have no clue what it takes to construct the chargers (maybe someone here can chime in), but it isn't just "outlets" -- it presumably requires a larger-than-average power source to charge 8+ cars simultaneously at 250Kw
It’s worth mentioning that, if you listen to the podcast mentioned in this thread, DarkMatter, the hacking company, at some point ran a certificate authority that was recognized by browsers including Chrome and Firefox, until lately that news about them came out.

I wouldn’t blindly trust CAs either.
There are a few types of comments on code review that I see:

1. Critical mistakes

2. Style guide mistakes

3. Non-optimal design (in your opinion)

#1 Always receives a comment, obviously.

#2 Always receives a comment, but we have good automation here so it's not too much of a worry.

#3 Is where it gets interesting. A lot of the time, commenting about this category is prematurely optimizing and it's a waste of time for both the reviewer and the owner of the change. At most I try to make one overarching comment about the design.

You really have to ask yourself "Does it work? Will it cause issues down the line?" If the answers are Yes and No respectively, you should likely let it go.

The feeling of ownership over the design, especially for a junior engineer, is incredibly important for moral and the ability to get better over time. IMO it's also important to let them make small mistakes now and again so they can learn from it.
> What entitles business owners to all the benefits of highly productive workers?

This is exactly why many of those workers go on to start their own businesses, to redirect those benefits to themselves.
Does this mean that tools like sdkman can include the Oracle JDK? (I haven't found any PR for it yet)
Ha!
I rewrote the CTOS serial protocol for the OS message passing link. It had been severely limited by fixed timers between polls, so going faster than 9600 didn't matter.

I changed it to 'if you have a packet, send it. If you can't buffer a packet, NACK it'. Now we could run full speed (and full duplex!) It instantly became practical to log in remotely and use source control on our server. Which mattered to me, because I was remote-working.

Anyway, nostalgia
It can be both, but you're absolutely right.
My bicycle tires are kevlar (I think) reinforced for puncture resistance. For me it was absolutely worth the cost, given how often I had been getting punctures before that: on a roughly 12-18 minute cycle commute, I went from one every month or so with normal tires to no puncture ever until the tire itself wore out.
A contrarian might ask "How many bugs were there in the HTML5 APIs that replaced it?" Probably fewer considering HTML5 is an open/modern code base? Some high profile ones in Audio though...
Methylprednisolone is more effective than dexamethasone for treating COVID-19 lung injuries. Cost is similar.

https://journals.plos.org/plosone/article?id=10.1371/journal...

https://bmcinfectdis.biomedcentral.com/articles/10.1186/s128...
Anonymity on the internet doesn't seem to provide much in the way of civility.
I would consider being unable to purchase a rundown house in a mediocre location after 30 years of saving from a high income to be pretty bad. You obviously aren't poor but it's not exactly a good situation to be in.
One of the best ones is "SSH Mastery" by Michael W. Lukas: https://www.tiltedwindmillpress.com/product/ssh-mastery-2nd-...
I don't think they were necessarily referring to getting rid of NK as much as NK's tactic of firing missiles. China could presumably influence to NK to not launch missiles at neighbors while still supporting it as a separate state, it's just not in their interest to do that either.
It's not hard to become a NixOS guru if you work somewhere that uses it..only thing blocking most people in my experience is a stick up their butt.
AzureWebJobsStorage, the secret you don't need in your Function App
I remember there were a lot of libraries that were part of the jdk that got decoupled and no longer included in the move from java8 to java9. I specifically remember this impacting anyone who parsed xml or json. I vaguely remember it being something in the javax.validation package.

My company migrated from 8 to 11 but we had a lot of headaches around those libraries that were pulled out of the jdk.

To be fair, those should not have been coupled to the jdk in the first place, but it did break backwards compatibility which was a cardinal sin for java.
Is "rig" a valid quotation of "dirigibility"?

Is "go there" a valid quotation of "never go there"?
Ctrl-F
automl https://westurner.github.io/hnlog/

> /? hierarchical automl "sklearn" site:github.com : https://www.google.com/search?q=hierarchical+automl+%22sklea...

https://westurner.github.io/hnlog/#comment-18798244

> Dask-ML works with {scikit-learn, xgboost, tensorflow, TPOT,}. ETL is your responsibility. Loading things into parquet format affords a lot of flexibility in terms of (non-SQL) datastores or just efficiently packed files on disk that need to be paged into/over in RAM. (Edit)

scale-scikit-learn
https://examples.dask.org/machine-learning/scale-scikit-lear... -> dask.distributed parallel predication: https://examples.dask.org/machine-learning/parallel-predicti...

"Hyperparameter optimization with Dask"
https://examples.dask.org/machine-learning/hyperparam-opt.ht...

