skysight-inc/HackerNews huggingface dataset:
Indeed Open Source also benefits Libre Software today. But do we really know what the ecosystem would be like today in a world where only Copyleft existed ?

Linux itself is GPL, so are some of the distributions. Hurd hasn't seen adoption, probably because the alternative is good enough.
Signal is still there, client and server. But maybe it wasn't needed because ejabberd, one of the biggest XMPP servers, was already there and powering all messenger platforms.

You're assuming that if developers didn't license under non-copyleft, they'd license under proprietary instead; there's no real reason to believe this. And as many examples have shown, many of the tools we use aren't actually made by billion-dollar companies but by single developers on their free time. The examples in the article show it, Werner Koch (the guy behind OpenPGP) has been asking for funding for years (decades ?). ssh, curl, ...

Anyway, that world is so different that we'll probably never know how it'll work, so here is the area where the optimism of people are visible and I myself believe Copyleft could have been a success.
Ah, very weasely. I imagine any prisoner can apply to be transferred to a prison in another country.
Don't get us wrong, eval() is terrible too.
Looks to me to be a "hot" indicator. Like lots of recent upvotes.
Is this a phish for log4j users?
Ask HN: What are your thoughts on women?
What are your thoughts on women?
Here's a picture:

* https://twitter.com/Orano_usa/status/1182662569619795968
I think that's the counterargument, and I can imagine it being true, but I also think we just don't know. Maybe there'd be just as much advancement but more developers would be properly compensated. It's hard to say exactly what would have happened because we're talking an alternate history.

Lowering the barrier to entry by being able to leverage a lot of free stuff probably helps make the industry bigger in having more startups, but I also can't say for sure there wouldn't be more jobs or higher paid jobs otherwise.

In the end, I'm not trying to push to end FOSS, but I'm trying to bring to front the contradiction I'm seeing of people wanting FOSS but also wanting FOSS developers paid a full wage. It seems fundamentally at odds, if you want people working on logging libraries to be paid full wages, stop making FOSS logging libraries.
It's a pretty widely studied artifact of mass retail that appearance was valued over taste, because appearance is immediately obvious while taste must be remembered and most consumers don't. In other words, it's immediately obvious what produce looks good, while knowing what produce tastes good requires time and attention. Most people don't really remember the difference between varieties of apples, for example, which are currently undergoing a bit of a renaissance as breeders have discovered the value of branding and marketing campaigns similar to those used for manufactured goods. The general perception is that this trend is starting to go away only now, as a largely internet driven food culture has emerged that values unusual varieties.

Moreover, for the retailer themselves, durability and shelf life is perhaps the single most important property in today's long supply chains, because produce is subject to rough handling and consumers absolutely do not purchase bruised fruit or wilted greens. Unfortunately it often runs opposite to other metrics of quality for produce.
Detect Log4Shell Log4j exploits with ansible
The study is somewhat skewed since its comprised of people 50+ years old, which have a significantly higher risk to begin with compared to young healthy adults.

Edit: Removed false/misleading bit.
> resulting in fetching code from somewhere and running it

Ahhh ok. I didn’t realize the service would fetch and execute. Yikes.
Is that really any different than admissions to an elite college? "Do we think this person can handle the abuses of other students and and still go on to donate mondo bucks to our school some 20 years hence?" All top companies are looking not just for intelligence, but for resilience.
> You'd think...these multi-billion dollar companies...would recognize the danger and immediately divert the best engineers they had to help this team identify and mitigate the problems.

For the general case, the problem is that a reporter might report the vulnerability to the open source project, then the project needs to keep it a secret while they make a fix. There isn't a great way to leverage these stakeholders. It's obviously different for something like Android that is open source, but clearly Google.
Just to make sure I understand this — the argument is that in order to combat authoritarianism, Silicon Valley companies should censor more content?
I'm very interested in what else they tried. Also very interested to see the research, is there somewhere it is published?

