skysight-inc/HackerNews huggingface dataset:
I don't usually comment on HN, but I feel inclined for this article. The advice here is very poor and misleading and shows that the author has a weak understanding of the ecosystem.

Their suggestion is to lock your project dependencies in your package.json file, however this completely ignores the rest of the dependency graph that is brought in as a result of installing those packages, locked or not.

In my experience almost every CVE or exploited package was a dependency of a dependency of a dependency that I have no direct control over.

The only way to ensure dependencies of dependencies aren't changing without your knowledge is to use and commit a lock file.
Thinking it's a shit company is one thing. Changing behavior is another.

My argument is that all of the slow down in usage (i.e. Apple's iOS changes, younger demographics ditching FB and Instagram for TikTok) would all have happened even if none of this reporting happened.

And, on a personal anecdotal level, I use Facebook less because the experience just has gotten so shitty and tiresome. Having lots of experience in the "usage optimization" industry, I think there is a real danger Facebook optimizes for the short term (outrage! scrolls! clicks!), but at some point many of us just get tired of outrage. Again, that trap was likely to happen even without any reporting.
Other way around. The Black Mirror episode was inspired by the early experiments with quadrupedal robots, especially those first terrifying Boston Dynamics videos. Like the one where the dude viciously kicks over the Big Dog and it relentlessly gets back up, and everyone's thinking "oh man, that guy is so dead as soon as these things get a brain"
DDG no thanks, as much as I dislike Google, their search engine is pretty much the only service I use, because there is no viable competition

my 2nd option would be yandex.ru

guess what, both these search engines return results for wikivoyage malta without any issues
UN Emissions Gap Report 2021
The last windows 10 vs linux benchmark that I saw had linux anywhere from 15 to 22% faster than windows 10, so if anything, this could be considered an improvement.

https://www.phoronix.com/scan.php?page=article&item=windows-...

>If taking the geometric mean of all 114 benchmark results, Windows 10 May 2020 on the Threadripper 3970X was running at 78% the speed of the fastest Linux distribution (Clear Linux) or 86% the speed of the slowest Linux distribution benchmarked (openSUSE Tumbleweed).

vs the most recent test...

>The geometric mean for all 44 tests showed Linux clearly in front of Windows 11 for this current-generation Intel platform. Ubuntu / Arch / Fedora were about 11% faster overall than Windows 11 Pro on this system. Meanwhile, Clear Linux was about 18% faster than Windows 11 and enjoyed about 5% better performance overall than the other Linux distributions.
Waymo is sure about their thing, but sometimes corporate America looks more like high stakes poker than a scientific lab or a scientific publication.

Sometimes bluffing and faking it till you make it...that makes you win the race.
They aren't losing the game, they don't even know they're playing it.
I am in the LMS space so I think I can throw in a few comments. First, great job on the website. Well designed and explains it well. I say this as a founder who struggles to get our own copy correct :)

Your biggest challenge will be figuring out exactly what market segment you are targeting. I see that you are doing Corporate and Educational institutions. Very different ballgame in terms of their needs, sales process etc. Trust me because I am doing this daily :)

All the best. Always good to see competition in this space because even though there are so many players, I think we are still in the early days on eLearning in general.
From a physical or a regulatory perspective, any of those second-order systems are going to be subject to the same money-transmitting laws in place across the world. So you can reimplement the existing money-moving tools with no significant benefits to anybody except the creators of the money-moving tools, who can take a vig instead of a bank or Visa.

Let's burn the planet down for that, hell yeah.
Go modules does this, but uses a different algorithm and semantics.

I really think they have done a great job w.r.t. software supply chain security. I've been working on a post here going into detail https://verdverm.com/go-mods/
My setup is USB-C -> USB-A -> VGA -> VCR. It’s an obsolete medium, so that seems reasonable to me.

