skysight-inc/HackerNews huggingface dataset:
The guardian isn’t a reputable source on this. We could adjust regulation in the US, pre-approve a handful of small to medium reactor designs and probably have a lot of them built in under 10 years.

The historical lag time comes from the period of rapid technological improvement and regulatory change where projects had to be redesigned multiple times mid project.

If you think grid scale solar and wind are just as susceptible to bad regulation, NIMBYs, graft, and bureaucratic nonsense then you may not be paying attention. Note the lack of offshore wind in the US.

Existing nuclear power tech could displace natural gas and coal without the need for storage or much land. We also wouldn’t need to overhaul the grid.
"Around The Corner - How Differential Steering Works (1937)"

https://www.youtube.com/watch?v=yYAw79386WI
Insurance does not remove liability from you personally. If you cause damage with your car, you are liable for it whether you are insured or not. The insurance is a private contract between you and the insurer where you basically agree to pay them a monthly amount and they agree to cover any losses you may be liable for (up to some pre-agreed limit). But the liability is not theirs, it is yours, and if the damages exceed your coverage limit, you are responsible for the difference.
Fair. There's been some licensing ... well shall we call them mishaps ... in the last couple of years. That I think has kept a lot of folks on older versions of Java.

But even if folks are okay on java8 (first released in 2014!) there is a version of java8 that is not vulnerable and it has been around for 3 years.
CEO Shoptalk – The Mantle of Power
I wouldn't agree that these are "pretty old." Maybe in frontend terms of software, but not backend.
How else would you implement Newton’s method? ;)
That's pretty funny, AoC is rule-based so I don't think there will be much "deep" learning going but I hope I'll be surprised!
Yes. Exactly (step 0). Anything will be used against you
I think each great circle has its own poles orthogonal to its inclination and earth's poles has naught to do with it.
Without station keeping, LEO orbits (thankfully) degrade so the outter shells will be gradually bleeding into the lower shells as well.
Small correction: Saturdays are also 200% (for the first 8hrs, the remaining ones are 150% - yeah, strange but I was bitten by it once).
OK, now I see. I got certified a couple years ago and seem like they introduced this pricing past year.

So "...you are not charged for static external IP addresses that are assigned to forwarding rules", yes, but a VM is not a forwarding rule :P

So you gotta pay for external IPs attached to a VM, but not to a Load Balancer. Seems like they're trying to incentivize using LBs to use less IP addresses, I guess...
Ooh, that's an interesting project, definitely lots there for me to learn about. Thanks!
Yes, but "almost nothing" in a domain of millions of educational videos is still a lot. One just needs help curating, like this thread.
It's a big deal because most large users of Java aren't actually using the newer versions. It's very hard to source that claim, and I apologize for the lack of hard data, but in my experience with "enterprise Java", it's almost all still Java 11, or even Java 8.

Some lame anecdotes:

Minecraft ships with a bundled version of Java 8. Most linux distributions still default to Java 11, and you have to explicitly ask for newer JDKs. Some distributions, like Void Linux, still only package Java 11. Many enterprise applications don't even use the system Java environments, and package their own outdated version of Java, sometimes in /opt, sometimes in their installation directory on Windows.

(edit: to this point, Minecraft apparently ships with 1.8.0_51 from 2015, and I'm sure I've seen similar with some Java applications at work. I imagine for programs that aren't servers listening on the network, the threat of exploitation seemed lower, and there was less of an (perceived) need to update even the version of Java. If it ain't broke, don't fix it, and all that.)

Regardless of the fact people should upgrade to newer Java versions, the reality is (IME) they ... haven't. And so many (very large!) corporations are relying on vulnerable versions of Java, which is why this is such a big deal.
The latest LTS version of OpenJDK is 11 (https://adoptopenjdk.net). I certainly don't touch the Oracle version with a barge pole and I assume that a large proportion of the industry also avoid it.
Basically this exact same thing happened to my business with an individual (some guy who’s main business appeared to be acquiring and selling domains) who setup a very similar trademark, registered the domain (very similar), setup a dummy business on the domain, and then sent us a cease and desist trying to extort (we did a call with them where they basically told us they knew it’d cost us a lot of money to litigate and it cost them almost nothing to keep their dummy business up) us for six figures.

