skysight-inc/HackerNews huggingface dataset:
At least with gradle you can easily add some logic to the buildscript to substitute all instances of a specific dependency for a java library/application with a fork.

It's only a handful of lines of code and it is technically a bit hacky but it's really no worse than any of the other jank you are forced to do when building any moderate to complex gradle based java project.
A serialized instance of the class is downloaded and deserialized. That the class itself is also downloaded (based on server-provided auxiliary download locations) is a secondary feature. The downloaded instance is then deserialized, which may run a custom deserialization method of the class, which in turn would contain the malicious code.
I've noticed that most companies follow this cycle: they grow reputation first, then they harvest the crops by monetizing that reputation. Someone unfamiliar with farming will be surprised why farmers spend a year to grow crops only to destroy them at the end.
This could have been solved by just making the unsafe behavior opt-in via a command-line flag. Right now it is opt-out.
But again, that means EVERY single product, open source or not, will have to patch their deployment to use the fork instead of simply using the updated version of upstream. Permanently no less if it's unmaintained.

Meaning every single Java product would have to include that "if you want to use log4j, you have to include this patch line to use a fork, because of unmaintained dependencies".

That just ossifies log4j and fixes nothing. Patching dependencies in Cargo is not meant to permanently replace code, it's to be used while you're waiting for an upstream merge.
Money spent on dedicated testing might have discovered it earlier perhaps?
There is a Netflix documentary on this called Made You Look: A True Story About Fake Art. I've seen it, and found it fascinating.
This is nonsense. Why should the time required to build even be a relevant factor in anything other than how soon to begin?

Unless you’re complaining that nuclear isn’t profitable enough, you don’t have a point. And if you’re just complaining about not being able to profit from it, you still don’t have a point. Is your priority to reduce the rate of climate change or to preserve the rate of profit???
Blockchainism
Carolina Gold was once the most popular rice grown in America (2019)
Thanks a lot! I’m definitely not looking for technical stuff only. It’s just that, YouTube’s recommendation algorithm skews me in that direction.

I like watching videos about interesting bits of history, debating/solutions for various civil/political problems, seeing someone being extremely good at their craft (whether that’s woodworking, electronics, painting, building houses using old techniques, etc.).

I also like investigative videos without blockbuster content and a ton of dramatic music, but those are really hard to find.
> In the US, you have lifetime odds of death in a crash of 1 in 106.

It's actually 1 in 107, but nonetheless, that's terrifying.

https://injuryfacts.nsc.org/all-injuries/preventable-death-o...
The original is understandable. The person might not be a native speaker and calling their grammar "questionable" is too harsh, especially on an online forum. Also I don't think some of your "fixes" are necessary or meaningful.
Do the moral thing and quit. Don’t let someone coerce your into a decision you don’t feel is right for yourself.
You would likely think differently if you cared about the product and had invested time in developing it.

Having said that, there is no evidence their developers felt differently to you.
As others mentioned, for any companies relying on this software, that's their problem, and it's nothing more funding and resourcing can't solve.
Nothing is stopping me from writing a google-ASR powered program hooked into my terminal, and start yelling my code into the computer either.

But as long as this isn't faster, easier or more reliable than typing it on a keyboard, I won't.

People don't work a certain way because it's possible. People work a certain way because it saves time, money, sanity, or simply because it's convenient.

If wearing a VR headset while coding isn't providing substantial benefits over what my current system provides, why would I do it?
A tool that inspects a company's software dependencies and generates a report of open source dependencies, state of support, and easy ways to fund (direct corporate funding, or even employee + corporate match) would be super useful.
Never thought I would hear someone quote Sole in an article linked on HN.

Here is the original song (Respect, Pt. 3):

https://m.youtube.com/watch?v=bBVfk4gyZ04
I wish there was a more concerted effort on following up on both covid patients and vaccine administrations and presenting the data on the outcomes in the general media. Instead, the only widely decimated message is "get your vaccine".
> This is why I am very careful about how I make "useful" software and release it to the world without any solid way for me to get paid for my efforts. I simply do not want to be in a situation where my software that I develop as a passion project on the side is holding people's companies together.

