skysight-inc/HackerNews huggingface dataset:
Why not start a foundation, or even a business where companies and individuals can voluntarily pay for open source software, like an online store?

Different projects have different prices, but you can pay more.

The money is forwarded to project maintainers was wages, but a "tax" is applied so that some money is redirected to small but growing projects.

Projects that see sufficient income would be certified as having certain level of guaranteed support, based on the fact that they essentially have a staff to maintain the project. The entity would ensure and manage this. Some of the money would be used to fund this process.
same. my evenings and weekend are totally gone to put out this fire. which I wouldn't do if i wasn't obligated to
What I meant is that both parties fund the police so it seems like pew polls don’t seem to affect policy much.

Biden literally pushed crime bills way back when. And I don’t have any hope that the democrats will pass any police reform given they control Congress and the executive. There’s such easy reform too that could be done by executive order like stopping police from purchasing military equipment or linking funding to reporting police violence stats.
Ask HN: Do You Use Logging?
It seems that with advent of technologies for capturing errors with breadcrumbs there is a diminished need for ever reading error logs.

I am talking about sifting through large log files looking for clues as to what happened.

If you do, I would be curious to know what's your use case?
OP should consult a lawyer with domain expertise and should seek to invalidate the threatening company's trademark, rather than doing nothing. File a petition to cancel the trademark with the Trademark Trial and Appeal Board.
I'm sure there are things that you like and I don't understand. How intelligent would it be for me to insult and mock you about them? Why do you feel the need to do it to others?
tfw you want to avoid Fox so you accidentally post fake news. lol
Oh, ok!
https://en.m.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has...
As a southerner, this sounds pretty good:

https://www.foodandwine.com/recipes/carolina-gold-pilau-shri...
Some time ago I read a pertinent comment from someone working on JDK here on HN. Unfortunately I can't find it, so I'll have to paraphrase:

Even though Adoptium has some big names backing it, they aren't big contributors to Java. This is relevant because it implies they get access to not-yet-publicly-diclosed vulnerabilities and the corresponding patches later than other projects. Rather, one should try to use a distribution by one of the major contributors, for example Red Hat or SAP.

Since I cannot currently provide the source and I cannot personally verify this either, take this with a grain of salt.
I checked out Jothy Rosenberg. Deeply moved by his perseverance, will power and technical sophistication. Wish I knew him in person.
Thank you for this comment, it inspired me to stop reading before I had any idea what this article was about. 5.5 hours later, I'm back :-)
I'm not saying you, as an engineer for those companies, should be the one to donate your time and energy toward the problem. We all have competing priorities, as do the maintainers of those FLOSS packages.

I'm saying that your company's CTO, especially one with a very large companies, could likely identify two or three engineers who they pull into a meeting and say "reach out to these guys and get them whatever they need. Here's my cell, call me the moment you need the plane or additional resources."

Seriously, if a CTO has a budget of a few hundred million dollars and thousands of dedicated employees, how hard is it to throw a few crumbs to the open source community to change this situation from being one of a burden on a volunteer effort to, instead, one where they feel like they're in the middle of an international event where their knowledge and services are vital to keeping the internet alive?

Again, I'm exaggerating, but you see where I'm going with this. It's a missed opportunity for some seriously great PR out of a seriously bad situation.
So far, the following parts can fail without a person losing its humanity:

Heart, gonads (testicles), lung, kidneys, liver, stomach, pancreas, limbs.

But you can't transplant a brain out into a new body. Take care!
I will let you know I am very aware of my lack of self-awareness.
Show HN: Automate Debugging, Save Time
Log4J is far from being the standard. As a matter of fact, JBoss, Quarkus, etc, aren't affected by this because they don't use log4j.
Speak for yourself!

I'm here all week - I think.
That's true of every np-complete (or similar class) problem: it's easy to verify that a solution work, but hard to find it in the space of possible solutions.

Reportedly, quantum computers can help us with some problems of that kind.
What about transflective lcd, like some Garmin forerunners?
You used the word “voluntarily” here, and it’s going to be the singular reason it won’t work.

Corporations ever do anything voluntarily if the alternative is tangibly worse, evidently more expensive, or existentially threatening, especially in short to middle term.
Libraries like that might make it easier to get started, but they tend to limit what you can do. For example, I recently created a Desktop GUI app that could take inputs from a networking socket. How do you do that cleanly? There is often a way around limitations, for example by creating a separate thread, or by polling every so many milliseconds (which is ugly and a waste of resources). In my case, interfacing directly with Win32 without a 3rd party layer in between, it was easy to create an Event Object for the socket and am calling MsgWaitForMultipleObjects() in my message loop. Not sure what's a good solution to do this with SDL, but why should I even bother...
didnt read the article, but it reminded me that a person mentioned in the book surveillance and punishment by foucault (iirc), was going to be decapitated and promised to keep blinking his eyes - on his severed head - as long as he could.

the author didnt disclose the results though!
I wish your comment would get higher visibility.

