skysight-inc/HackerNews huggingface dataset:
> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

This is false. Free software is given away by those who produce it. When you receive a gift, no moral or ethical obligation is created.

This idea that you can do things with free software that are contrary to the spirit (such as create a profitable company around it and not pay the original author) is a false one. It is free as in beer, too.

You don't owe anyone anything when you receive a gift freely given.
Wow. Seeing your open source project while scrolling through hacker news is something that really brightens your day. I’m happy to answer any questions people have.
> Lol, “never again” and Nuremberg code are just words easily forgotten

Being a bit over-dramatic here, aren't we? Never mind factually wrong about

> Israel is effectively forcing everyone to be at the 4th booster by now.

How do you come up with this stuff?
I'd guess those exterior walls are 6-12" thick poured concrete, similar to this[1]. You can see in the 6th picture almost all of the missing wall is still there and intact, it's just lying flat on the ground. In the 12th picture you can see how thick they are compared to car wheels nearby.

[1] https://www.mppengineers.com/index_files/Page369.htm
Whatever you do, brogrammer2018, please post a follow up story here on HN.
whereas nuclear will not

Why not? Why wasn't there a nuclear module (SMR) 20 years ago that can be installed in banks of multiple modules, just like a solar array made of multiple solar cells? Why should every single nuclear plant be semi-bespoke for that particular area?

reducing our energy needs

In some sense, human development can be measured in energy available per capita. We definitely want to make each activity we do as efficient as is reasonable (e.g. a washing machine that uses 0.5gal less water per cycle, but costs $3000 more is unreasonable), but the goal really ought to be to maximize energy used per capita, while minimizing energy used per activity.
do you mean to make a cluster of mini-receivers in location that has all speaker cables ?
No, the letter they got sent uses Pacific Time. The dicks couldn't even be bothered translating that into the time zone of their target, or even UTC.
The last part advises to be feature conservative to avoid promises all together. For that look to enterprise software where backwards compatibility is a legal agreement. This carries a bunch of alternative issues.
I believe one of the key features of the new power plant being built in Wyoming and sponsored by Bill Gates/Dept. Of Energy doesn't use water as a coolant.
MANGA should pay them. They have enough money
More money doesn't always make for better software.

Would millions of dollars of donations over the last decade have caused log4j to not have the vulnerability?
Just a random paragraph that caught my eye.

> And if we're talking about the construction of new power plants, then nuclear power is simply excluded. Not just because it is the most expensive form of electricity generation today, but, above all, because it takes a long time to build reactors. In other words, every euro invested in new nuclear power plants makes the climate crisis worse because now this money cannot be used to invest in efficient climate protection options.

You're literally investing that euro into climate protection... but it's not climate protection because you can't invest it in something else? If you start with this mindset of course you'll end up with nuclear energy being bad. You either postulated it's bad, or you wrote the specifications to make sure it ends up bad.
Can someone help me find whos idea was it?

Basically kill free open source. Make every "new open source" (NOS) program dual licensed, free for non commercial use and paid for conmercial use.

He proposed companies paying 1% of revenue to license this software. But it would all go through a proxy company that would gather payment and send it to participating companies, I dont remember how it would be split.

I think this is actually a way forward. I would feel better building on top of this kind of stack vs npm ecosystem
Just got my Bangle.js 2 and like it very much. Also purchased a Watchy for the epaper display a few months back. Compared to Watchy, the espruino IDE and ecosystem for Bangle.js 2 is much more developed and the community much more active. There is support for widgets, custom settings, and apps other than watch faces, and the development / sharing path is much more thought through. Check out the app loader, and the 300 or so apps (all source available on github) here: https://banglejs.com/apps/
I don’t doubt that corvids are quite intelligent, but I do find the conclusion jump in this type of science from “we did these experiments and saw these results” to “crows are self aware” to be quite dubious. Specifically the connection between X and Y in “we are demonstrating X by doing Y” is very often quite weak and prevalent across scientific disciplines.
We have a lot of the transmission lines already although of course we need more. The major missing part is interconnects between countries, or regions of large countries like the US. Germany has an over supply of renewable energy on occasion but is unable to export the energy so it simply drives the price negative in Germany while prices are high elsewhere.
I think the idea is to provide a middle ground option between full-on startup and doing free work for corporations. That implies meeting in the middle both on compensation and on work delivered, but it's possible that we'll find new non-zero-sum opportunities.
And your company can invest in log4j or it can invest the time and money in switching to another one. Which is cheaper?
> I just think that playing video games is probably the least healthy option.