We ended up litigating and canceling their registered trademark with the USPTO by proving our business and website were setup before theirs. If you have over 7+ years of business and public records this should be a pretty open and close case. The bad news is however even if that is the case it can take 2-3 years (probably due to pandemic)and a lot of money. In our case it cost less than $10k, so the guy’s extortion made no sense.

It also didn’t help their case that the guy lifted verbatim copy from my website, including my TOS with my address! I’m not sure if the judge even looked at this though.
The serialized object doesn’t contain any code. But the client needs the code of object’s class to deserialize it.

Instead of providing the object directly, the server can provide a JNDI object reference, which (among other things) contains a `classFactoryLocation` attribute specifying an URL where the bytecode of the class of the serialized object can be downloaded. If the class isn’t already present in the client’s codebase, the client proceeds to download it, in order to then be able to deserialize the actual object of interest.

This only works over LDAP, with the intended use-case that enterprises store and organize their code repository as part of their LDAP directory.
Please, share the name of the company. Let's name and shame them. I hate this kind of law-aggressiveness.
> ”A Republican--Democratic snow battle at the Capitol. Page Boys”, 1923

Maybe that’s how congressional leaders should resolve their differences.
A thoughtful piece, and most supporting points are real and I think I agree with them. However, I don't think the conclusion "Open Source is broken" follows from the arguments.

The most concise counter-example I can come up with is: What would change if that XKCD picture had the critical log4j2 component replaced with closed-source "McA$$hat logj2+ ENTERPRISE" trialware+commercial $$$$ licensed product that was thanklessly maintained by severely underpaid hire-and-fire contractors in a 3rd world country? Nothing. Well, it'd be a lot worse because you couldn't fix it.

What's broken is larger umbrella projects and products, open-source and commercial, not understanding that they own and are responsible all the dependencies. All of them. Down to the very bottom of the stack. Whether they bought them or got them for free. Each and every dependency must be evaluated, and if it's appropriate, you could delegate the risks to a trustworthy sub(contractor) or project.

What if that project gets abandoned? What if "McA$$hat Inc." goes out of business? Or either just changes direction or quality suddenly? Will the security bugs be reported or covered up or remain undiscovered because nobody uses the thing?

I currently trust Linux. I trust the "big" distros. I trust a lot of larger, well maintained opensource projects. I'm very hesitant about things like node.js and others that have very fine grained and super-easy automatic dependency management and build systems the just pull whatever the latest thing is for hundreds or thousands of dependencies. I really don't trust most commercial software because it's always just as broken, but you can never see it nor fix it.

A lot of the article focuses on getting paid. I totally agree and the market will definitely correct when it becomes visibly critical. You can get paid to maintain opensource commercially and that's probably the best of both worlds. There's going to be a lot of people working for a lot of companies getting paid to fix or replace log4j2. There's going to be a lot of people paid to figure out how to get better control over that XKCD picture situation.

But Open Source isn't broken, it's the cure just working it's way along by making that picture visible.
Why pay for something that's being offered for free?

I know that there are many good reasons to support valuable open source projects with money. But you can also _not_.
Doesn’t answer your question but something I’ve wondered about as well. I don’t maintain any open source software (yet?) but if I were to start a project I’d likely use a permissive license.

I don’t want to start a philosophical flame war about licenses, but this idea makes sense to me. The details will likely take work to iron out, but why not have open source licenses with a clause for companies with over a certain amount of annual net profit. Does anyone have examples of this in practice? As far as I know, licensing models like Mongo or Elasticsearch are a bit more binary.