Then again, I distinctly remember my amusement when I got my first MP3 player - a Diamond Rio PMP300 - to work with the stereo in my room when I was in high school. It was a console record player with an 8-track deck, and I used an 8-track to cassette adapter, a cassette to 1/8” stereo adapter, and plugged that into the headphone port of the Rio.
after almost 6 years?
National Fire Incident Reporting System (NFIRS)
We need more tax revenue to fund our largess says bloated, inefficient government. More news at 11.
Again, if there are sources to suggest that the streets of Barcelona justifies calling it one of the "crime capitals of Europe", feel free to supply them rather than presenting unsupported hypotheses about how drug users behave there.
> For once, photographers, artists, musicians, countless others can be in control of their own distribution and the terms of it.

That's strange, I have been purchasing digital comics, books and art online for years. Some use WooCommerce, some use Shopify or BigCartel. But they all work, and they get the artist paid.

How do artists have more control if they have to give a cut to a marketplace like OpenSea, and then have to use an exchange to convert useless ETH into food and rent payments?
It's certainly more prevalent on the front end, though. You'll never see a C/C++ job add looking for "libsodium developer" or "plibsys developer," however front end job postings are littered with "Angular dev" and "React dev" and will not consider anyone who's spent the last decade writing JavaScript but hasn't used whatever front-end button library is in use.

I honestly don't know what your system API point has to do with anything when we're talking about a distinct disadvantage to NPM specifically and the JS ecosystem generally.
Off topic: I know Ben Thompson commands a lot of respect, and I use to be a paid newsletter reader of his.

But holy cow, can he use 8x more words to convey his thoughts than needed - and he can surely make something simple sound extremely complex.

He raises good points but I really wish he would do some major editing and simplication in his posts.
I just don't see a way around a future with autonomous killing robots. As China ramps up its military rhetoric and technology spending, it's hard to imagine them drawing a line in the sand against using a technology that could give them military superiority. Once they have it, we're going to need it too, because at that point we're already threatened by its existence anyway, so there's really no point in us purposefully keeping ourselves militarily limited relative to China.
I just checked with the Dutch app. It says the QR code is valid.
Given that the majority of the NFT ecosystem is running on Ethereum which still has the gigantic fees that come with swapping tokens, purchasing tokens, staking them and minting an NFT, the artist will end up losing more money than they actually put in and will sit with their unsold NFTs forever or will sell it in frustration at a loss.

Adobe knows it is a scam. That's why they are merely selling shovels to fuel the hype and they win regardless if the would NFT market crashes.
Thank you! Took your advice, went to seat61.com, and loved it. Could I ask what other old gems I could explore?
Two months is not a lot of time for four people to investigate their government.
Well done the lads from Stripe!
I know Foundation series also toys with this concept, where “religion” is used as a way to neutralize enemy worlds and rebuild the empire
Who the hell does not lock their dependencies with npm.lock or yarn.lock? The suggestion is practically useless. This is low-effort blogospam with very little concrete information; well congrats on reaching front page and drawing attention to the completely unrelated "Open Source Session Replay" you sell.
> I'm vaccinated and prefer to be around vaccinated people. Because of health? Yes. But also because of the mindset of people

- I'm well-trained and prefer to be around well-trained people

- I'm classically educated and prefer to be around classically educated people

- I'm an atheist and prefer to be around atheists

- I'm Christian and prefer to be around Christians

- I'm Hindu and prefer to be around Hindus

- I'm Muslim and prefer to be around Muslims

- I'm vegetarian and prefer to be around vegetarians

- I'm anarchist and prefer to be around anarchists

- I'm <category> and prefer to be around <category>

Notice the segregated society this attitude creates? Now look in some history books - real ones, not political propaganda pieces - and see how this type of us-versus-them society tends to end up.