Isn't this the best position to be in if you want to get paid? "You've built your company on top of my project and now you need this bug fix/feature yesterday? My hourly rate is $$$"
There is mostly no such things as "optional" in those sorts of situations. It's like "Here's a take home project. It's purely optional but it would give us a better sense of what you can do."

In other words, maybe if you utterly wow us in-person you'll get in anyway. But probably not.
Big companies don't just pay random invoices;* you need to indicate what project and account (usually IDs from their CRM). So it would merely be chucked out.

* In really big companies it's possible for admins to buy routine stuff below a threshold just to save on paperwork. So there's a scam in which someone sends out a bunch of $100 invoices for "printer paper" -- account payable assumes the department code was left off by the vendor but it seems legit so they pay it. Seems like a hard way to collect money.
There are some maintainers for Postgresql that get paid. It’s a part of their job in consulting companies (they specialize in postgresql). Not sure about the other projects though.
If you hosted the package/library yourself instead of in closed silos/package repos, you could directly check the IPs of whoever regularly pulls your stuff.

We all opted for centralized package repos though, so now only they know. And they’re not telling us.

Just another “free” opportunity lost to centralization, I guess.
The wind farms angering renewable energy fans
WebTorrent has never worked for me. It's included in Brave now but whenever I try to open a magnet link it just sits and waits while qbittorrent downlads everything i before I can manage to make a cup of coffee.
This is why I like the points and objective of Strong Towns. It's mostly about fiscal responsibility and improved quality of life for all.

I think those are some objectives we can all rally behind.
World's Most Advanced Video Editing Tutorial (Premiere Pro) - Editing LTT from start to finish

https://www.youtube.com/watch?v=O6ERELse_QY
Detroit's Underground Resistance also had a release called Hidden In Plainsight that has two "parallel" grooves, so two independent tracks on the same side.

IIRC it was an NSC thing.
> OSS with a paid model for premium support / feature development.

Adding features do not reduce likelihood of bugs, if anything the opposite.

It's very difficult to come up with a paid model that specifically encourages a preventative strategy towards bugs and security flaws. Currently the best we have is getting people who care about those things to build software.
the documentation also needs to include the 5 line dependency exclusion that you place in your pom to exclude the bad version
https://m.youtube.com/c/everyframeapainting

Every Frame A Painting. A great channel (that I wish was getting new videos) going deep on about aspects of moviemaking, editing, musical scores etc. High production quality videos and interesting even if you’re not a film buff or movie nerd.
The problem is that many projects (open or closed source) don't respect the exponential cost in bringing in a new dependency, i.e. code that's not under your own management.

Bringing in a shitty old bloated logging library with functionality you don't need or want compounds the interest even more.
Exactly - GA is nice for proofs, bad for code. I wrote an article in Games Programming Gems V back around 2004, showing many proofs of things one wants to do in computer graphics all derived simply using GA.
You're right, the name was borrowed from Lucid, where it is a proper operator on streams.
You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid. Of course there is a lot more detail in such negotiations, but the fact is that he/she will be facing similar "assholes" from the side of the copros. The entire thing is essentially just a game of standard capitalism. You have to know how to play that game, though.