To clarify, the vulnerability would make it possible to post server environment variables to any remote server, regardless of JRE version. That could easily end up being as catastrophic as an RCE.
Volvo, maybe?
They are. You should have an up-to-date runtime to prevent vulnerabilities or just to have more-or-less accurate TZ databases if anything else.

It can be Java 8, but please use one with actively developed security patches.
There's a lot of complexities and politically-motivated reasons behind calling various varieties of Chinese "dialects" but this article swings way too far the other direction.

There has been a single lingua franca across all of China since at least the Han Dynasty, perhaps even the Warring States period or earlier. It has variously been called 通語 (the mass/common/omnipresent/intelligible language, 通 is a bit difficult to translate here), 官話 (the official language), potentially 雅言 (elegant speech, this is more controversial and earliest mention) and now 普通话 or 國語.

> Indeed, before the 20th century the idea of a singular, spoken Chinese language was a foreign concept

Matteo Ricci explicitly talks about a single language he can use to talk with everyone in every province (in his time this was the 官話). And indeed he used the same language as he made his way across the entire coast of China. There is an entire Han Dynasty compendium of the vocabulary of various regions that compares it against the official lingua franca. Indeed the title of this work is exactly Fangyan!

> But while Chinese thinkers frequently mentioned ‘official languages’, this was by no means synonymous with a ‘national language’ – a language unified in its sound and script used by and representative of a Chinese nation.

These "official languages" were exactly unified in sound and script and representative of a Chinese nation! The language Ricci encountered was the descendent of one whose pronunciation was explicitly codified (there are some asterisks here I can elaborate on if people are interested) in the 14th century 洪武正韻 (Hongwu Proper Sound), and was passed to neighboring kingdoms as the official language (and is e.g. preserved in Korean rime books on the Chinese language).

The difference in the last 100 years has been a difference in degree rather than kind. With the advent of near-universal education and literacy and the technological tools offered by mass media, the PRC, ROC, and to a lesser extent places like Singapore and Malaysia can more effectively carry out the language programs that have been attempted in the millennia past.

Granted the difference in degree is vast: the tools at the disposal of political regimes today absolutely dwarfs those of the past. This also means the effects of standardization are far more keenly felt. However, the motivation and policy is one with a long and winding history.

It follows a standard story of varying unification and disunity both linguistically and politically that has played out many times in China's history.
If you’re into guitar and specifically guitar pedals, almost any video by JHS Pedals where he talks about technology and/or history of a specific pedal type or brand/model.
> If my company was liable to have to pay out for each one of these projects we would be bled dry and our business would no longer be profitable.

Unfortunately, building a business on a limited resource that is -currently- "free," is not a particularly wise decision.

VideoLAN and ffmpeg are amazing tools, but a lot of folks have made a lot of money on wrappers (some of which, are eye-wateringly expensive). I'd be unsurprised to find a number of license violations in some of these wrappers.

History is filled with examples of people making money on resources that are not sustainable. These folks make a lot of money, until they wipe out the resources.

OS is a limited resource.
For me, there were four black-colored stories on the front page, and the fifth black-colored story was #56 on the second page.
> If log4j2 is responsible for your company's success, you have a moral obligation to donate to the person who creates this library thanklessly.

This is absolutely not what open source is about. The author just sounds completely against open source, which is fine, but don’t lecture people for not paying for that which was intended to be free.
Oh man, that's sad. I hope he recovers and gets back to making these great videos again. Wish him the best.
I checked out this guy's resume and even after Borland he has sold two companies for $300M each. A fantastic engineer and entrepreneur I think.
They do. I personally know at least a dozen extremely talented software engineers who have left Blizzard alone for FAANG in the last 3 years. Could bump that up to a solid 2 dozen if we included Riot, and go back 5-7 years.

edit/ These game companies themselves are also quite incestual, for want of a better word. Once a developer moves from one team in one company to another team in another company they typically try to heavily recruit the solid folks that they "left behind," as it were.