I'm vaccinated and I don't give a damn about whether people around me are vaccinated or not. I'm atheist and like to mingle with Christians, Hindus, Muslims and what have you. I'm left-handed and still willing to shake your hand (remember that, shaking hands?). I'm open to the world, not just to my own in-group. I might not agree with many of the doctrines of those Muslims nor some of those Christians or Hindus, I might sometimes be annoyed at how utensils are tailored to right-handed people but I'm not going to segregate myself into an atheist, left-handed, classically educated, ... group just because of such trivial quibbles.

Also, SARS2 is not a big threat to vaccinated people. Why the hysteria? Did you act this way during one of the influenza pandemics? If not, then why treat this disease differently?
Maybe from Austria?
Many find it to be a long boring slog of a book.

They get frustrated with its jargon and made up words. They don't find the story captivating. And they find the writing style pretentious, antiquated, hard to read.
It only seems user friendly because you’re used to it. Same with the Mac.
We're getting closer and closer to Robocop (1987)'s ED-209.
Clearly someone cares, hence the existence of the article. Be if you don't care, then why not get on with your life instead of writing it a comment?
It worked for Apple with: ADB -> USB, SCSI -> Firewire -> USB, No Floppy, No CD, etc. However, the device manufactures had bought in and rolled new connectivity with them. Remember hard drives that had eSATA, USB, Firewire all on one chasis?

I do agree that the USB combined with Thunderbolt and the cabling differences were a problem and really pissed me off. It also doesn't help that a hub to do what you are doing with a single cable really should be thunderbolt and minimum costs >$200 to do it right. People were used to USB hubs costing $20.

Horrible execution in every part of the transition.
> Also don't forget, many people don't want to live in a crowded, noisy, dirty, disease ridden city.

I dispute that cities are necessarily dirty and disease ridden, particularly the latter. There are models for cities that would work in this regard (e.g. Tokyo, Singapore).

That said, I don't necessarily have much sympathy for the notion that we shouldn't rely on electric cars -- we should just do the simpler option of completely restructuring American cities and reallocating vast numbers of people. Which would be overwhelmingly, unfathomably expensive, as well as rely on people actually wanting to move to the new cities. (Or forcing them to, I suppose.)

Speaking for myself, I like having a bit of space. My very long term goal is to have a house or cabin in some decent forest, secluded and private and peaceful. City life just isn't appealing.
The Author of the substack was curious about the voice at start of the movie. That was the voice of a Sardaukar.
Dynamic languages are dangerous toys...until someone straps a chastity belt on them.
user friendly?

can't remember the last time my Linux machine:

- force rebooted over my explict objection, then spent 30 minutes installing updates
- showed me ads from the notification tray
- showed me ads on the start menu
- showed me ads on the lock screen
- showed me ads in the file manager
- showed me ads when I attempt to change the default browser
- installed MS teams
- sent mountains of telemetry back to base (which can't be disabled)

the standards of 2000 would consider Windows 11 to be adware/spyware
That’s a specification. Just because the specification says it’s standardised it doesn’t mean it is. Where’s the corresponding approval from ISO, ANSI or other standards authority?

There’s nothing wrong with a specification or even a reference implementation but they are not themselves standards. And that’s exactly what this is: a widely respected specification.

You shouldn’t have to lie about this being standardised for it still to be relevant.
Not arbitrary transcendental numbers, but the e specifically.
This type of response is also why Common Lisp isn’t more popular. :)

Having a standard has little to do with how people write code, which is what I meant by idiomatic conventions.

Elixir is not a “cool, hyped” language in the sense that you mean. Elixir is basically a wrapper around Erlang and OTP, which is an old technology (much older than ANSI Common Lisp), that provides several improvements in terms of developer tools and frameworks. It’s not just the next “cool” thing. It’s an incremental improvement on an old and tested technology to bring that technology to more developers. It has also been embraced by the Erlang community.
While I am not denying that first issue exists, that first issue is resolved by the transition finishing. It is painful now but it would have fixed itself.

Which again that transition would have never even started had the companies not tried to push it.
> Not from Germany for sure.

