skysight-inc/HackerNews huggingface dataset:
Sure, people have to use graphics APIs they hate (D12, Vulkan, Metal) because there's no realistic way to avoid them. If you're forced, you're forced.

Log4j type libraries don't really fall into that camp (unless it's an awful transitively forced dependency, which unfortunately can happen, but it's at least usually slightly easier to fight against/mitigate). And I was mainly challenging an implied equivalence between "large, growing, pinned dependencies plus dead code elimination", and "small, static, pinned/floating dependencies". There are plausible trade-offs that could cause you to choose any combination of those factors, but I think it's wrong if one were to make an equivalence like that.
The ban was lifted in 81 but the closure of the facilities required investment in order for them to restart. So the ban continued in a de facto sense.

I’m willing to concede that this isn’t my strongest point. What I’m aiming at though, is that it strongly mitigates the waste issue.
It was meant in reference to this comment:

https://news.ycombinator.com/item?id=29521461
Equating (per unit weight) fission reactor waste and waste from PV or wind is a bold position.
I'm wondering why there is no regulation on this kind of up marking by the hospital?
> no such thing as a non-lethal weapon

The jargon du jour is "less lethal" for this reason.

And since every weapon from a stick to a stun gun is possibly lethal, your adversary can claim "self defense" when he shoots you dead with an actual firearm.

I would be afraid to carry only "less lethal" weapons because they can get you killed faster than being completely unarmed.
> I'd suggest that Blizzard employees consider the consequences of working in computer games

0% of Blizzard SWE are forced to work there and do so voluntarily - they obviously like it there
I worked at engineers-call-the-shots fintech and later SV shops for many years. No, their in-house code is not worse than open-source.

In fact one can safely say that top companies that attract top talent also have methodologies in place that lead to better than average code quality.
It’s a mass communication, not precise scientific communication.

It will keep evolving as the situation evolves.

I think, the danger lies in the fact that everything said by scientists on the media is oversimplification and technically wrong as a result of the simplification attempt. This can erode credibility significantly.
> Far too expensive compared to other non-fossil alternatives.

But what are the costs of unstable supply and behavior of whole grid?
> Should maintainers of all core apache libs just remove or disable features they don’t like, when not known to be insecure?

I'd bet more will start doing so. If nobody is excited to keep the feature up and any unloved code contains risks, getting rid of it seems fine to me. If companies want that code maintained, they can pay up or get one of their people to do it.
Exactly, the JNDI feature has been on the docs for everyone to see for several years: https://logging.apache.org/log4j/2.x/manual/lookups.html

Anyone who knows anything about JNDI would've immediately recognized that this was an incredibly bad idea, as JNDI attacks are well known around black-hat circles (LDAP is just one of the things you can do once you have JNDI available).

Yet, here we are, several years later, acting surprised this thing existed and thinking that tests would've helped!? What kind of tests, exactly?!!? I think I am to blame myself, as many other Java developers who actually use log4j, has a good understanding of how it works, knows JNDI and LDAP, yet never connected the dots and noticed what this incredibly stupid feature was making possible.
Thanks! My first child was born last year, and I started a new job 3 months earlier, so time was definitely not an abundant resource! But between the stress of all that and the pandemic, I found squeezing in an hour or two for this project here and there was one of the few things keeping me sane, and that's what got me through it.
You run into problems when there are contributors other than yourself.
If you haven't discovered Discogs and want to buy vinyl records: head there now. Even if they don't have something you want, you can set up a Wantlist so that when it does go on sale, you'll be notified.

As a (former) seller, I found that their database has virtually every release and every pressing of every record ever recorded. More or less. If you bought the thing in a retail channel of any sort, they've got it.

The buyers and sellers, with very few exceptions, are really nice. Altogether a great experience.
Consultants sometimes dislike NDA, because as a consultant, you are already expected not to disclose. It is strongly implied, like patient-confidentiality. Airing dirty laundry or competitive advantage as someone visiting many companies a year, is like a doctor amputating the wrong leg. You do this once, then you are out of a job and reputation.

Risk is on your end, so you pay for it. A 10k contract becomes a 12k contract. You clarify your risks, your mitigation method (NDA), and that the extra money is for the legal liability the consultant takes on.
I just got started into wildlife photography and this video has been a great starting point for me - https://www.youtube.com/watch?v=R9YBeNBoKVw

It is long, but goes into a lot of details on what makes a photograph look good.
As someone that has to support a lot of in-house code, yea, it's a bunch of crap too.