I do believe that performance in a technical interview corresponds closely with overall performance, but I'm very curious how they measure job performance, considering tech job performance is mostly a subjective popularity contest. I'm not convinced that is a valuable signal either. This is what I was getting at, we can't measure productivity _of employees_ with any rigor, so how can we know if our interviewing process works. Since job performance is so subjective, it's not very surprising to me that people hired with a different process aren't as well liked. The one thing I know about people is they like people like them. People who can and will grind leetcode are a very similar group indeed, so a person who didn't do that likely sticks out like a sore thumb.

Perhaps all this is accounted for, in which case I'd love to see it.
> Soon they'll censor women's health issues.

Surely you mean "people who menstruate"
TBH, this is a huge antipattern. You have to put some context in your logs, so it must be something like "debug.log("Got from peer: {}", stuffIGotFromPeer) or something like that. You can't complain printf(stuffIGotFromPeer) is dangerous, so here is the same. But in log4j, debug.log("Got from peer: {}", stuffIGotFromPeer) is as unsafe as the other one, too! There's no way to make it safe, as I understand.
You may be thinking of the Canon Cat. This feature is mentioned in passing here:

https://method.ac/writing/work_journal/method-draw-loading.h...
If they were going to give their award to a truly deserving recipient it would have been the tortured and imprisoned journalist Julian Assange who is an advocate of free speech and an independent media and voices. Instead they gave the awards deliberately to censorship advocates. It's the journalistic equivalent of giving war criminals and killers of children Nobel Peace Prizes like Kissinger and Obama.

https://www.huffpost.com/entry/doctors-without-borders-bombi...
I went to Mayo after a stroke.

I was (am?) a fairly high iq person, national merit scholarship, 99.8%tile SAT scores, etc. Degree in mathematics, compsci.

I had a stroke in my 30s, and it was thankfully mild (slight dysarthria that went away in a month) but I'm certain it impacted my intelligence and ability to concentrate. I can't focus/concentrate for long sessions anymore. I used to be able study without problem until the need to sleep kicked in, but now I get tired/distracted after only a short time even if I'm well rested. I find complicated math significantly harder to learn than I did prior to the stroke.

When I complained about this to my local PCP he would only run normal post-stroke cognitive tests like word recall, naming places/things, etc. "You test normal".

So I got a 2nd evaluation from a neurologist at Mayo.

Feedback was basically the same thing. He diagnosed mild depression, suggesting that could be part of it, and offered an anti-depression med, also threw in a "you're getting older so can expect some slowdown" for good measure.

I probably should have took it because the clear-to-me-loss of ability, with my doctors not seeming to give a shit, or even talk about it left me with no hope or plan to recover it has made me want to kill myself at times over the years. (I'm fine now, not a threat or risk).

I still read and try and just do my best even though my best isn't what it used to be, and count myself lucky that the stroke didn't leave me disabled or with permanent apparent deficiencies.

I just wish it were easier to find doctors interested in helping you be the best you can instead of simply not broken.
A post can be black on the front while not be black when reading from /active or /classic. So this not something tied to a post. And it seems to change every minute or something like that
> And PR? Google has been running projects like OSSFuzz for years and I haven't really seen it materialize as a large amount of positive PR, even in the tech community.

Google's Project Zero is both very helpful and gets them A LOT of PR, both tech and mainstream.
Open market dynamics should in theory change this one way or another. Long term you can't have some code cost $0 while an SVE's code costs $300k+ per year... Reality is open source code is badly mispriced right now.
Reprocessing makes the waste issue worse. Instead of all the stuff nicely sealed up in fuel rods, it's now spread all through the reprocessing plant. The volume of contaminated material will increase greatly. And it doesn't really reduce the volume of underground storage needed (from heating due to alpha decay of higher actinides.)