What about movies and TV shows? Theatre? At least video games are less passive than those activities.
If I could figure out for certain which big companies were using my software, I might try the invoice idea for fun. I expect it would be ignored, but I would send it anyways to prove the idea one way or the other.
The life-changing secret of organized people. 2022 GoodNotes Planner
Bolt Labs | Blockchain & Software Engineers | REMOTE

We're a small, privacy-focused startup on a mission to empower everyone with the tools they need to realize financial privacy. To achieve this, we’re building zkChannels (https://github.com/boltlabs-inc/zeekoe): a scalable and usable privacy-preserving payment infrastructure that integrates with existing payment networks, including but not limited to public blockchains. We're leveraging cutting-edge technologies like zero-knowledge proofs and multi-party computation to realize fast private transactions on public blockchains.

We're hiring for blockchain engineer, software engineer, and senior software engineer roles right now and offer competitive salaries, great health benefits, equity in the company, and a strong remote work culture. Lastly, we're building all of our infrastructure in Rust so you'll be working in Rust from day one.

You can read more about us and the positions in our full job postings here: https://boltlabs.tech/join-us

These are fully remote positions available to anyone living in and with work authorization in the United States. We are only able to offer these positions to someone who is living and working in the US.
This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source.

You can pay someone a lot to make a product and they can do a shitty job. You can have a company install a backdoor in a closed-source software for whatever reason. You can have a well-trusted organization with competent developers mess up a single line of code, creating a huge bug or exploit.

OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will). There are plenty of open-source libraries where contributions are seriously reviewed for any accidental or intentional errors.

Serious hard-to-patch exploits are discovered in closed-source software every day. They might be harder to discover and easier to reveal without revealing how to trigger, because you can't directly see the source code. But this isn't a fundamental problem of OSS, it's something OSS users and maintainers need to look out for.
I don't know if you're a troll, or if you really managed to stuff three different far-right rhetorical tropes into one sentence in order to declare the cooperative development of software as immoral, because megacorps can't force people to pay for something.
“grep” is how raku spells what is elsewhere called “filter” or “where”.
I don't get the premise. I click the C page [1]. X=c, but what is Y? If you're not going to tell me Y, then shouldn't the page be named "learn X quickly" or something similar?

[1] https://learnxinyminutes.com/docs/c/
I feel this is a problem of companies being cheapskates, not of OSS maintainers. So do not make it their problem. I do not make OSS for companies, but for enthusiasts, contributing to building cool stuff, students and researchers.

Don't really want a commercialization of OSS maintainers. Does not seem in the spirit of OSS, but a convoluted way to contract a single dev to work on your stack. If you are this big company, ping your developer advocate, set aside a budget, and have them go through your dependancies and reward accordingly.

What bothers me way more, is when companies take OSS and then do not adhere to the license. Not as in forgetting to attribute you, but publishing a patent based on your code and approaches. That's easy enough to kill your motivation if you are doing it for free in the first place.

If money becomes an incentive for OSS maintainers, then they will start replying to the emails they constantly get, to buy their extension or use their CDN. Your company bet the house on a poor Polish CS student for logging or useragent parsing? Your, and only your, problem. OSS keeps on working.
See if you can find a Timex Datalink on eBay
Are you familiar with Kant's categorical imperative? (https://open.library.okstate.edu/introphilosophy/chapter/the...)
As a maintainer of several OSS projects, I could work full time on them and have time for nothing else.
Yet, I'm pretty sure that even if these projects would be 100x more popular, the donations I would receive wouldn't even pay my daily expenses.

I refuse all donations/tips for three reasons:

- as per above, your donation is generally insignificant. it's just overhead in tax accounting

- people donate "with strings attached": AKA "here's $2, but I'd really love this feature"

- receiving donations wouldn't be fair to any current or past contributors that made the projects what it is

The last point is especially true in the OSS landscape. The most front-facing programs get the donations, but the low-level libraries and infrastructure that make them possible get nothing. Heck, I've seen forks with a few superficial tweaks receiving donations and reaping the benefits while the original projects is chugging along slowly at the hard-to-build infrastructure that nobody else wants to do.

Bug bounty sites fall almost universally in the last category in my eyes.
HN is not the place to ask for legal advice. Just because it tangentially relates to technology does not mean it belongs here.

In any case: asking for legal advice without even providing a the jurisdiction(s) or details is a waste of time.
Building extra LNG plants is going to help us even less, and that's what it currently takes to keep grid operational with renewables, so...
it may be done to death but it certainly doesn't seem like a solved problem?
as anyone who's maintained a large old java codebase will know: there's adapters for all the popular logging frameworks so they interoperate

so yes, it can be
Sure you can fix it, change the "log4j" in your dependency list to "wyldfire-fixed-log4j". You can't do that with closed source (either because you care about legalities, or because you have no way of obtaining a compilable and readable source code).
When I look at https://apache.org/foundation/thanks I see a huge list of Big Name Tech companies who are presumably donating a lot to Apache.