Is it illegal to name a child Adolf Hitler in Germany? Serious question, not sarcasm.
These Wiliot chips already draw power from distant LTE towers, can do I/O through GPIO and can communicate back 20 meters through a Bluetooth LE ping. Imagine a new smart thermostat that gathered temperature data from a dozen unpowered temperature sensors throughout your home, adjusted accordingly, then sent you a report on your home's insulation performance. These tags could be used for that today.

https://support.wiliot.com/hc/en-us/articles/360059009614-Wi...
The sound levels were absolutely bonkers, I had volume at 20/40 for some parts and 40/40 for others. I watched most of the movie with subtitles on because I didn't want to wakeup the neighbors. I wish Android TV had the ability for loudness equalization. Does VLC or Plex have this feature? I think I checked once before and didn't find it.
So can be the published packages? And the developer accounts' passwords?
Just move to China. Dysfunction in the US has no fix in sight.
Agreed. I spend a lot of time writing SD cards for use in various projects I do using the Raspberry Pi. Unusual for a week to go by when I'm not doing it.
In what way? What is GraphQL competing with? I can't think of another reasonable alternative that allows the client to specify what they want in a single round trip. What preceded GraphQL was REST with a whole lot of inconsistent include_xyz query params.
Might be a matter of issuing bodies per country. Most countries have 1 passport issuing authority that’s used to thinking about security 1st, while they can have many covid certificate issuers. And many clinical authorities are not security 1st.
No. There's not even a UK-based company that offers a decent interconnect to the NHS network that doesn't cost the earth.

AWS is probably genuinely the best tool for the job here.
> In case of a leaked private key where the actual PKI wasn't breached, they still have authority over the CA itself and can therefore determine which certs are valid and which are fake.

In a very important sense the private key is the CA.

The OCSP responses are not encrypted (you'll notice that URL you mentioned is HTTP, you can't use HTTPS for this) but they are signed documents. They're signed by the issuer using its Private Key.

So, somebody who has the Private Key can mint bogus OCSP responses signed with that key too.

The recovery from losing a signing key is to revoke the entire tree under that key. This will usually involve pushing out software changes e.g. a Firefox or Chrome gets fresh data from the vendor saying "This CA is no longer trustworthy, disregard it".

This disaster scenario is why the root keys aren't (must not be) online. If you break into the computer systems of a famous but competent CA and seize total control of everything, you could perhaps (it should be difficult because they're using HSMs but if you've really got control of everything it may be possible) steal the private keys for the online intermediates. But their root is physically locked in somebody's safe, so, you can't steal that by this route for the same reason you can't steal gold bars from Fort Knox by hacking the Pentagon's web site.
Just curious, what should they use instead?
It's not actually possible to work at Amazon and qualify for food stamps, unless you are a single parent with multiple children. Amazon simply pays too much.
Seing a lot of new PHP and Ruby ads locally.
Jeff Goldblum: Don't you see the danger inherent in what you're doing here? Killbots will be the most awesome force the planet's ever seen, but you wield it like a kid that's found his dad's gun.

Richard Attenborough: I don't think you're giving us our due credit. Our scientists have done things which nobody's ever done before… Our robots can do parkour and even dance!

Goldblum: Yeah, yeah, but your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should.

Attenborough: What about search and rescue? They're not just for the military, you know…

Goldblum: (shaking his head) No…

Laura Dern: Well, the question is, how can you know every possible use for a new technology? And therefore, how could you ever assume that you can control it? I mean, you have plants in this building that are poisonous, you picked them because they look good, but these are aggressive near-living machines that have no idea what's right from wrong, and they'll defend themselves, violently if necessary.

Attenborough: Sam Neill, if there's one person here who could appreciate what I'm trying to do...

Sam Neill: The world has just changed so radically, and we're all running to catch up. I don't want to jump to any conclusions, but look... Killbots and man have just been suddenly thrown into the mix together. How can we possibly have the slightest idea what to expect?