"Works good enough" is how our world generally operates unless under strict regulatory guidelines.
Sure, and it's supported by more software than the newer versions (edit: because this wasn't clear, I mean I think the default JDK will remain 11 for a while, even on distros that package newer), which have been making a fair number of backwards incompatible changes, which seems to have had the effect of discouraging adoption of newer Java versions. I'm not a Java developer, so I don't really have personal experience or frustration with it, but it seems like I read "x was deprecated, then dropped, in versions <x>, <y> of Java" a lot, changes that would require pretty sweeping changes to codebases that relied on the old behavior/features.

A lot are still stuck on 8, and aren't even compatible with 11, much less 15 or 17. I think VMWare's vCenter software still uses Java 8 internally...
I had never heard of covfefe before, that's a funny read on Wikipedia (https://en.wikipedia.org/wiki/Covfefe). Thanks for that one.
The market value of an open source library is the price you’d have to pay to replace it.

How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much.

Why don’t they? Because the cost of just using log4j2 is 0… until it isn’t.

The externalities of the damage caused were never priced into that zero dollar price. I think about this every single time I depend on a third party library. Free now, but potentially pay very dearly later.
Google employee #107, a Jolly Good Fellow (2016)
> Now just subscribe all of the non-tech business people at organizations that use FFMPEG ...

Don't do that bit unless you're sure it's not illegal in your (and their) jurisdiction.

Spam being a thing, and there being laws against it.
Every engineering-driven fintech company I know of (having myself worked there or having friends who work there) is doubling down on every single one of the processes I mentioned.
Even if you dual license your software with AGPL/Commercial license, there's still companies that just plain ignore them. I was doing some scripting on my PDF bank statements and discovered they were generated using iText (AGPL version). Imagine a multinational bank blatantly violating copyright laws let alone expecting them to pay for open source.
Are you a developer? Do you not know that bug-free software doesn't exist?
I liked that analogy to paying a law firm.

Most of these companies spend more on greenhouse services to keep plants in their offices than they spend supporting the F/LOSS stuff that they built their product around. That's how it should be viewed.

The Faangs probably have on the order of 100m boxes running Linux etc. It would be totally reasonable to expect they would pay someone $1/year/box to help maintain all the F/LOSS in there.
FOSS Is Free as in Toilet
I was part of a test. The whole flash, red, blue thing was way over my head.
From the article it looks like they are trying to act as an uplink/downlink service for other satellites rather than anything terrestrial.

>Kepler CEO and co-founder Mina Mitry said the six-year-old privately-held Toronto company only plans to launch 200 of its own small satellites to establish its internet-of-the-sky service called AEther. The rest of the six-figure sum of flying objects would actually be launched by its customers – such as Earth observation services, space tourism operators, space agencies and defence departments – which would affix a cellphone-sized 220-gram terminal provided by Kepler to their own satellites. The Kepler box would function like a SIM card and enable customer satellites to connect to the larger constellation “and any other space-borne assets” in LEO, via the always-on, always-available AEther network.
Maybe businesses should pay a tax that goes into paying a respectable universal basic income.

That would make it easier to develop and maintain such software, and it would make it easier for people doing other things besides software development (yes, they exist) to open up their artware without starving.

Then there wouldn't be a need for the insane "professional" formalism described in this blog post.
We'll be saying this in a few years about all other forms of algabreic effects too.
This assumes that large companies are willing to pay in the first place. In my experience most companies if they can get something half-developed for free. They will jump on it and think nothing further of the ramifications in the future however near or far that is. Any business that operates on that level deserves what is to come.
It is a 128bit wide vector design. Which means the wdith of actual vector register is 128bit. The 1024bit figure is due to register grouping of up to 8 vector registers which is mandated in the spec.
What I see as broken is the expectation that dev tools and the entire dev stack should be provided for free. It manifests as only using "open source" tools and everything in this blog post applies.

As a developer I both expect tools and libraries to be free and have been burned by this as someone working on developer tools and as an open source maintainer on my personal projects.

The frustrating part to me is that this doesn't apply to apps, saas apps, services, or a lot of AI/ML related things. Most developers expect to make money off those things while at the same time demanding everything they used to build it be free because it's just code and they love open source. It feels unfair, and in that way I agree, open source is broken, or at least unsustainable for small projects long term.
This channel goes deeply (well, as deeply as is possible) into ballpoint pens, fountain pens, and other writing instruments:

* refills: https://www.youtube.com/watch?v=Pr1UfM8PP0U

* Parker Jotter: https://www.youtube.com/watch?v=6h8uIjfWqm4

* multi-pens: https://www.youtube.com/watch?v=AAJ9BwHKJU4
Hopefully nobody hits these state medicaid sites or at least they just take them down until they're fixed.

Louisiana for example looks vulnerable in at least 6 places.

https://sspweb.lameds.ldh.la.gov/selfservice/selfserviceCont...
Are you sure it wasn’t the Carolina brand that sells a “Carolina Gold” that is NOT the real thing?

