skysight-inc/HackerNews huggingface dataset:
There's a pile of international treaties on this, starting with https://en.wikipedia.org/wiki/Outer_Space_Treaty#Responsibil...
For all you know, he could have just donated to the victims' gofundme after running a candlelit vigil, but here you are.

Feel free to express how upset you are, but please don't demand that we somehow express our feelings in a way that you deem sufficient.
So their business plan is to buy launches from SpaceX to build their own fleet. Then SpaceX has the booster paid for and can re-use it up to 4 times to launch their StarLink satellites for a fraction of the cost.

Seems like it would be simpler for them to just write a check to Musk...
I seriously doubt that open-source is broken.

What is broken is companies using open-source to build their products, expanding to billion dollars total revenue and not giving anything back in the long run.

This will - as shown in the latest example - come back to bite them.

It's the classic tragedy of the commons; everyone is willing to profit from the public good and nobody is willing to invest resources into it.
First, contact an attorney who specializes in this area of business and law.

Meanwhile, also look up that law firm that sent you the letter and see what you can find out about them (e.g., are they even legit, what kind of other cases do they handle, etc).

And search for any information you can find about this other company and the people. What have they done? do they own property? What other businesses? Criminal records? etc. etc. etc.

Also gather all your own records - business formation, original site registration and registration history, logs of any marketing and advertising you have ever done, etc.. Anything that shows you actively using this trademark over time and as far back in time as you can establish.

Bring this data to your new specialist attny.
Sure, but it's doubtless that there are prevailing attitudes, and also doubtless those attitudes are allowed change over time. Because of the voting system you can even measure that change. I would also argue that a voting mechanism can distill that room into a single amplified voice, even if there's some disagreement within the room. As an example: You could post a Dawkins quote on /r/atheism at noon and you'll probably get some upvotes and some comments. If you post the same quote at midnight (when most of those who interacted on the original post are asleep), you'll probably get a similar proportion of upvotes and similar comments, but from entirely different individuals. Meanwhile, you could expect the inverse outcomes making the same post at different times on /r/christianity.

What I'm asserting here is that any popular community with comments ranked by upvotes and downvotes inevitably ends up speaking with a singular editorial voice regardless of who happens to be online that day. And (here comes the hot take) in the case of HN, that voice has, for better or worse, lost a lot of its hard-edge over time in my opinion.
How about e-ink watches? I know nothing about them, but it seems they exist and aren't specially pricy.
All the best to you,
It makes sense that the booster might lower mortality from an already very low rate.

My question is, are we already below the risks from seasonal flu? I do normally get the seasonal flu vaccine, but I didn’t last year or this year because I’m still practicing social distancing.

I guess I’m trying to put this in perspective.
Terminal Planetary Defense
My team has cracked making blockchain NFTs legally control physical property: buy the NFT, get legal ownership of the underlying physical asset.

Works right now for stuff in vaults. Property in warehouses and galleries is next. It's a building block of the circular economy.
I'm afraid Mozilla can't promise anything at this point:

>After discussing this with several content blocking extension developers, we have decided to implement DNR and continue maintaining support for blocking webRequest

Then they say blockingWebRequest will be eventually deprecated:

>We’d like to note that it’s still very early to be talking about migrating extensions to Manifest v3. We have not yet set a deprecation date for Manifest v2 but expect it to be supported for at least one year after Manifest v3 becomes stable in the release channel.

https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...
It's not uncommon for a severe storm system like this to produce multiple tornados. The "quad-state tornado" was farther to the south, cutting across the bootheel of Missouri, while the one that hit the Amazon warehouse was more north, near St. Louis.
> Can you please help me understand why you, and everyone else, are so passionate about the status page?

I don't think people are "passionate about status page." I think people are unhappy with someone they are supposed to trust straight up lying to their face.
It's really too bad it's so expensive to pursue issues like this. If the .net company has more money than the OP they could even end up with the .com even though no one would consider it fair.