I’d be fine letting individuals, small businesses, and startups use the software for free in perpetuity unless they hit some metric like “greater than $x in annual profit” or whatever. I guess a counterpoint to this might just be that companies that get to that scale would just develop the same thing in-house instead.
Natural gas isn't stored as LNG in the US; it's stored as compressed gas in underground caverns. Many millions of tonnes of natural gas are stored in these caverns; they buffer the transmission system against seasonal changes in gas demand.

We could store hydrogen in those caverns instead.
If there was a button on Github that donated small amounts of money to the maintainer(s) of a project, I would press it frequently for many libraries I depend on.

For example, donating 25 or 50 cents every time I visit gofiber/fiber would be fine with me.

However, there is no way to feasibly charge small quantities of money without the majority of it getting raked in processing fees. For example, Stripe charges 30 cents plus 2.9 percent (last I checked), meaning only ~20 cents would make it to the maintainer(s).

The same issue exists with rewarding content creators. You either donate a non-trivial amount of money (often recurring) like $10 a month (which means you have to keep track of that expense, which is arguably an even greater disincentive for donating), or you don't donate at all.
1) Create a funding report newsletter for FFMPEG

2) When funding is low, big scary exclamation marks all over the place

3) Include a bulleted list of doomsday scenarios showing what could happen to YOU if a bug/vulnerability is found

4) Add a picture of a sad kitten or crying baby for good measure

Now just subscribe all of the non-tech business people at organizations that use FFMPEG, and wait for them to panic. (Make sure that they need to call you to unsubscribe from the newsletter, especially if they work at the New York Times)
It depends on companies, some corps do it, some don't.

I worked in both types, usually contractors are treated as second class citizens, e.g. some perks don't apply to them.

I have yet to see a company where contractors are majority.
I argue that if your code gets assigned a 10/10 Severity CVE, then it broke, even if nothing changed. It just broke a while ago.

Switching one library is not much work. But if it becomes the standard approach then the first time you fire up your java project you either spent 30 minutes to put in all the exclusions to provide your favorite forks of dead projects or your pom.xml will already be 5KB large on generation just for those exclusions and patches.
FYI: AdoptOpenJDK is now https://adoptium.net/ and the latest LTS version is 17.
Whether or not you make this argument, or whether you feel it is unnecessary, is beside the point. People often ask "What about the waste?" as a sort of final argument. I have encountered this multiple times. It can be time consuming and frustrating to explain why it is not a serious issue, and hurts one's credibility to dismiss the issue too quickly.
It's a double edge sword. They can you use your stuff AS-IS WITHOUT WARRANTY, but if something goes wrong it is AS-IS WITHOUT WARRANTY.

We've gotten complacent that open source just exists and is maintained and it's sunshine and rainbows. We've been able to build amazing things on the backs of these maintainers, but you have to factor in that they don't owe you anything. So keep that in mind when you're just gonna install some random library from the public package repository because "not invented here" or something.
If you think of the world as a giant corporation, in the short term it's more efficient if these workaholics are not paid at all. Think of a typical workaholic who's always happy to do more and take on more responsibility - why would you increase their salary if they don't ask for it?
There is nothing intrinsic about the nuclear cycle that demands large quantities of water. Nuclear plants, like all thermal generators, require a cool sink where the turbines can dump the waste heat.

This is usually and most economically a large body of water, which is sucked in, heated by a few degrees and dumped back out, left to cool of back into the environment. Water is not "consumed" and remains available for any other use.

Powerplants that don't have access to significant water reservoirs can use cooling towers where a much smaller quantity of water is forced to evaporate, providing the same cooling but with a somewhat lower efficiency. Using this principle, nuclear plants have been constructed in the desert, see Palo Verde nuclear generating station.
And when another library is unmaintained and breaks, you add those few lines again. And again and again and again, until your gradle file is 90% hotpatching your dependencies.
My apologies, it was not my intent to distract from the discussion at hand. I thought my original comment would languish at the bottom of the thread with 1 or 2 votes.
A union is not some "outside organization". Union locals are led by people that come out of the workforce and are democratically elected. Bargaining committees are elected by the workers, contracts are subject to ratification to workers, strikes can only be called with a strike authorization votes.

