skysight-inc/HackerNews huggingface dataset:
It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last?

A while back I bought a cheap robot vacuum. Their scheduling feature didn't meet my needs, so I reverse-engineered the protocol and open-sourced a cron-friendly CLI tool and a library so people could do other things with it: https://github.com/wpietri/sucks

Honestly, this was a mistake on my part. It was a demanding audience of home-automation hobbyists mostly without programming skills. The company was thoroughly unhelpful. When my vacuum finally broke, I was relieved, as I had a good excuse for trying to hand off the project. Nobody stepped up, so I shut it down. I just ran out of interest in doing free work to support a company worth billions.

I really admire the community spirit of open source But it's not sustainable if companies making their money off it keep depending on the niceness and generosity of others without giving back enough to keep them happy, healthy, productive people.
Elmish/MVU Library for Python?
I've been using simple animations in a CS1 course using the Elmish/model-view-update style in OCaml. In the spring I'll be teaching CS1 in Python. Does anyone know of a reasonable Elmish/MVU library for Python?
Still seems to be it could be mostly conditioning. It's essentially a two-part stimulous to provoke a response.

Also many animals can problem-solve up to a point, even use tools, but that is not what "self aware" means to me. Self-awareness is more being able to think of yourself in the abstract, behave in consideration of how others may see you, etc.
FYI if you watch the video and like it, he also has a great podcast (Mindscape) which often involves physics but usually combines it with some other topic being discussed with a guest.
Far too expensive compared to other non-fossil alternatives.

For a long time, nuclear supporters just ignored the cost issue, since they felt they were the only real non-fossil alternative. Yes, they'd be expensive, but society had no choice. In the last decade this changed. Renewables are now far cheaper on a levelized basis, cheap enough that even with the cost of dealing with intermittency they are likely to come out cheaper than nuclear.

This is why so much new capacity in the world (and in the US) is renewables. It's not because of green mind control, it's because of brute economics. Nuclear is in dire shape competitively, in comparison.
This is completely wrongheaded.

The people responsible for the logging library security are 100% the people who decided to integrate that piece, not some open source person who provides a patch and his three sponsors.

The Log4j library has a LICENSE.txt with clauses "7. Disclaimer of Warranty." and "8. Limitation of Liability."

The wake up call is that programmers should take responsibility for everything that they integrate, including all that they recursively integrate. If you put it in the image, it's your fault.
Inflation is not some unfortunate built-in side effect of fiat but a deliberate policy choice by specific organizations and people. Why would they all of a sudden give up those policies and embrace the crypto-land?
Bingo. Prioritizing preservation of profits over preservation of the planet is exactly whats killing us.
I've gotten used to the full screen (or width) windows. Mostly it's because of certain work web UIs that need as much width as possible.

I agree with your statement that wide text is difficult to read. In Emacs I use Olivetti mode to narrow my text windows, I should probably do something similar for hackernews or other sites that would benefit from narrower windows.

In Firefox, there's reader mode too, which makes things much easier to see.
No, the companies are supposed to generate value for shareholders. They are supposed to have infinite financial growth and that is pretty much it.
Throwing money at some outside parties will not ensure that your in-house developers aren't carelessly in including snippets of code from the wild into your product.
Panda – Clip and share moments from Zoom
The reason that most distributions only packaged Java 11 until recently is actually very simple: it was the current "LTS" version, which had a longer support window. So companies won't usually jump into Java 12, or 13... because it meant you had 6 months until that release would be considered unsupported.

That's why Java 11 has been receiving updates (latest one, 11.0.13, dates from October 2021) while Java 12, for example, got its last release (12.0.2) in 2019.

Now that Java 17 (released two months ago) is the new Java LTS version, you could expect most distributions to package it. For example, Ubuntu has been offering Java 17 for a couple of months.
I'm going to do this as a top-level comment because I think it's important. Throughout this thread, a number of people seem to be misreading the numbers and arguing that the results are unimportant because they show that the booster reduces a tiny risk (0.00298%) to an even tinier one (0.00016%). In general, this is a fine argument to make, but I don't think it's well supported by this paper.

Here is the Results section from the paper: A total of 843,208 participants met the eligibility criteria, of whom 758,118 (90%) received the booster during the 54-day study period. Death due to Covid-19 occurred in 65 participants in the booster group (0.16 per 100,000 persons per day) and in 137 participants in the nonbooster group (2.98 per 100,000 persons per day).

The risk of death is being reported per day, and not per year as many people seem to be assuming. They had 85,000 people in the control arm, and 137 of them died in the less than 2 month timeframe of the study. If you multiply the daily risk by 365 to make it an annual risk, you find the non-boosted (but already doubly vaccinated) group had a slightly greater than 1% chance of dying within a year. By most standards, and compared to most other situations, this is a considerable risk of death. By contrast, the boosted group had a less than .1% chance of dying per year, so it's not just that an elderly study population was already on the verge of death.