I think it would cost a lot of money to invalidate a trademark, especially if the company that owns it has deep pockets and even a UDRP complaint can cost in the range of $5k from what I've read. I think that's why so many mediocre .coms sell in the $2-4k range. It's cheaper to pay the domain/trademark squatters for the guarantee of getting what you want than it is to (maybe) prove their registration was in bad faith.
Low-income kids use different brain function to ace achievement tests
> The average social security payout for recipients is around $1500/mo. The max is around $3100/mo.

Nope, the max is around $4200 (or, will be in a few weeks). And that's per person. A couple could receive as much as $8400/month.

https://faq.ssa.gov/en-US/Topic/article/KA-01897
Unpopular opinion:

Maybe there is nothing wrong with the "status quo", maybe we don't need yet another attempt to finance small FOSS projects where it's hard to explain how money will actually solve any of these issues.

Maybe people just need to be more considerate of what they depend upon. And in the case that a popular yet well maintained project has a CVE on day, maybe we need to accept that popularity does not make them invulnerable to bugs, all software has bugs.

</ unpopular realists opinion>
IANAL, but at least according to ICANN rules you have nothing to worry about unless "your domain name has been registered and is being used in bad faith". You can see the specific definition of "bad faith" and the rules around this here https://www.icann.org/resources/pages/policy-2012-02-25-en

Its easy to prove you are not acting in bad faith because your ownership precedes the trademark. I personally own and use several domains that others hold trademarks on, but all of mine were registered before those companies established trademarks.
> I'll take a 90% lower mortality rate any day.

Really? Any day?

Read the part you quoted carefully: the death rate in the control group is 3 per 100,000. And if you read the rest of the paper, you'll see that the study population was entirely over age 50.

Remember that the risk of death from Covid-19 goes up exponentially with age -- something like 90% of all fatalities are over age 50 [1]. If you're in the typical HN demographic (<30 yo), your risk of mortality from Covid-19 is much lower than what is reported for baseline here.

I want to put this in perspective. Per The Book of Risks (chapter 8; annual risks) [2], your overall chance of dying in a typical year is 1 in 115 (~870 per 100,000) Your chance of being murdered is 1 in 11,000 (9 per 100,000). The chance you'll die of an accident is 1 in 2,900 (34 per 100,000). From a fall: 1 in 20,000 (5 per 100,000). By getting hit by a car while walking: 1 in 40,000 (2.5 per 100,000).

In other words, your all-ages chance of dying from Covid-19 after two doses is somewhere between your annual chance of dying from a fall, and dying after being hit by a car -- and it's much lower than that if you're under age 50! Divide that number by ten, and you're in the realm of risks that any sane person wouldn't even consider: the annual chance of dying by freezing, for example (1 in 3,000,000).

Point being: dividing a very small number by 10 is indeed a 90% risk reduction, but you have to weigh it against the costs very carefully. There are tons of reasons why I wouldn't take a 90% relative risk reduction, if the baseline risk were quite small (as it is here).

[1] https://www.statista.com/statistics/1254488/us-share-of-tota...

[2] https://www.amazon.com/Book-Risks-Fascinating-Facts-Chances/...
Unfortunately, the print version is apparently sold out all over France. Interesting that they're trying to sell a kindle version of a comic.
I'll probably switch to a system-wide adblocker like Adguard. It's already a life-saver on Android.
Log4j: Between a rock and a hard place
music subscription is pretty decent. I'd say news also, although I don't like any of the drivel that passes for news which is available via [aggregated] subscription. But in the world we live in, I can understand why and I think it's good.
> Things like banking, insurance, manufacturing, healthcare. All of these industries have competition from startups, but are far from being crushed by them... Not yet at least.

All of these are either low margins or extremely regulated (healthcare). Not interesting targets.
Maybe you can consider another vaccine as a booster if this one did not acted well on you?