FFmpeg should be able to pull multiple $M per year easily from all the major corporations that use it. For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs. And most, if not all of them, use FFmpeg quite seriously.
Tomorrow at 2pm, of course!
The Matrix Awakens: a vision for the future of real-time graphics
To add some perspective, log4j has gone for 20 years with only two major versions. Assuming that they are following semantic versioning, that means they added new features/fixes in a backwards-compatible way and only broke compatibility _once_ in over two decades. That's both a testament to the stability of the library over time and a reminder that all the cruft accumulated over the years at most gets gated off through saner defaults.
Not exactly designed for YT, but Sapolsky’s Human Behavioral Biology is great.
You can also write useful software without getting paid. Simply don't share it. Indeed, that's one way to spend your time when you're not seeking employment.
The strange thing to my mind is not that people will use things for free given a chance, because of course they will, but rather the developers of popular open source packages are having trouble getting jobs. Back when I was a CTO, if any of my applicants could claim to be developers / maintainers of popular open source projects, I would consider that to be a major plus. Wouldn't everyone?
I don't think there was ever such time. Only a tiny minority of developers ever has open source projects and some companies even actively discouraged that.

Moreover, with industry moving towards agile, having project and developing in a company are massively different kind of work.
How about writing code and then looking at it through blocks?

That might be superior, if done right.
> What companies do with the source is their thing. They get all of the benefits and all of the responsibilities.

I know this very well and for some irrational reason it still makes me anxious to think about the many people relying on one of my free-time project that is used in classroom and medical settings. When there is a nasty bug found it's hard to shake the feeling of responsibility.

I have disabled the counting of downloads for this reason, I would rather not know just how many people rely on it and instead focus on improving it without pressure.
"I didn't say that. In fact, no one seems to have, according to Google."

- pg
> So, large SV companies and startup should also start agreeing to pay for open source, when it's the core of the tech.

Companies usually have a reason to keep their expenses low. Sometimes they are a public company with fiscal responsibilities. A startup will only have so much runway and is likely trying to reduce expenses.

Given this situation, why will they pay for what they can get for free?
I also find it amazing that my 1970's vinyl setup sounds better than my modern setup (multiple homepods). I definitely have a reverence of that tech which helps improve my experience.

I also suffer from the paradox of choice... the more options I have, the more skeptical I am of the choice I make and how it negatively affects my experience. When I pull out a record and play it through, I usually love the experience. I can't say that about playing something on Apple Music or Spotify. Same reason why I can't find a game (one of over a thousand) to play on Steam, but loved every minute of the terrible NES games I owned as a kid.
As far as I know Fox TV stations have no connection to the Fox with the cable news channel aside from being part of the same company in the past.

edit: https://www.mediamatters.org/fox-news/fox-affiliates-we-are-...
that sounds like Quartus Block Design, I used it to program a simple 'dynamic ROM' onto a CPLD once: https://youtu.be/rw7xYkM1-HY?t=219
This was my go-to video to put me to sleep, but it has sound effects and I found other videos. The two others are Clayton Christensen's talk at Google, and John Danaher's appearance on the Lex Fridman podcast. These two are just amazing as the dynamic range of everyone's voice is so narrow. They don't have ups and downs. Their voice is rather monotonic and soothing. I'm asleep in less than 5 minutes. I know because I remember the topic I slept to, and diff it with the topic I haven't listened to.

I also listen to old tool restauration videos/CNC/industrial sounds as they put me to sleep as fast if I haven't booked a hotel room on the first floor of a hotel that gives to a busy city street at peak time, or at a specific place that overlooks a mechanic shop with pneumatic tools during work hours. I can't control traffic or people's work hours, so these videos are the closest I got to reproducible, predictable, on-demand sleep.
The LD50 of lithium carbonate in mice is 500 mg/kg. That's not very poisonous. In comparison, the LD50 of arsenic oxide is 8 mg/kg.
On the corruption front ... hell yes! Ok there is rarely the envelope of tenners dropped on the desk, but tell me, if the SVP with millions to spend on a supplier happens to serve on the board of the Gotham Orphanage alongside the CEO of a major supplier, is that corruption ? What about the understanding they have of "working together in the future"? And the nice directorship waiting on the suppliers board ?