So, what exactly is the issue? Perhaps one of allocation of existing resources?
This won't just cause issues for earth through collisions. Imagine a mass coronal ejection that would fry the electronics in all orbiting satellites. The more that are up there the more that can come down very quickly and randomly.
There are big discrepancies in the US alone. I'm comparing mine (L6+) to those.
probably switching as there's drop-in adapters for all of the popular logging frameworks
Name and shame the Founders.

There is a huge community of domainers on Twitter. There will be blowback. You will get tons of support, and recommendations. (as well as guidance on lawyers...etc).
> Taking the option of "I'll just build everything myself" then is not really a viable process in today's world

I want it to be practical to build software which only depends on a small number of trusted individuals or organizations beyond the OS and compiler. C++ manages it better than newer languages with built in package managers, and dependencies rarely depend on transitive dependencies, though it comes at the cost of adding dependencies (especially transitive dependencies) being extremely difficult (I hear Meson subprojects help, and CMake has their own worse version I didn't try).
"I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a critical issue is discovered, you are not at the mercy of the current maintainers of that package to quickly get a fix into production."

I'm probably mistaken, but I thought in maven managedDependencies was exactly this. Please correct me if I'm wrong.
Because for last ~25 years there was no funding to finish the SMRs that we did have good base design for, nor to expand necessary metal production for their coolant loops (or finalize the variants that didn't need those).

It all boils down to will.
I agree with your point that with low death rates it's important to try to determine which subpopulations are at highest risk of both (a) succumbing to the virus should they become infected and (b) vaccine-related side effects.

With respect to myocarditis, though, note that it is rare, and those affected recover quickly [1], and there are some recommendations about potentially changing the injection site to be further from the heart to lower the incidence of this side effect [2].

1. https://newsroom.heart.org/news/young-people-recover-quickly...

2. https://www.scmp.com/news/hong-kong/health-environment/artic...
Seeing these Excel pros compete reminds me of when I found an old server inventory system at work. Someone had in Excel+Visio+VBS made a system where you could see a top-down map of our DCs, and server cabinets. Each cabinet had an alert light indicating if there were any alerts on any server in that cabinet (fetched from Xymon), you could click each cabinet to get a front view of all servers, with graphics of server fronts reflecting the vendor and model of the server.

The person who made this had quit a long time ago, no one was quite sure of who it was. And of course things had slowly started to break down, like API connections, alerts, it wasn't up to date, but wow. It blew my mind.
As a former US Submarine nuclear reactor tech, I used to think when we pulled into port that our submarine could power the entire city while we sat there.

I don't know why we don't put reactors on large barges that sat offshore where there is plenty of cooling water and transmissions line wouldn't be too much of a problem. Navy ships don't worry about dumping slightly radioactive water overboard, but fortunately there isn't much of it from the closed circulation systems. Of course the spent fuel is disposed of properly once every 15 years or so.
I gave up battling with half-baked GPU drivers, buggy desktop environments, zero backward compatibility in 2012, when I switched from Linux to Mac, and all my problems vanished at once. Remarkably, MacOS is POSIX-compliant, so basically a well-designed desktop environment over Unix derivative, something that Linux failed to reach in 30 years.

In the same time, I develop server-side software for Linux for the last 15 years, and feel like it's just on the right place - on the server.
> Of the places I’m familiar with, I’d call out Delaware and Montgomery County, PA

Maybe certain select towns within those areas, but most of the area within those counties is not "Strong". Particularly where I grew up in Montgomery County, there are potable water issues that the municipalities refuse to address because the costs are too high.
Who said anything about LNG? Why the straw man? I said nuclear won't save us, full stop. Please do not put words in my mouth.
A large warehouse is pretty much built as a thin steel shell that would be expected to fail in more or less this manner in a tornado. However, there is usually an interior building within the warehouse that is built much more strongly (probably cinder-block masonry) that should withstand a tornado strike much more securely. That interior building would contain the warehouse offices, the bathrooms, etc., and it doesn't appear to be in the collapsed portion of the warehouse.
Open source isn't broken. Open source is organic and perfect. It's the rest of the world that is broken.
Quite a few managers I have spoken to will use the exact reasoning ("we could rewrite this in two weeks or so, why should we worry if it disappears?") and do indeed seem to think that the fact that because the OSS dev did not get paid for their work implies that it is low value work. If it was in fact high value, they would have gotten paid for it you see.
Covid tests needed for international travel can cost more than a flight
This is a website hosted in America by an American investment company with a primarily American user base. Not hard to understand why. Either way the OP appears to be Australian, so please hold off judgement next time.
Good. Maybe some people will drop Chrome now.
The Biggest Ideas in the Universe by Sean Carroll, an intro to modern physics, including homotopy and quantum field theory. He does some math but you'll follow if you've finished high school. Don't miss the Q&A videos in between the 26 regular episodes.

https://m.youtube.com/watch?v=HI09kat_GeI
No, it's not broken -- it's thriving.