I don't see how the booster is guaranteed to be the final answer as the virus keeps mutating and spreading among the very large unvaccinated population.

I personally think that it will become endemic, thanks to the vaccine we would have enough immunity to keep us out of hospital and each time we get the virus it would act as a booster.

This thing is not going to end without something like world wide super strict lockdown(Wuhan style) or world wide vaccination(and probably some combinations as the vaccine itself reduces but doesn't completely stop the spread).
I've just finished it, it's excellent. It's about more than just our energy sources, and it's drawn by the author of Quai d'Orsay, another excellent graphic novel about "a" foreign affairs minister in 2003.
In many states (including California) you will get a ticket for impeding the flow of traffic even if you are at or under the speed limit, e.g. if you are in the passing lane or not using turnout areas when on a two lane road. While you yourself don't have to speed, you do have to get out of the way of people who want to.

Ignoring everything that is happening around you, even if you are under the speed limit, is an incredibly unsafe way to drive.
> Man-pages is a Linux thing, while python packages are cross-platform and can be installed on Windows.

Windows has help files, which are its version of man pages. So an installer that installed man pages on Linux would be expected to install the corresponding help files on Windows.

> dropping files all over my system

I said no such thing. I said there are certain designated places in a filesystem where certain common items like man pages (or Windows help files) live. Not to mention system-wide configuration files (which on Linux go in /etc), and I'm sure there are others I've missed. An installer that is not allowed to access those places does not seem to me to be a complete installer. Linux package manager installers certainly put files in such places. Windows installers do it too (although the specific items and places are different).

> How would that behave in a virtualenv anyway?

A complete virtualenv would have its own copies of the above types of files, in the appropriate places relative to the root of the virtualenv.
Note, as others have commented, the JRE change prevented the fully open-ended RCE where you could download classfiles from an external server and run them. However, the log4j bug does still allow posting of environment variables to external servers, even with the JRE changes, which could be just as catastrophic.

That was my understanding anyway, someone correct me if I'm wrong.
Someone should write a package that goes through your existing codebase to see which open source projects you make the most use of (however that is measured). Then a company could run it once a year, say around tax write off time, and build a list to donate to

I would have happily given to log4j, but I didn't know that they were in need. Someone has to make it easy to keep track of this because it's never going to be a priority for businesses
No, they couldn't. There are a handful of companies making almost all traditional games, a handful more of indie successes, and then a terrible morass of companies making gambling traps called "mobile games".

If you're not working for EA, Activision-Blizzard, Ubisoft, Sony, Microsoft, Bethesda, Valve, Bungie, Epic, Rockstar, or Riot Games, you are almost certainly not working on a major video game project, and certainly not on a game that will make hundreds of millions of dollars in profit.

And conversely, if all of the developers on, say, World of Warcraft were to strike tomorrow, Blizzard would not be able to afford to replace them. That's the power of a union.

I have no idea where you got this idea that it's easy to start a gaming company. Unless you plan on making a mobile game, they're a very hard industry to enter, like all other art industries.
You mentioned you don't want your passion project to be critical to someone without getting paid for your work.

How do you ensure that's not the case? Careful license choice, "you're on your own" wording or something else?

Like, if someone created a unicorn startup rivaling Slack using Elemental-IRCd, how would you react?

(I have massive respect for anyone maintaining an ircd, btw, having attempted to contribute to one a long time ago)
I agree. What's broken is liability of those companies relying on open source but not taking responsibility.

One way to hold them accountable is to apply regulatory pressure in case of security breaches, which has started to happen (albeit not nearly enough). Is there any other way I'm not seeing?
Side note: dang there are salary discrepancies in the SWE community.
Well, I just mentioned what was used for a web, yet we had tons of tools working on internet and intranet, as well as background workers...
IMO you're falling prey to the tendency to anthropomorphize these things. That's powerful and common and unavoidable. Where it becomes a moderation issue is when people start posting their images of the community in a snarky or sneering or defensive way, in order to immediately knock them down. (This is what you did above with your "they".) In comments like that, people are simply battling with their own imagination. Such comments are reliably uninformative and go against what we're trying for on this forum (https://news.ycombinator.com/newsguidelines.html), so please don't post like that here.