Union nationals do have problems (e.g. UAW only just voted to move to a true one-person-one-vote system), but the nationals aren't really that important in the important areas.

A union binds you to working together with your colleagues, not to some outside entity.
Lolol yup, now you understand NFTs :)
Can you really trust those average 3 engineers you work with to build any sort of complex piece of software more reliably just to get started with the project you're actually building?
Bring back the Eisenhower era Atoms for Peace program !
Agree that we’re getting better at treating it. You seem to be praising those treatments and not wanting to get the vaccine. I don’t understand the idea that medicine that prevents the disease is bad but medicine after the disease is ok?
I do almost nothing but develop products. However as product becomes mature I start looking for new things to do. Also maintenance of mature product requires different type of people, not inventors.
This isn't only about companies, people who develop open source software on their own are just as affected by log4j. Funding and resourcing can at least help people and maybe incentive handing the project to someone else.
From the article’s subtitle:

> Bank, which does not provide corporate devices, …

Not everyone is in the position to bankroll their own second device.
Here's what arguments like this fail to understand: I don't care if you get paid.

I don't expect anyone to work for free. If you stop creating because you're not getting paid, too bad for me I guess. But I don't owe you attention because you did something either. There are two sides to this remember.

If what you do is worth charging people for it, charge people. If charging people would make you go broke, how valuable is what you're doing, really?

If your revenue model is "let some scum track my users and sell their data" you weren't taking your revenue seriously to begin with, you need a better business model than "they'll put up with it because they like me."

Sponsorships. Patronage. Merch. Exclusive content. These are viable revenue models, you get what your work is worth. If you can't pay the bills with these, nobody really wants your content anyway and they're probably just passing the time because it's free.
I'm reminded of solving Laplace's equation in Excel. It makes some cool animations too https://www.av8n.com/physics/laplace.htm
> organizations who use it

Do you know which organizations these are?
Correct, all those other people will have to manually find some fork or make their own, repeating the same work thousands of times and ossifying that some part of your java build system now permanently includes a section to patch log4j dependencies.
> i even found out that a call like glBufferSubData will call malloc or related functions. so doing that on each frame seems to be a bad idea as well.

That's interesting and not what I'd expect at all! Is there documentation you could point me to or did you find that out with some tooling? And is there a better way to update attribute buffers for instanced draw calls?
They didn’t know it was vulnerable, they just didn’t like it for other reasons.

Should maintainers of all core apache libs just remove or disable features they don’t like, when not known to be insecure?

That said, log4j2 isn’t that old. Not sure why this was added in the first place. At the very least it’s a performance issue.
I'd also imagine someone who lost their shirt in the stock market (or crypto) might get whiny and complain "Math is broken."

Open source is just a process. It never promised you anything.

Either way, this is why, even if annoying, the concept of "Free Software" is a better one. Its goal may not be perfect -- but at least it has one.
Java's dynamic classloaders were one of it's original tantalising features. That you could have code from one place running somewhere else - "agents" could literally send their bytes to a device to execute there, run there and then erase themselves when they were done. It sounds crazy these days but it was all meant to be held together by the security model - built in at the core it was safe to let foreign byte code execute locally because the completely managed VM could enforce a security sandbox that allowed the code to do only exactly what it was meant to.

In some ways that is where this and all those features fell down ... if log4j had constrained those classes within a security sandbox it wouldn't matter what they did. But nobody understands or uses Java security permissions. The whole system is byzantine and drives people crazy whenever they do run into it. But if it had worked you could be asking the question, "why did log4j allow the permission for the remote code to do bad things" rather than "why was remote code allowed to execute".
> What does backwards compatibility mean to me?