BTW, your comment about LNT is also misguided. There is no good evidence that LNT is wrong, and without LNT you might instead get a "precautionary" approach: assume radiation has the worst damage not ruled out by evidence. This would be much WORSE for nuclear than LNT, as it would increase the presumed damage from low doses. LNT is nuclear's friend; it is looked askance at by some of the anti-nuclear people for that reason.
By my understanding the RCE part of the exploit should not apply to recent java versions if the default options are used (minecraft shipped older version afaik, and all bets are off for unmaintained enterprise applications).
The data extraction however will work on any java version if the server in question has the capability to connect to a server under the control of an attacker, as the network request will be performed even if the JVM options that should avoid the RCE are enabled. Big problem for client applications (as usually most outgoing connections are allowed).
A bit harder to evaluate the impact in the enterprise context as many companies will not allow their servers to connect to "random" endpoints or at least require target-specific proxies to connect to the internet/intranet which makes this harder to exploit.
How a wedding with ‘super responsible’ vaccinated people led to outbreak
Taste doesn’t matter in the majority of the fruit and vegetable market because it is not perceivable at the time of purchase.
so what can individual consumers do? The LOE to keep up with everything is so overwhelming, even with organizations like EWG.
> Isn't interviewing in pairs fairly common?

It wasn't at any point that I knew. Interviewing is an expensive operation--it ties up quite senior folks for a fixed amount of time. If you pair that, you double the expense.

And it seems like phone screens are exactly the point where you most need a pair from these anecdotes.
You just awakened me that our nerves, and body in general, work more like a network than I cared to analyze. What other kinds of similarities can we gleam from this analog? Have those who work on digital networks made any useful discoveries from how the body and brain network? I vaguely recall a few things in which digital communication has learned a bit from animal communications and language itself but can't recall exact sources; brain like a sponge, it leaves as easily as it soaks up.
Hmm, 25 downloads at $100 per month would do it.
Like Common Lisp?
Ultimately these tools have already been released for free so asking for a rent seeking style payment after the fact is a little bit like sour grapes. What stops me from just forking the project? Really nothing. If anything open source maintainers that want to get paid should look into a model that mirrors the bug bounty programs. Have bounties for features. Generally these projects only really need security updates.
Aren't governments (especially Germany and Australia for what they are doing at the moment) way more scarier than big tech? I am not scared of Google or Facebook at all. I am, however, scared of governments. Especially seeing how the pandemic was handled and how little resistance the handling got from the citizens.
Ask HN: What are your thoughts on future technologies?
What are your thoughts on future technologies?
That’s not the point, you told me that you are not fine with a whole peninsula being owned by the same entity.

My question is: where do you draw the line?

Can someone own a 300 sq meters house? A castle? A golf course? A small island?
If you’re in the same industry, for bonus points consider filing to dissolve their trademark since they started using it long after you had been.
If the company is in healthcare or finance, yes. Otherwise the typical answer is no. Most companies just load up on cyber insurance and call it a day. That said, reputational concern, is a big thing for companies. Take Dropbox for example. Early on they suffered several security breaches, and had a bad reputation around security. They've since built out a fairly large security program, in part because bad security can block deals, especially in the enterprise space.

I'll note that there's been more investment in security the last 4-5 years. Most B2B companies do a SOC2, and early on, so there tends to be a baseline of competence.
Whatever feature this is for its too subtle to notice. I would have never noticed the difference without you pointing it out.
I agree. Facebook can try to show me targeted ads, but that's pretty benign compared to what my government can do to me with absolutely zero recourse.
I think they were joking about Java because of log4j.
Telling someone how to steer a bike is useless and plain unnecessary. You teach them to balance and they will naturally counter-steer. There is no theory class.
Never heard of OpenDyslexic. Thanks for your input.

Curious to hear from some dyslexic programmers on here
That would be impossible. Can you imagine: United States imprisons Nobel prize laureate.
Correct. I am absolutely done with this level of doublespeak.
Unless I miscounted in my head, that does not seem to hold true. Could be wrong though. Is it purely a guess or did you look at some stories and conclude this?