I’ve had the real Carolina Gold (my parents get it— I’ll have to ask them where/how), and it’s definitely the best rice I’ve ever had (and I eat a lot of rice / all kinds).
It's called a Purchase to Pay system - whoever makes an order supplies a Purchase Order number from their internal system, which the supplier will reference on their invoice so the accounts team can look it up before paying it.

In terms HN would understand, it's a stateful firewall for invoices that prevents paying orders that didn't originate from your company.
Yep but that's just the breaks. Especially with ecosystems that have tall dependency trees.

Luckily those few lines can mostly be shared and you end up with a handful of lines and a map from old dep to new dep which makes it not too painful.

This whole issue is why I don't like these ecosystems but at the very least in the Java space dealing with this issue isn't too painful. I can't speak for the JS space but this is also a pretty trivial fix in the Rust space and it isn't too painful with C++ or C projects. Nix (mostly used for Haskell but it's a pretty solid universal package manager) has some pretty good tooling for modifying upstream dependencies. Spack (package manager specialised for HPC and embedded projects) has really good support for this as well.

My point being that people have run into these issues in the past a lot in certain spaces and as a result those spaces have come up with solutions for this problem a long time ago. It just so happens that for the most part the average dev doesn't see a lot of that because these issues get dealt with upstream or just aren't common in most industries. The embedded industry is particularly used to this considering how much of the kit from manufacturers is just outright wrong or broken 3 levels deep. The only reason I'm as well versed with this as I am is because I've been in the embedded space patching over broken HALs and I've bled my blood dealing with legacy enterprise applications that were initially written in Java 1.1 and haphazardly dragged along over the decades.

TLDR: This is an ugly fix but ultimately it's the best ugly fix to an ugly problem and every software ecosystem eventually gets to deal with it once they get old and crusty enough.
His link includes a discussion of Anson Mills which is the best source of the real thing.

(Yes, Carolina-brand "Carolina Gold" is not the same thing and not great).
No, the fob is local only, no cloud. The money is just to keep the feature enabled.
Apache funding goes to stuff like infrastructure and administrative stuff. Developers writing code for Apache projects are volunteers and are not paid by Apache. If they’re lucky, their employer might pay them to contribute to the Apache project.
Fairbanks only has 30k people, most of Alaska lives in anchorage or the panhandle.
My point is that we do not and have not had a free market in health care. So to say that free market healthcare can't work then using the current system as an example is a flawed argument to the point that it is nonsensical.

The incentives for the current system are to continually increase cost. The only way to fix that is with a free market or price controls. Price controls cause a whole different set of problems. The best solution is a free market for the routine and elective parts of healthcare with insurance to cover the rare unexpected events. Everybody gets to manage their risk how they please and healthcare cost comes down due to market forces.
2-3 years is pretty old.

Java backward compatibility is really good, even better when it's on the same major I don't see why you shouldn't update. You have a docker image with java, just pull the base image before you build, you run it bare you/need to update the server packages periodically, better if you have unattended update setup (default in recent ubuntu versions tho might need a server restart for some to apply)
It's not like between java updates there aren't any security fixes, there are so you should update.

Nevertheless other mitigations like not exposing internal services to the internet would have blocked these attempts.
""" Excessive concern about low levels of radiation led to a regulatory standard known as ALARA: As Low As Reasonably Achievable. What defines “reasonable”? It is an ever-tightening standard. As long as the costs of nuclear plant construction and operation are in the ballpark of other modes of power, then they are reasonable.

This might seem like a sensible approach, until you realize that it eliminates, by definition, any chance for nuclear power to be cheaper than its competition. """
from: https://rootsofprogress.org/devanney-on-the-nuclear-flop
The "everyone gets a stack" implementation feels awkward and limiting.

One of the first non-trivial simulators that I wrote was an implementation of Icon's control structures using heap-allocated frames.

While heap allocating a frame is more expensive than incrementing/decrementing a stack pointer, managing lots of heap-allocated execution contexts is faster than managing lots of execution stacks, especially in a 32 bit world.

It had an ordinary stack for each thread, which was used mainly for running libc stuff.
My company also has a level for level match, except there are far more managers than equivalent high level ICs, and even the generous IC tree ends far sooner than the management one does. If a manager is so inclined one could pursue an executive position, and I’ve never seen an equivalent for IC engineers.