We live in a world where Air Force Generals join boards of air plane manufacturers, so a quiet understanding between suppliers and buyers will easily pass muster. Is it corruption ?
Black Tuesday: Death Hits a Village in Imo State
>Dollar General was the town’s only national chain, and the only place — besides a gas station convenience store — that sold frozen food, snacks and canned goods. “It’s left a hole in our town,” said Ashley Steinbeck, Auxvasse’s mayor. “It was such a convenience for everyone, especially for elderly folks who can’t get around really well.”

Why not start your own shop then? Previous Dollar General presence already confirmed market need and profitability. Is this learned helplessness?
On Debian, which I'm using, you can say that.
What do you think of hiring maintainers to audit? Answer specific questions about usage and security, with some visibility into your codebase? We’ve talked this over and hit risks concerning access to code where we’d like an NDA that a consultant may dislike.
What really frustrates me in this whole debate is the question asked so to dismiss nuclear by asking about what to do with nuclear waste. As if it’s insurmountable or somehow worse than fossil fuel pollution.

For decades we’ve been kicking the can down the road by ignoring the toll of fossil fuel waste. That bill is coming due both for our climate and our bodies.

Enough is enough. We will leave nuclear waste for another day as we try to pull ourselves out from underneath a century of fossil fuel addiction.
This “hold an object while falling asleep” technique sounds very similar to a technique I read about maybe 15 years ago at an avant-garde sleep away arts camp. It was in the context of lucid dreaming and not increasing creativity, though.

That technique didn’t involve holding an object, but going to sleep with your elbow against the floor/bed and your forearm raised. When you started to fall asleep your arm would fall and wake you up as it hit the floor/bed.

It also suggesting sleeping with your head facing north, but that part seems less scientific to me. Nevertheless, very interesting how this came back around.
One of the dirtiest, most corrupt, and violent branches of US federal law enforcement.
Actually, the command is "download this serialized Java object", and the server serving the object can add "by the way, you will need these classes for deserializing the object", and the client "ok, I’ll download those as well then", and upon deserializing the object, code from the downloaded classes is run (the actual RCE) in order to initialize the class and deserialize the instance.
What software to use for this kind of video?
"Sending them bugfixes for free" is both a benefit and a burden to an open source project. It takes maintainer time and effort to review the fix, test, make releases, etc, and that's a thankless job. When a company pushes their patches upstream, they're gaining a benefit for themselves (avoiding maintaining a fork), and potentially benefiting any other users who might be affected by the bug or want the same feature. But they're also adding to a maintainer's workload, and that's often the scarcest resource in open source.
> I don't understand why people think it's a good idea to remove the primary source of revenue for content creators.

> I'd appreciate it if someone could respond to the points I made rather than simply complain about why they don't like ads.

I'd say explaining to you why they don't like ads should help you understand why they think it's a good idea to remove the primary source of revenue for content creators, if that primary source is ads.

Here's the worlds smallest fiddle.

If your primary source of revenue is automated advertising, I don't care if you lose money. Sorry not sorry. Get some sponsorships, exclusive content, whatever. But if you want to sell my information to companies to build a profile on me and then invade my life with all manner of annoying distractions using that data, you want me to feel bad when I put a stop to it because you didn't get your penny from me? Cry about it if you want.

Seriously, fuck ads. We have offered a truce to the ad companies before. Put a banner at the top. Slap a commercial in a video. But that's not good enough for them, they autoplay videos and popups and tracking pixels and 10 ads in a video. And then when we tell them where they can go stick it they act like we are stealing. So fuck them, they can go hungry, and if you intend to monetize me by funneling my attention to them, you can go hungry too.