Everyone involved has their own incentives, and gets to make their own decisions about when and where to invest their time and money.

Some devs are in it for the passion, some for the experience, some for the challenge, some for the learning, some so their work will live on when they change employers.

Startups get to use well-tested community supported libraries and don't have to build everything from scratch. Big companies get tech branding cred and can attract better talent, etc, etc.

And yes, maintainers sometimes get burnt out, consumers sometimes act inappropriately entitled, massively profitable enterprises often give back relatively little in return.

But that's all part of the deal going in, and everyone is fully aware of all the trade-offs straight from the onset.

What's so beautiful is that there are so many options whenever conditions change for any party. A maintainer goes to jail for vehicular manslaughter and a bugs needs fixing, no problem. Stand up a fork and the project continues on. A company's new leadership takes its own source project in a questionable direction and consumers are upset, no problem. Community forks and the project lives on.

And the result is we have this thriving, organic, creative, productive ecosystem which benefits us all in the end.
It's basically the same as the "I'm rich" app that costs a lot and does nothing other than display that text.

Well to be fair the NFT lets you sell it to the next sucker if they don't mind the 2nd-hand 'original'.
How amazing is it that I have served on the ELT for multiple companies and not once in a single meeting was it ever discussed how we could screw over the folks that worked for us?
It’s a testament to the sensible decision to treat JSX as view-library-agnostic and not just as a part of React.
Good maintenance requires skills and a steady hand but nobody is going to pay for it. New software is valued much more and thus is the resource allocation. If maintenance is done at all and not shifted to some lower cost organization or country. The Apple App Shop puts a premium on new over working a long time.
> Now the best way to get a job is leet code, leet code, and more leet code. Rather than spending <5 hours a week working with real code and producing real value on open source projects - most career minded engineers will simply focus on leetcode.

Maybe more broadly: The only way to prove that you're good at X, is to do X well. An artist is only as good as his portfolio. The same is true for all creative jobs.

I'm thinking that these proxies (see all attempts at standardised testing) are a disease of our time.
Germany pays neighbours to stop their own wind farms to sell power from their own, because they can't ship the energy from wind-rich north southwards due to lack of necessary interconnects. It's not that simple.

And the overbuilding necessary is usually more in range of 10x assuming favourable storage conditions (which aren't necessarily available).
Why would it need to be a fork?

It would just need a (regular to get security fixes) rebuild with an extra patch applied. Something that Linux distributions do all the time for Chromium.

The question is just who could maintain the extra patch.
Preach it. I have been the bane of third-party software vendors for years because I require a default-deny outbound policy for servers (and erring on the side of default-deny between subnets, generally).

This log4j vulnerability will serve, for me, as yet one more example as to why that's a good idea.
those types of roles are not usually salaried, or at most, very early-stage CTO type positions that quickly ask you to name your less-expensive replacements

you can more easily find that kind of work by offering consulting services and building/maintaining a network of entrepreneurs who stumble into those problems often enough to fill your schedule

being #2 Super Developer long enough to get your name out there is a good first step into that world ;)
You asked how to have an economy without scarcity. There will always be certain things, like natural resources, that are scarce. You can not make more land. Those things will always have scarcity.

There are other things that have zero marginal costs, and can indeed eliminate scarcity. But if you eliminate scarcity on those items, there becomes no incentive to create new things, as the natural price of anything with infinite supply is zero.

The creation of new digital items needs to be balanced with the very real scarcity of natural resources. The essence of your question is - how do we reward the creation of things if we can not restrict the use of it? And so we need to find a way to figure out the value of infinite supply items.
I am now. I'll need to digest it for a while.
I'm ok with 1.5C. I'm ok with significant climate change long term. I haven't read anything yet that caused me to think it's a particularly large problem. Like anything else there will be winners and losers - some places will be better, some worse. More people will die of heatstroke, a lot less of cold. It may well end up being a net benefit.

Should we avoid particularly large climate changes? Well, yes, mostly for Chesterton's Fence reasons. But I'm far from panic.