Edit: see the addition to the TS, I noticed some counter-evidence towards this theory.
I voted for Biden but [semi conservative opinion].
Well, let's see: cost, $0, and a few minutes. Extremely tiny risk of serious side effects. Benefit... better immune response to the nasty virus going around. Let's also not forget this doesn't benefit just you; it benefits everybody you probably won't infect if you get exposed to the virus.

No emotion involved, at least not from me. Seems clear enough to me. You seem to be the one having an emotional response here.
> Microsoft . . . huge checks

E.g., any company smaller than MSFT would have been destroyed by the endless Word For Windows effort.
That was the same "authoritarianism" that saved us from a violent insurrection and another Donald Trump presidency.
>Israel is a wrong example too.

To be clear, Israel is an example of a country that is claimed to be a nation-state. I didn't intend to say it is or isn't, so I use the passive voice on purpose.

If you think it is not, that is further proof that nobody agrees on definitions or classifications.
sure, and I think I've even seen one. The problem is, your software won't be included in any distribution repositories anymore because it is no longer Free Software under whatever definition they use (likely based on Stallman's "Four Freedoms")

Some similar things have happened to mysql (to mariadb) and mongodb (to whatever the fork is called).

Dual licensing it like MySQL did is one way to approach it, but plenty of people were happy enough with what it did that they didn't pay for it.
A friend said the same. I'm curious how much of that is display contrast or environmental lighting and how much of it is personal (noticing odd details, quick DIY autism test (jk)).
I really don't understand why you are defining this as a random, external project. Your software is dependent on this project! It's right in the term "dependency"!
I think you are grossly and uncharitably misrepresenting my comment by calling it "fake news" when I clearly pointed out my mistake and posted a correction inline with "EDIT" as soon as I was made aware. I don't think your response is an appropriate one in the spirit of Hacker News and I think you should reconsider this style of response.
Crows or humans?
> On the other side I've read the following articles[1][2], from people who know the industry inside out, which are less enthusiastic mainly because building new reactors takes too much time for our climate crisis and is too expensive compared to solar/wind + batteries

I ran across the statement that the entire output of the world's battery factories wouldn't hold an hour's worth of electrical usage in the US. I have no idea if this is true.

But I'd rather side on the side of caution and start building more reactors now just in case the Totally Renewable Plus Storage future does not scale.

If the billions spent on nuclear turns out being a sunk cost because renewables+storage does work out I would not consider it "wasted". It's simply the cost of a backup plan to help ensure we humans don't cook ourselves to death.

At the very least we should stop retiring current nuclear plants. Any added renewable capacity should be used to offset shutting down fossil fuel generator plants. Once those are taken care of we can then perhaps talk about nuclear.

And talking about the problems of storing nuclear waste for 10,000 years is a moot point if civilization doesn't survive the next 100.
Once I fell in dark depths of depression. Everything lost meaning and I just wanted to stay in bed.

Eventually, I came out of it on my own. I think following things helped:

1. I would cry out loud and pray. I am almost atheist but praying really helped. Almost every morning I needed to cry like a child and pray before getting out of the bed.

2. I didn’t quit my job. Really wanted to. This gave me a reason to get out of bed.

3. Music. I would listen to sad songs and cry out loud with them. Sometimes, I would cry for couple of hours before going to sleep.

4. Tried to not bailout of social situations but I did cut it a lot. It was very hard to put a fake smile.

5. Read a little about CBT and tried to unravel my thoughts.

I don’t remember how and when I got out of depression but I still suffer from anxiety. However, my depression is completely gone and I am a happy person now.
Sometimes links to other subs go to the new site, sometimes stays on old, I suppose depending on how the links are set up.
I can imagine them imprisoning Nobel Prize laureates as they have bombed Nobel Prize recipients as well.

https://www.huffpost.com/entry/doctors-without-borders-bombi...
A better interpretation would be that Silicon Valley should stop algorithmically promoting anti-democratic, pro-authoritarian content.
One place I worked used syslog to ship important analytics data from services to Kafka. log4j is a reasonable choice for logging to syslog from Java (but let's be honest, you should be on Logback). Now, using jndi as part of this? That's getting a little too clever.
> That's a good thing

Good has many dimensions. I'm saying that as a developer, FOSS means people don't need to pay you to build those things, only to use them, and that's why FOSS developers themselves don't get properly compensated, because they chose to build it for free.