And I get that, but, anecdotally, it's never been something that I did when I moved around in my non-games industry. It's never even really crossed my mind.
Zgomot centrala Ariston. De ce bubuie sau pocneste centrala
No one is entitled to money. There's nothing broken about that. If you want to make money it would be a good idea to make a business plan.

Making and maintaining a piece of software and giving it away for free isn't a great business plan, or at best it's an incomplete one.
2007 Kindle Pessimism
You have issues. Seek help.
What's the largest company that uses FFmpeg and has refused? What did they say?
In practice this isn’t an issue. You put alarms on that queue and triage it immediately.
And also the US Army.

https://en.wikipedia.org/wiki/SL-1
> Excel still is used heavily in government.

Are you implying that there is somewhere it's not used heavily?
Something that's 2-3 years old maybe has enough bugs worn off it by the early adopters that enterprise users might start thinking about maybe using it in Q4 of next year. After a massive pilot program to do a test rollout and lab deployment.
That's stunning. People are screaming about SQL injections and such for decades now, every "programming 101 for complete doofuses" course has a chapter about it in the first ten pages, we have tools upon tools to detect patterns of using untrusted data as control... And yet, one of the most popular logging toolkits in one of the most popular languages has it built in as a feature - literally using untrusted and unfiltered outside data as a pattern - and it takes until 2021 (almost 2022, happy new year!) to realize this is bad??? There were so many problems with untrusted data used as control flow, how it didn't raise any alarms before?
Open source developers can still release things to everyone for free. Seems fair to say that companies derive value from open source in proportion to their scale. How about a $1m value generated threshold before it's considered impolite for a company to not at least give a little something back?
Different people have different incentives. No, throwing money at people does not solve every problem.
> Surely the difference is you are getting paid, and if your boss says, help these guys out, you can do it?

No, I'm not getting paid. What leads you to believe in that? My targets are defined yearly and are very well defined, and patching random FLOSS projects is not one of them. And what leads you to believe that others, such as my boss, don't have their own milestones to meet, and instead take random FLOSS requests from random people on the internet?

A FANG is not a magical entity where any engineer can drop everything they're doing at the drop of a hat to work on external projects, let alone one whose only possible outcome is at best total indifference and at worse we get the company to own a problem affecting everyone for no reason whatsoever.
Chechk this benchmark comparing front-end frameworks (includes alpine, react, vuew, svelte, etc) : https://krausest.github.io/js-framework-benchmark/index.html

Maybe try https://github.com/solidjs/solid
> Which is very difficult / nigh impossible for closed source.

Closed source does not mean that the customer has no access to it.

In case of my Sciter, for example, customers are getting access to SVN server with sources. Some of them are sending patches with fixes and features.

Sciter's [1] core customers are antivirus vendors - highly professional, dedicated and disciplined teams that know very well what they are doing.

It is not an open source but not a closed source either. Rather a professional club where members value each other time and efforts.

[1] https://sciter.com
This one seems popular too: https://ansonmills.com/products/23
Keeping this around, as a default, was a bad decision.

Definitely. But really, they were screwed once it had shipped. They could and should have disabled it in an update long ago, but then anyone who read the release notes or the code would know how to exploit the millions of un-updated systems.
It is very simple to justify when you consider the US alone.

However, if you choose virtually any other countries that you might consider to be nation-states, then you could describe them in the same manner. The way I read your definition, you describe two polarities, which lend themselves to any conclusion about any country, depending on which is emphasized.

I felt like the UK, Pakistan, and Israel were three good examples of countries claimed by some to be nation-states that show the definition is complicated and subjective.

And indeed, it already was denied that the UK is a nation-state, in this thread!
Actually, the first moves of the players determines the result. And because of the symetries there are just 12 first moves.

My tweets about this topic: https://twitter.com/arman_boyaci/status/1442436923960827913?...
Ask HN: How do Western Women treat men?
My research on this topic indicates a statistically significant difference between women from the western world, compared to women in non-western countries. Why and how come?
This issue is so complicated.

Yellow journalism existed in the 1920s. It's nothing new. There will always be people that want to consume these materials and believe them.

The alarming thing are the calls for censorship.

Look at how bad the media and platforms have been about Covid. Early advice on masking, lab leak, adipose inflammation, and other fairly innocuous lines of research were censored. Imagine centrally purging such discussions.

When you censor, it isn't just the thoughts you dislike. Soon they'll censor women's health issues.