> I want to not spend much time upgrading a dependency

> Go compatibility promise:

>So whenever a change in behavior happens in an upstream library

You are comparing a promise from language designers to no promise from the library developers. Syntax from Oak (before Java was called Java) still compiles and works in Java 17 right now:

jshell
pub| Welcome to JShell -- Version 17
| For an introduction type: /help intro
jshell> public abstract interface I {}
| created interface I

You can still type (public abstract interface - all interfaces are abstract by default since Java 1) and it works. One of the reasons I gave up on writing desktop applications in Go was libraries were breaking compatibility with every commit. GTK+ binding was literary unusable as before gomod this would break literally, and I mean literally, every day.

Please tell me that none Go library had any breaking changes in the last 5 years and I'm using it as my default ecosystem from tomorrow.
> I'm similarly unconvinced that wind and solar will provide everything we need by 2040.

Have you actually looked at the numbers for renewable energy installations, or is this just based on personal incredulity?

While the nuclear industry has been shouting about how we need nuclear, the US has installed about 20GW worth of renewable generation in one year. That is equivalent to about ten nuclear power plants (in the US, most plants are 1-2GW; a few are 3-3.5.)

40% of our installed capacity over the last 2 years has been renewable energy sources, and both wind and solar installed capacity is growing at a nearly logarithmic scale. The only thing cheaper than wind is solar, and both are continuing to get cheaper.

Those figures, by the way, are for utility/grid scale projects and do not include residential systems.

Utilities already consider this a solved problem and have now shifted focus to storage technology.

There is a strong online PR effort by the nuclear industry because they are desperate to stay in business I'm not exaggerating when I say that the blog of a guy who runs such a PR consulting firm has been featured more than once here on HN.

The nuclear waste problem is solvable but has not yet been solved in the US. Nuclear power plants are decade-scale projects and even once they sync up to the grid, it takes them another decade just to offset the carbon impact of their construction.

Nuclear power plants have very high OPEX and very deep/complex/exacting supply chains when we're seeing lots of supply chain issues due to climate change.

Reactor vessels require very high grade metal and specialized firms, and those firms have years if not decades long waiting lists. We can't just snap our fingers and create more reactor vessel manufacturers.

No wind farm or solar farm has caused a catastrophe of any sort, much less one that renders thousands of square miles of land uninhabitable for a century.

Wind and solar do not generate material that is extremely lethal and weaponizable.

The list goes on and on.
Tennessee cold case reopened after YouTube SCUBA sleuth finds missing car
Since the OP is running a legitimate business on it I wouldn’t recommend them sitting on the trademark being owned by a competitor, even though I agree with you it sounds like the other party has no legal basis to do anything to them, even if they own the trademark. I am not a lawyer but this exact same thing happened to me and I did consult a lawyer.
Unless those accounts extensively discussed how immune compromised individuals and not evolution across whole populations provided the virus a platform to mutate extensively as that’s the current leading hypothesis of omicron’s origin, then I would recommend understanding those accounts are garbage and should be a big red flag about their motivations
Amazon warehouses are Tilt-Up Construction. Basically 4-to-6-inch thick cast concrete panels on a grid on metal tubes as joists. Support pillars with basic trusses, and a roof tying it together.

You lose a ton of stability once that roof is gone. You lose a truss or a few pillars, and I'd imagine it came down like a house of concrete cards very, very quickly after the first wall section fell.

It has no chance against a tornado direct hit. You need a dedicated shelter structure for that.
I am not a lawyer, this isn't legal advice. Definitely don't respond yourself, get a qualified lawyer in with track record in startups/domains to write back (and advise). The letterhead goes a long way here in showing you're not trivial to push around. If facts as presented here are truthful, there is a reasonable chance of never hearing from them again.