So unless you think 1 person out of 100 dying within a year is insignificant, it would be more helpful to point out the potential flaws in the study than to say the results don't matter. Should the data be trusted at all? Is the boosted group really comparable to the unboosted? Did they mishandle/miscount the way people were switched from one group to the other throughout the course of the study? Should those less than 30 years old even care? These are potentially good questions, but it's not reasonable to suggest that the study as printed shows that there is no real benefit to the booster.

(Obviously, if my math is wrong or if I'm misinterpreting the results, please correct me!)
https://en.wikipedia.org/wiki/Negative_temperature
But then whose fault is it? Software will always be compromised sooner or later by hackers looking for exploits.

I know Microsoft just threw the keyboard at the wall and said "fuck it everyone gets forced to update".
I don't think testing is the silver bullet here – it's about system boundary awareness.
don't worry about this 3 day nonsense. Nobody works that fast.

This was a red flag for me too. 3 days to take action? It takes longer than that to get anything done these days. They're trying to scare you into compliance. Three days is not enough time to get legal advice from an actual lawyer who is versed in domain name law, and respond.

If you're gonna spend any money with a lawyer, have one write up a "go away or I'll let this go to trial and you can pay my legal fees" letter to send back to them.
> Should maintainers of all core apache libs just remove or disable features they don’t like,

Why not? I can just go into a parity package.
Again, anyone “in the financial services industry who regularly communicates with clients [using their phone],” is not going to have an issue with this. We’re not talking about bank tellers here.
For one, NOAA shows a US-centric aurora view while SWL shows a mercator projection. And it has a much nicer dashboard.
Some subreddits (like /r/linux) will delete your comments if you don’t register an email though.
Note "yearly cost". Between administrative and organizational overhead, taxes, benefits, etc, typically only 50% of that cost is actually taken home as employee-visible salary [1] (which the employee then pays income taxes on...). $175k is still a healthy salary especially when compared to other locales, but it's not the $333k that is easy to presume based on GP's comment.

[1]: From what I've seen this ~50% number seems to be pretty close to the mark across virtually all industries and jobs. I.e. it's pretty safe to assume that the total cost to your employer to retain you is around double your take home pay.
Do those specific managers and layers really complain about CVE? Afaik they don't care or know.
Hi, I understand that you might be thinking I'm pretty comfortable doing what I'm doing, but there are few things that I'm not sure you've considered or not: 1) Are you comfortable editing your .gitlab-ci.yaml for the type of work you're doing or it's always the case? e.g. if you're a go developer, is it that easy for you to do the same for java? if your application is dockerized can you compose the file as fast if the application is supposed to run on ec2? what about a different cloud provider?
2) What if you decide to switch from Gitlab to TravicCI?
3) Do you consider your expertise with gitlab/bash/ci-cd above average, average or below average?
4) How exactly do you believe a tool that has generated at least the scaffold of your pipeline's file can make it more difficult for you to take the final step? Again, assume you want to create the file from scratch.
5) Regarding the frequency of the problem, I totally agree, we don't create or update our pipelines everyday, but almost every developer/team has to do that.
I personally am very comfortable working with Gitlab, cause I've used it non-stop for two years, but when I want to use Github action, I have to read the documentation and it can take me couple of hours to figure out what to do.
Having a Ph.D. and getting referred by insiders in no way reduces the amount of LeetCode you have to grind for Google interviews.
I am describing how it works today, not how I wish it to be. Assange made mistakes but he should not have disappeared into the UK prison system because a corrupt banana republic (Ecuador) elected a new leader. Austria should not have forced landing of a plane with Evo Morales onboard just to hunt Assange, yet Austria did. No country will protect you (he was not offered asylum in or other "democracies"). The left wing media (Guardian & Co) failed to support him.

No matter which country you look at if you intend to upset their power structure (or the structure of a powerful ally that you want to appease), you will not have rights. Even more so when you're not a citizen of that country.
Yes, but the next sentence says:

>We have not yet set a deprecation date for Manifest v2

which means they plan to deprecate everything before v3, but don't want say it now.
Thanks! This was a revelation for me on a few levels:

1. That memory management doesn't have to be scary with a little forethought, at least for programs where you can set a reasonable upper bound on the resource requirements.