Censorship is a threat to democracy.
Yeah, I was poking around in the compiler source and noticed a D file with the #! prefix so it could be executed in interpreted mode. Just like tcc does, except I guess it would work for any valid D program, unlike tcc which won't compile all C code. That's a great feature to have. I do get the impression from looking at it at a distance that it's well designed.
You do realize that this issue wasn't discovered this morning, and indeed part of the point is that if it wasn't people in their spare time it could've been patched days ago, and you could've fixed all your services during the week? So you prefer working weekends to fix a delayed bug instead of devs being paid to help fix it for everybody during the working week?
This commentary is exactly the problematic commentary the authors were referring to in the quote that David included near the top of his article. You may not be being so directly brash about their state, but you still imply with added dramatic extension that the project is in some dire state. That's likely a significant overreaction. There's a feature in the project that leads to a security concern, making it fixable likely took a small number of hours, communicating and dealing with the drama is what has and would continue to take the time, as well as pushing back on a plethora of demands for "full review" or "you must travel outside of your home country so I feel comfortable again".

I poked some fun at the issue, because this is in many ways an amusing issue - a feature that would rarely be added in more recent times, but at the time it was introduced we as an industry considered the whole space differently. I'm sure the maintainers are having a tough time, and theres no need to point fingers at them, hell there's no need to point fingers at the implementor of the feature. It's a mistake in retrospect but that doesn't make anyone unworthy of respect.

The actions you identified make a lot of assumptions, some are exclusionary, some are potentially offensive:
- not everyone lives in the same country
- not everyone can travel on a whim
- the developers don't need to be close to you or their customers unless they want to be.
- the project is not in some dire state in need of "saving"

As an Apache project there is a foundation that can help organize funding, and so if there's a funding problem with the project the discussion should start there. Yes, open source at large is underfunded, but this isn't a standalone project on a personal git host. Apache has some (probably not enough) funding, but most importantly it has the industry contacts and relationships to do better here.

There's a problem with "doing better" though, which I rarely see come up in these conversations. There are lots of libraries, such as log4j, that don't necessarily need full time staff or full time funding. They need spurts of funding at key times, to handle the trickle of regular but infrequent patches, to roll releases periodically, and occasionally such as this to dedicate some significant time to handling an exceptionally rare event. What this requires, in my opinion, more than arbitrary dollars, is a slush fund of professional time sponsorship, for employers of key contributors to be ready to make space available during work hours for this work, without adding any more pressure to the situation. Depending on the situation this may or may not require additional funding, but for a healthy ecosystem finding ways to arrange for this, and helping employers be comfortable with it is the step necessary to address the wide scale problem of small to mid size projects burning people's personal time in unplanned ways.
But I don’t see people attacking the AWS team, at worst the “VP” who has to approve changes to the dashboard. That’s management and that “VP” is paid a lot.
That's way worse than that - that's like SQL server looks into your data and if it sees something that looks like SQL it executes it right there. I wonder how it took until now to find an exploit...
For me it changed each time I visited another discussion page, or maybe just as I refreshed, currently only number 1 is back and it is no longer changing.

Edit: after posting this comment #3 (this story) changed to black.
I'm wondering if it's possible to retain the editor but use modern toolchain such as GCC? I guess it's definitely possible but how can I achieve that from WITHIN the editor?
I'm not sure about Amazon but Google project's zero and openfuzz teams seem to be doing a lot of good work when it comes to open-source security -- more would be nice always

Personally I'd like something like a security health card/metric on opensource libaries that we could tie into CI systems/pull requests or something

in the past there were so few libarries it wasn't as daunting

I'd be able reason about stuff like libpng, libttf ..etc and think about them or even support them but now some projects are massive hodgepodges of thousands upon thousnads of packages
Does Facebook even need to give justification to remove content they don’t like? I’m not sure compelled speech on private infrastructure is the solution to this problem.
This situation is fairly urgent, but I think you might not realize just how many people a CTO at one of these companies manages. There are going to be "OSS fires" more or less constantly so "some major OSS project has a bad vuln" is not the sort of thing that gets a CTO at a company like Google or Facebook out of bed. I've only seen this happen a very few times and they were for problems that were way more serious and complex.

But that is not to say that nothing is being done. At Google, at least, there are organized efforts staffed with plenty of people that are trying to solve the much much much bigger problem of "secure all of our open source dependencies and all future dependencies" rather than the individual problem of "secure this one dependency."

And PR? Google has been running projects like OSSFuzz for years and I haven't really seen it materialize as a large amount of positive PR, even in the tech community.
Is HN still written in LISP? I think it’s time it’s written in a modern type-safe language. You know what I mean.
(my guess) those rising faster than some threshold, over some period of time.
I would assume wasm. Some program will migrate to the browser (AI/ML / data analysis).