You could say FOSS is a good thing if you talked about computing progress, or barrier of entry for a startup wanting to build an app, or as a great source of example to learn from, etc.

As for your comparison, I don't think it holds, because very rarely are FOSS contributors hobbyists, most of them are professionals. So it is much more akin to a professional window engineer giving away free schematics for unbreakable windows, which means that companies manufacturing unbreakable windows no longer need to pay a professional window engineer to make schematics for them.
Nice summary!

As a Chinese native and Han people, I have no idea of these historical records! Just to say how rich and complex the Chinese history is and how profound is this legacy and heritage.
It's true that I shouldn't have posted it, was mostly just in a grumpy mood. It's still considered very bad form. I'm not actually there anymore, but the idea stands.
One thing that I constantly think, when reading about these Jurassic-scale disasters, is "where are the wise, conservative stewards?"

I've been appalled at the way that older, more experienced developers are treated, and am not surprised at this.

There's a really good chance that many of these bugs were introduced by developers that are now older, and more cautious. In some cases, these may be the harsh lessons that caused these developers to become more conservative, these days.

A conservative (not political "conservative," practical "conservative") approach is generally best, when maintaining infrastructure. Be careful, test well, don't "push the envelope" too much, and, for God's Sake, don't add new stuff, until you have the old stuff completely tested, documented, and supported.

New stuff can be added via forks, and introduced via carefully-vetted PRs.

I keep thinking of the Linux core kernel project as an example of how to do it right, but I am not very involved in that ecosystem, so it may be a case of "the grass is greener on the other side of the fence."

I can tell you that I take each of the tools I make, very seriously. A quick shufti at any of them will tell you that. No one really uses them, but that's fine with me. I write them for myself.
I think you are mostly right, it looks to me like stories that are rising up the page, rather than dropping or stationary.

Could it be a feature that is usually visible to mods or highly ranked users but has accidentally been opened up?

(Also I have a vague feeling is seeing this before)

Edit: 100% sure this is right. Also this story just dropped from 2nd to 13th instantaneously. Thinking as it’s HN Meta it’s probably (understandably) been flagged by a mod…
I think the opposite is true, we're doing the same thing doctors and lawyers do: artificially restrict the supply, driving up demand and pay. Not top down and centralized, but individually and decentralized. There's plenty of jobs, almost every company reports a 10% shortage, but the developers won't let in anyone.
Advent of Cyber – Learn cyber in 25 days
You wrote this...

All the comparisons like > are better written using their TensorFlow equivalent (e.g tf.greater). Autograph can convert them (you could write >), but it’s less idiomatic and I recommend to do not relying upon the automatic conversion, for having full control.

...but I'm not sure you realized that the for loop and the if statement in your code are being transparently compiled to dataset.map() and tf.cond() for you by Autograph :)
300 sqm yes, a castle yes, a golf course yes, a small island no.

I also just don't like the church, so there's double the hate at a super rich church.
> Extremely tiny risk of serious side effects.

How tiny? It matters. Your risk of a bad outcome from Covid-19 is extremely tiny.

(Also, by the way: the costs are greater than what you pay for the shot. Miss a day of work? Spend a day in bed? That's a cost.)

> it benefits everybody you probably won't infect if you get exposed to the virus.

We have no evidence of this, nor do we have any reason to believe elevated antibody levels will continue indefinitely. Antibodies from the third shot will wane, just as the antibodies from the second shot waned, and antibodies always wane after antigen exposure. It's how our immune systems work.