I think there is probably one IC equivalent for every 2-3 low level managers, and $CORP is better about these things than any other company I’ve ever worked for.
Yeah I agree, I originally built that block-code tool for data transformations and in that domain it is used in practice and very useful. But it's just configuration/queries, no unrestricted coding (the users were shooting their feet too much).
I had started with J and find out about Klong later, a nice niche language. I bought the book to learn about array programming in general and can recommend it: http://t3x.org/klong/book.html
It doesn't seem like that 50% number would just keep scaling with salary. There is a cap on payroll tax [1], administration stuff around administering health, vacation, etc. doesn't change that much, office space.. maybe so with things like the Apple spaceship ($5 billion with capabilities for 12,000 employees; amortized over 25 years would be $16,000 per employee so I wouldn't think so).

[1] https://en.wikipedia.org/wiki/Payroll_tax#/media/File:Effect...
According to the original RCE post:

> JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not affected by the LDAP attack vector.

So people just need to stay up to date on the latest patch version. Latest 8x is 8u312 and 11x is 11.0.13.

So Java 11 and 8 have some mitigation already in place, but people need to be applying patches like they should for all other critical system software.
It seems like Stripe Atlas could be adapted to help people formalize side projects, with invoices and subscriptions, while providing guardrails to keep from having to worry too much about the minutia of business, taxes, fees and so on.
I just bought a Tacoma. To be clear, the "remote start" is not what you are paying for. You subscribe to their remote connect service, and that is only one aspect.

You can also see where your car is in near-realtime, set a speed governor, stop the car, and a myriad of other data analytics are available.

If my truck was stolen, not only could I track it, but I could set it to not move.

Anecdotally, I have been told remote start via the keyfob will continue to work if the service ends. You just lose the app connectivity, which means I wouldn't be able to start my car while still in the mall
How Do I Unsubscribe?
Why loan? US printed trillions of dollars and put into its own markets and helped its own people, but didn’t think at all of giving checks to other countries that use the USD.

Sure, other currencies have problems as well, that’s why it’s probably better to use the dominant open standard that has already shown that it can’t be easily inflated…it just makes sense.
Apart from the discussion that nobody will pay, have you considered that companies aren't even remotely aware of what they use?
At Enterprise levels there is no excuse to be using open source software and not paying some amount to get support. Boo!!! Booo!!! To anyone in an Enterprise that exploits FOSS without diverting funds to it. https://youtu.be/74GdZs2Ilk4
PFAS ‘forever chemicals’ are widespread and threaten human health – a strategy
And equating fossil fuel waste with fission reactor waste is not?
I'm just curious what you think this adds to the discussion. (I'm aware you were riffing off the title).
But...and bear with me as I'm no JS guy and am unfamiliar with that library...how hard is it for the community to fork it and go on from there?

Literally every time I find an esoteric library on Github the first thing I do before forking it or adding it to my dependencies is immediately pull up the "network" tab to see if there's are active branch downstream I should follow.

Perhaps Github can do a better job of highlighting hidden downstream forks to direct people to find more updated and supported dependencies?
They aren't removing the capability to monitor browsing.
Yes, you just described Capitalism.
(unrelated design notes)

Columns with numerical data should be right-aligned. Column header alignment should match the data.

https://alistapart.com/article/web-typography-tables/
I used to not get the appeal of Rothko. I had one of those "my kid could do that" reactions to his work.

But years back, I started working in an office that had a bunch of his prints on the walls. Maybe it was the repeated exposure, but one day it just clicked. It wasn't just a mix of colors, it was a sunset, or a reflection on a lake at night, or a visual representation of what a happy or sad thought feels like.

Ever since then, I find pretty much everything he did to be transcendentally beautiful.
I find it interesting that there isn't an option on the table to just... not write addicting games. Similar to how we just can't not continue to improve on artificial intelligence, with limiters or without. Now that we know there is potential, it seems there is nothing preventing us from exercising our resourcefulness to pursue that potential.

Similar to the idea of UP, it seems we will continue optimizing all sorts of ideas to find ones that hold our attention the longest, until they expand to occupy all of our remaining free time. There is some kind of human instinct that encourages and validates this. I can't imagine it can realistically continue forever, though. The number of hours in a day is a hard physical constant.
And, misconceptions about vinyl’s reliability aside, it’ll just play. Nothing can happen. The internet can’t die, Siri can’t think she heard you, Apple Music can’t just randomly stop for no reason whatsoever.

You play a record, it’ll just play.
This assumption isn't true, though. APIs routinely get changed in minor versions, which can make it non-trivial to upgrade large codebases that use lots of features.
As much as I liked IH in the beginning, I have to disagree now. Valuable discussions on IH are rare. (Or any real discussion at all for that matter.)
Marx eventually clarified that he thought the “dictatorship of the proletariat” would not be a dictatorship, but instead rather radical democracy. With the benefit of hindsight, we can say that the anarchists’ criticism of Marx and his dictatorship of the proletariat were spot on, and that such structures rapidly became authoritarian and self serving.