2. That it's possible to structure at least a subset of programs in such a way that error states can only be entered during initialization, and that makes the rest of the program much easier to reason about.
How I got tricked into writing a Clojure port (ClojureDart)
Tony Zhou and Taylor Ramos (of Every Frame A Painting) are involved with Netflix's new show Voir, which seems to follow the same video essay format. Haven't watched it yet, but it's on my list.

https://www.netflix.com/title/80990130
Does it matter that other products don’t patch something that yours does? Like, sure, it’s unsatisfying from an ecosystem perspective, and one would hope for fixes to be incorporated upstream. But if they aren’t, who cares if other products are broken after you’ve patched the ones you’re responsible for?
That could work if the cost per sale were sufficiently low. But unless companies set up some sort of low-overhead system for putting that kind of money into open-source projects, I can't see it working. From what I hear, most devs can't just say, "We use project X a lot, so I'm going to fill out their web form right now and expense a $1k annual donation."
That's because most companies don't consist solely of very senior people (they can't afford them). Among very senior and valuable people, contractors are a majority I think.
> Would following an open core model work better, like it has for Hashicorp, Sidekiq, Tailwind, etc?

Yes, I think this might be a better model, indeed.

But I did not start either of those projects, I came on board later; and those models are difficult to back-fit into an existing project.
I think the media might have unintentionally done themselves in by using the terminology "vaccinated" with no qualifiers in much of the coverage of the virus in the past two years. Soon we might have to be careful to state "vaccinated, but only within the last six months" or "vaccinated, but with the version targeting omnicron". I can't imagine it will be easy for all the existing articles from months ago to be updated now that we have new information.

I feel the same way with masks. If you didn't do enough research, you could easily believe that anything with an N95 certification would be ideal for protective purposes, but plenty of N95 masks have valves which makes them useless for preventing infected individuals from infecting others. There are also cloth masks, gators, and so on. But to many people they all fall under the umbrella of the unspecific term "wearing a mask", and unless you explicitly look up the medical consensus, many sources of information are unlikely to also state "but not those masks."
Insider threats are a thing. Never assume that because machines don't have internet access that you can be lax about such things.

Source: A colleague of mine who deals with APT all day long.
Yes I would like less regulation of nuclear. The NRCs 15mrem per year requirement is nonsense. It means that a person living on site year round, growing all food on site, and drinking the groundwater must receive less radiation than eating 3 bananas per year. It’s an unscientific requirement.

The ban on reprocessing is stupid, and results in more waste. The ban on long term storage outside of Yucca Mountain is dumb. Prehistoric salt deposits are far better and cheaper to maintain. Requiring waste storage that won’t expose a hypothetical persons 10k years in the future to more than 15mrem per year is also stupid.

It’s all based on the linear no-threshold model which isn’t supported by evidence. We know from experience that 35 mrem dental x-rays and 70mrem chest x-rays don’t pose any risk to the average person over their lifetimes, for example.

Adhering to the 15mrem standard is insanely costly. Especially since it can be super difficult to separate from background radiation that’s at times 2 orders of magnitude higher. You’d get 600mrem standing in Grand Central In NYC all year, and more on a flight to Europe.
Yes, but it doesn't mean what you think.

Goodwill in that context is towards the company, an intangible asset comprising the value in its brand etc.
> This is what I hope to see happen more and more: Open Source maintainers graduating to sophisticated counterparties who send invoices for "support and sponsorship" on letterhead, and big companies developing procedures to assess, approve, and pay them as a matter of routine so that they can get what they need from the ecosystem.

In what way is this not an ask?
I think the most recent Minecraft release (1.18) actually requires Java 17?
It does because now I pull in a dependency that indirectly relies on log4j instead of my favorite fork of log4j and I end up having the same CVE in the project anyway. Yes this needs to work ecosystem wide, otherwise you have fixed nothing at all.
And not just less waste than fossil fuels, it's less waste than what solar panels, batteries and wind turbines produce. A lot of which can't be recycled and ends up in landfill.

For perspective, one person's lifetime nuclear waste would fit in a Coke can.

https://www.npr.org/templates/story/story.php?storyId=125740...
I have tons of stuff running on Java 8. It's LTS version and no reason to change working builds, adding more unknowns into the system.
There are, roughly speaking, two categories of businesses that receive this letter and differentiate themselves based off their response:

1) "Hobbyists" and the like who are not doing anything particularly valuable with the trademark and domain name. Even if these people can prevail in a lawsuit, the other company is hoping that the owner decides they can't (or won't) risk the time, money, and stress of going through a civil lawsuit.

2) People with valuable businesses whose rights are worth defending. The other company is already pretty sure you're not in this category, since you haven't vigorously defending your naming rights to date.