Attenborough: (laughing) I don't believe it. I don't believe it! You're meant to come down here and defend me against these characters, and the only one I've got on my side is the blood-sucking lawyer!

Goldblum: Power, uh, finds a way… to oppress.
Kinda off topic, but I'm wondering who names these threat actors?
I have to say that I agree with this. The primary purpose of an operating system now that I passed my *rties is to get out of the way. And Linux does that really well, while Windows is doing it less and less.

I'm happy that we have at least 3-4 popular operating systems still, and that this should help drive innovation. But at the same time, I feel like Linux gets all the free innovation because of its openness. And if you add all the benefits of Linux being very user-friendly (as in not spamming me with ads), then it's just going to be a better choice.
Autofuzz – Fuzzing Java Without Writing Fuzz Targets
We could at least make it illegal domestically.

Also, is this Cold War thinking still common? I thought we were over that by now.
On Fighting
I actually did and the link just references a specification, not a standard.

Something being “standardised” requires more than just a specification and just because the specification throws the term “standard” around it doesn’t mean it has been formally standardised.

This doesn’t mean people shouldn’t still follow the specification. Plenty of specifications exist that have not been standardised. For example, there is an RFC specification for CSVs but not formal standard.

So by all means push this specification as a de facto standard but please don’t mislead people saying it has been standardised when it has not.
I agree! Another reason why VE appears to decrease might be that the ratio of unvax population with prior infection might be growing, and it's a wash between vax and post infection natural immunity.

OTOH this is not an isolated data point. We have: the booster push (why?), the veteran study, the PHE data. Something doesn't add up. For whatever reasons, the observed epi VE, after all the confouding factors are accounted by reality, is fading for both infection and severe infection, though VE agains severe infection is fading at a slower rate. To the point of J&J VE against infection (the weakest of the bunch) being almost gone in 6 months. I don't have a time machine, but I'm really interested to see how the Jan 2022 VE numbers hold up across the board.

Given OAS concerns (please re-read the dengue study excerpt I already quoted), near zero covid risk for kids, rapidly fading VE against infection and the general lack of long term data about covid & immune system (no time machines), what exactly is the rush to vaccinate kids against the original variant?! And why do we pretend we can just tweak vaccines to any new variant, when, while technologically we can concoct any protein we like, the immune system doesn't turn on a dime?
Maybe you can do it with REST but it would be more complicated and won't be the right tool for the job.

RESTful or FIOH seems only appropriate if you design a public API. If your API isn't public, you don't need it to be RESTful. If you just need microservice communication, you don't even REST nor HTTP.

We shouldn't try to deform the whole logic and actual needs to fit a few HTTP verbs.
Would you mind sharing the author's name as well please? I'm interested in checking this book out.
I don't buy that this is an actual trend. If anything I think we're seeing more original plots than we used to. Even marvel plots are a hell of a lot more interesting than their equivalents in the 00s, 90s, and 80s. A lot of content is starting to get smarter, and more genre savvy, and indie content is thriving more than ever before.
Mt gox happened 8 years ago, and Tether just survived a pretty big test. These things actually build confidence in crypto. FDIC is only possible because the government can print money which underscores the how prone dollars are to inflation. As with everything - diversify, hold both.
I think private companies and corporate American might be the way to go about trying to alleviate climate change. We are already seeing some effects on automobiles too where major US companies are trying to move towards EVs. In the current political climate I doubt the US government would able to do much but corporate America can maybe move the needle.
Possibly, but is cost the only factor? What if you don't want to wait a year to get the data? Or don't want to saturate the 'net connection you're using with just this download? And what about error recovery, since no 'net link is going to be 100% stable for an entire year...

Not saying Snowball is the best idea by any means. But I can see how it might be worth considering.
That's just your opinion :)
I’m not sure this solves the current problem of the wealthy living off loans against unrealized capital investments. One of the issues that this plan is trying to address is that these gains are forever unrealized, but the person still has access to billions of dollars as a result…

Or have I misunderstood your point?