> Sklearn.pipeline.Pipeline API: {fit(), transform(), predict(), score(),} https://scikit-learn.org/stable/modules/generated/sklearn.pi... : ```

decision_function(X) # Apply transforms, and decision_function of the final estimator

fit(X[, y]) # Fit the model

fit_predict(X[, y]) # Applies fit_predict of last step in pipeline after transforms.

fit_transform(X[, y]) # Fit the model and transform with the final estimator

get_params([deep]) # Get parameters for this estimator.

predict(X, *predict_params) # Apply transforms to the data, and predict with the final estimator

predict_log_proba(X) # Apply transforms, and predict_log_proba of the final estimator

predict_proba(X) # Apply transforms, and predict_proba of the final estimator

score(X[, y, sample_weight]) # Apply transforms, and score with the final estimator

score_samples(X) # Apply transforms, and score_samples of the final estimator.

set_params(**kwargs) # Set the parameters of this estimator

```

> https://docs.featuretools.com can also minimize ad-hoc boilerplate ETL / feature engineering :

>> Featuretools is a framework to perform automated feature engineering. It excels at transforming temporal and relational datasets into feature matrices for machine learning

From
https://featuretools.alteryx.com/en/stable/guides/using_dask... :

> Creating a feature matrix from a very large dataset can be problematic if the underlying pandas dataframes that make up the entities cannot easily fit in memory. To help get around this issue, Featuretools supports creating Entity and EntitySet objects from Dask dataframes. A Dask EntitySet can then be passed to featuretools.dfs or featuretools.calculate_feature_matrix to create a feature matrix, which will be returned as a Dask dataframe. In addition to working on larger than memory datasets, this approach also allows users to take advantage of the parallel and distributed processing capabilities offered by Dask
I’m not saying an API to interface through the site no.

What I mean is that I would typically want to specify the project through more of a ‘Build it to this interface’ style, and I would like to know that the type of people who are on the site are okay working to this style.

Then I would be both a project supplier and a code supplier depending at different times. More of a marketplace for developers to cooperate. Does that make sense?

So my request is not so much about features for you to build for the site as it is about web copy and outreach to your user base to set expectations.
*Russian American Psycho
Yep, you got it.

The joke is: "when US claimed you have wmd, you better actually have it"...

NK has been behaving quite bad comparing to some other countries that got US invasion. The reason that they were not invaded, is mostly that they indeed have the stuff that can scare away US.
Putting the period or comma within quotes (the US style) is like tucking your shirt in and then leaving a small part of it out.
If you were going to give/allow Taiwan nuclear weapons to protect itself, you'd have wanted to do it decades ago. And you wouldn't support them in developing nuclear weapons, you'd want to have quietly slipped nukes into Taiwan several decades ago. China was far less advanced in the 1980s and 1990s, it might have been possible to arm Taiwan with nukes back then, before China could stop it. Today if China found out Taiwan were attempting to develop nuclear weapons, they'd either invade and conquer the island in rapid fashion (at whatever cost necessary), or potentially glass it entirely (that's a serious consideration for China, and a good reason not to give Taiwan nukes at this point).
> I was, again, technically stronger. A thousand-string pull request was littered with 200 comments, not leaving the person even a faint hope in his competency. Great.

That's way too much feedback. It makes it very hard determine which problems are critical, and which come down to aesthetics or personal preference. On the flip side, if I was churning out buggy code at that rate, I'd want to know about those bugs in detail.

There's also an opportunity cost of evaluating code so tightly. Not only does it take up more of the reviewer's time, it also eats up developer time that could be spent on other features.

> The reason for these angry code reviews is obvious. As part of the team, I bear full responsibility for the project’s code base. I have to work with it later, after all. It’s a source of many issues for the business. The code doesn’t scale, can’t be tested properly, is littered with bugs. Support gets more and more expensive. It can’t be open-sourced or used to lure new developers.

Premature optimization? The mistake here is trying to optimize the legacy of your code base, possibly thinking too far ahead.
Looking for a co-founder to build a real estate/blockchain
I'm from Costa Rica. With a background in technology, international business and CS. I am aware of the very high number of tourists from the USA, England and France that our country receives every year. I have the idea of developing some vacation homes on a property 5 minutes from 4 beaches, overlooking the sea, that a friend is selling at a very low price. With $500k we could buy the land and build at least 2 medium houses, with luxury finishes and fully equipped to rent to vacationers or sell them.

The idea is to create a token and that people in the crypto community can buy it to participate in the profits in the future. For example: 1,000 tokens of $500 each, if someone buys 20% of the total issue, they participate in that same proportion of on capital gains.
Inspiration4 Mission
There already is a pregnant woman codepoint (U+1F930) that was added in 2016. The pregnant person emoji can be used to reflect a non-gendered reference to pregnancy or in reference to specifically non-binary pregnant people.
For two decades I wrote professionally and there were no code reviews at all. I had no problem with that.