Yes, people are that adamant about blocking ads. I block all ads. I don't need my mind polluted with noise and my life to be about stepping over dogshit every step I take and I don't need spyware running in my browser.
There are popular languages that have `eval()`, so I don't see why blame Java only?
Warehouses (any big-box building really) are among the worst places to be in a tornado. Maybe such buildings in tornado-prone areas should have storm cellars or reinforced "safe rooms" for shelter.
Oh, wow. I've used this before. I think the python community needs to work out how to make it easier for us to identify and donate to maintainers. When I pip install, I never get a donate here: some url. When I npm install, I do (arguably too much). Anyhow, sh is handy. Thanks!
That was very much intentional, given I mention the very same album earlier in the post :)
> Looks like Google is coming out with Wear OS 3 soon

Wear OS 3 is already out.

https://www.androidauthority.com/wear-os-3-watches-2736393/
I don't know if that is objectively true. There are numerous small companies who will leetcode every candidate. Then there are Google and Microsoft and the other bigs who hire thousands of people every week, where the best way to get hired is to have a Ph.D and get referred by insiders.

Mediocre candidates getting leetcoded by mediocre companies may be a highly visible pattern but on industry scale I am not convinced it is the dominant mode.
It's a little bit longer, but bash/zsh support `printf '%q ' <args...>`, which produces output where any characters that may be interpreted by the shell will be escaped.
The industry is nor moving towards multiple rounds of code review. Nor towards in house development nor away from using open source.
> Given this situation, why will they pay for what they can get for free?

See the article...
> You say that as if you even know your full dependency chain. Reality doesn't quite work that way. No one knew their codebase even relied on leftpad until it broke millions of applications the world over when it got pulled.

We're professionals - we in fact simply can do that with some elbow grease. Doesn't take a genius to understand how software is built.
I get that this is a big deal (any remote code execution that is prevalent is a big deal).

But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java.

From https://www.veracode.com/blog/security-news/urgent-analysis-...

JVM version - if lower than:
Java 6 – 6u212 (java6 first released in 2006, this version appears unreleased?)
Java 7 – 7u202 (java7 first released in 2011 this version appears unreleased?)
Java 8 – 8u192 (from 2018)
Java 11 - 11.0.2 (from 2019)

The current version of java is java17. Anything running on 17 or 14 (the last major release) isn't vulnerable.

Now, I get that major version upgrades are a hassle, but I haven't seen anyone address the "hey, you should have upgraded" elephant in the room.

(All java release dates from https://www.java.com/releases/ )
From the final sentence: "I was using the name 7+ years before them with a similar product"

So it seems like they aren't squatting, but genuinely using it (for a similar product, which makes sense)
This is marvellous! I loved when YouTube recommended me some stuff about camera angles from Vox, or how interesting old 3D cameras worked.

I didn’t really know how to search for this kind of content, this channel is gold!
Same here, what I want to do is detect my dog barking excessively at people/cats/birds on the street and trigger my curtains to close for a few minutes... I've already got a wired camera in there so processing the audio seems easiest technically, but I can't help but think it's a really crazy waste of CPU time (even though it will be good for my neighbours).

I'd wondered if computing peak volumes per second would be a good enough proxy, then trigger action if the threshold is exceeded more than n times in 15 seconds... certainly seems like it should be way less compute intensive!
Yeah, I had an LSI-11/23 when I was a student, with dual 8 inch drives and a Fujitsu drive (not an Eagle, it was 160Mb if I remember). This was all cobbled together equipment, but lots of fun trying to get it to work.

My bootstrap code loaded the first block from a floppy which had the boot code on it. The result was much easier to type, and I ended up with that boot code as a script so my much more powerful Amiga I was using as a terminal emulator could replay the boot code to start the machine.

Happy days!
The LKAS is my Honda (Honda Sensing) has the same issue in construction zones and also anywhere there are overlapping or "ambiguous" lane markings.
So the attacking server sends back a serialized object during the jndi request and then deserialized method is called on that object?
It's an euro invested today in climate protection that supplies zero energy for the next 10 years, while the same euro invested in solar/wind + batteries will also generate energy in the short run, helping retire carbon emitters now.

It makes sense if present value of reduced carbon is high, the value of your future nuclear plant gets discounted by a large "carbon interest".