Overall, you have prior use, and may be able to "win" if it gets to an actual lawsuit. The strength of your legal claim isn't the problem; if you have to spend high-five figures to keep the rights to your hobbyist website, you have already lost. Your goal is to convince these folks to leave you alone on as favorable terms as possible. If your domain name is not particularly valuable and important to you, this likely means A) hiring an attorney, B) using their services to convince the other company that you're in the second category, and then C) selling them your domain name for significantly more than it's worth to you. If your domain name is valuable to you, the only thing that changes is that you may need to pay the stochastic taxes that businesses have to pay to have access to the legal system for dispute resolution, and you might have a hilarious "thank you for informing us of your clients' violation of our trademark rights" demand letter sent back at them.
We think therefore we are -- aren't we?
There's a tradeoff between the costs of trying to detect possible issues at various stages, and the costs of damage if those issues aren't caught until later. This makes the caught-earlier-is-cheaper analogy not always hold, because the costs you spend to detect an issue at some stage can easily outweigh the costs of the issue itself at any later stage. Hence the industry doesn't follow NASA practices, or even more reasonably make use of TLA+ as basic professional practice like unit tests have largely become. Many bugs have such negligible impact that they remain unfixed, regardless of when they were caught, regardless even of whether the customer found them or knows about them. We also realize that some bugs still make it past everything and get to production, so it's worthwhile to spend effort trying to reduce the cost of production bugs, which might for instance involve having a faster and smoother deploy process.

So in hiring, there are costs companies pay to avoid a bad hire, and costs that result as a consequence of bad hires -- which they mostly can only estimate because of bad hires getting through anyway, everything on the consequences side is formally probabilistic. You can think of it as hiring-filter-costs + P(bad-hire) * consequences-of-bad-hire. So yes, if P(bad-hire) is 0 because of your amazing hiring filter, then you'll never have to pay for the consequences-of-bad-hire. And supposedly, increasing hiring-filter-costs should decrease P(bad-hire), though over time we've found many practices that don't actually do that, and smarter companies have stopped doing them.

My thinking boils down to we can and should reduce hiring-filter-costs (which I want to think of as including opportunity costs and negative externalities on the whole industry, but it's not necessary), but fear prevents even experimenting at many places because there's an idea that any reduction will increase P(bad-hire) too much, and consequences-of-bad-hire are too large. So, why not focus more on identifying and lowering the consequences-of-bad-hire? Do that, and we'll also be able to lower hiring-filter-costs even if they increase P(bad-hire), which they aren't guaranteed to do anyway.
This might sound weird, but I find every time someone publishes or contributes open source, they are stealing value from me, because it is one less thing that a company will need me to implement, build and maintain for them, instead they'll now expect me to simply use the existing free of charge open source one.

Not only does it feel like I'm stolen value, open source work tends to be the most interesting, and as more and more is done and offered for free, my work becomes less and less interesting, and the job becomes more about connecting and configuring all these open source systems together.

Needing to contribute free work in open source before getting a job therefore sounds like the biggest of scams to me.
But the fees are taken from people speculating in crypto to make money.

Even though these are "fees" or "loans", the purpose is strictly speculation. It's not driven by intrinsic value, but people attempting to make money via speculation.

If I take a loan for a house, I can live in it. That's intrinsic value.

So the system only works to the extent that people are willing to pay for tokens without intrinsic value. Does not seem sustainable to me
> It seems like you haven't quite got the concept of open source. If everybody consumes and nobody contributes, how long will that last?

I think that's a pretty unfair characterization of the previous post.
In the case of core-js the issue isn't that "nobody is contributing", the issue is that there is one guy with commit authority and he's an asshole who reportedly spends most of his days rejecting PRs from people he doesn't like.

IBM, Oracle, Apple, Microsoft could submit all the PRs in the world and it won't do any good if he says "I don't like your coding style" or "this takes core-js in a direction I don't like."

Or he ends up in jail. I thought the author was joking about him going to jail for killing two pedestrians. They were not: https://www.theregister.com/2020/03/26/corejs_maintainer_jai...
> Can WebTorrent clients connect to normal BitTorrent clients?

> In the browser, WebTorrent can only download torrents that are seeded by a WebRTC-capable torrent client.

https://webtorrent.io/faq
I'm curious on your thoughts about the difference between publishing this post and publishing oss/foss code.

To me, it seems like this blog post is something you've shared freely with the world, with no expectation of getting direct financial compensation for it. You have an idea you want others to read and think about, so you wrote it down.

To me, this act of publishing and sharing your thoughts freely in the hopes others might find them interesting shares similarities to free software. You wrote something that you think others might find interesting or useful, and you want to share it. That statement applies equally well to FOSS and blog posts.

What do you see as the major difference? Is it that OSS rejects copyright, so the code can be used for profit, while your post can't freely appear in, say, a published for-profit book of opinions on OSS? Would you be opposed to this post being published by someone else and you not getting money for similar reasons that you blog about here?

Is the difference in expectations, that people expect support for software, while people expect nothing of blog posts? That a blog post is finished and may be thrown over the wall, comments ignored, typos uncorrected, and that feels "fine", while software thrown over the wall with issues ignored and no future changes planned feels "weird"?

Is there some bigger difference?

Is there a way to reduce this difference, to create an environment or structure where you would share code, just as you currently willingly share your thoughts and writings on this blog?