(On the other hand, if you actually want to do a rigorous analysis of the data I'd be happy to help. We'd never publish vote data but I don't see why that would be necessary anyhow.)
well written.

One thought: i disagree with the classification of (senior) software engineer.

i think it’s more comparable to a VP of Engineering in a company with n engineers (n = count of committers/involved), so salary estimate are even higher.
It's fascinating to see people go back through all this old data from these probes. A lot of the data they downloaded to Earth has never been decoded for lack of resources at the time.

It's a shame NASA doesn't at least help these guys out more by digging out the specifications, rather than have most of them trying to reverse-engineer everything blindly.
What could the attack be there? Aren’t Jenkins usually private for employees use?
> They start their career at age 24 and, because they have a Master's degree, they skip over the long years in the trenches working as a computer programmer. Instead, their first job is often as CTO of some medium sized company.

If this is actually in your book I would remove it. This totally destroys your credibility because:

A. You're talking about a 7 person startup, not a "medium sized company"
B. You're talking about the worst managed medium sized company I've ever heard of, where they would put a 24 y.o. masters student with no real world experience in charge of anyone.
C. It's not a true anecdote

Any of the above options lead me as a reader to think that either you don't have experience in the industry, have experience with poorly managed companies or are making up scenarios to fit your narrative
Well, I agree but no solution in the horizon yet. Yes, the companies which profit from open source "should" fund the open source. But nothing forces (or even reminds) them to do so.
Have you ever used Lisp or a similar functional language? Understanding those helps to understand Lambda calculus. That and an advanced Math degree. :)
Please define "unsustainable".

It has worked great for decades, both for the free market side, and for the FOSS community.
Thanks for the tip, I'll give this a try.
I practice something similar, I've statically allocated the physical RAM modules when I built my computer. O:)
I've not seen much speculation on how this bug was created in the first place, so I'll take a guess here:

On https://logging.apache.org/log4j/2.x/manual/lookups.html it says: "Lookups provide a way to add values to the Log4j configuration at arbitrary places." I think, the person/team that implemented the Lookup feature never indented it to be used outside of the configuration files, which are clearly part of the codebase and therefore trusted. I can fully understand why this is seen as a useful feature.

Then someone else came, saw that there's a useful feature that allows to automatically extend stuff like the request URL in a log message, and embedded that in the log message parser. I don't think this should ever have been implemented, and surely not enabled by default. Even if there was no LDAP remote code execution (ok, we can blame Java for this) or JNDI lookups (which can leak data to the outside), this lets user provided input be used as a query to all the stuff that can be inserted by Lookups (environment vars, request headers, JVM arguments, ...) For example, someone who just has access to the logs can use this to query secrets stored in the environment of the app.
Seems they did a Leeroy on the Jenkins.
I don’t believe any comment recommending Firefox is off topic at all for this. For anyone who is worried about losing uBlock functionality in Chrome, the correct answer to that problem is to switch to Firefox. Hence the top two comments right now pertain to Firefox.
"Being considerate" and "accepting" can't fix bugs. Time and money can fix bugs. We need to get these projects more time and more money.
“ What's even more unknown is how technology might affect something like this in the future. For example, cellular providers in the U.S. have earmarked the end of the 3G cellular network, a technology that many vehicles rely on today in order to call home to the mothership, so to speak. We've got a whole explainer on that available here, but the long and the short of it is that the situation is particularly dire for Toyota owners.

While some other manufacturers are retrofitting vehicles to be compatible with newer LTE networks, Toyota is discontinuing Connected Services support for the affected vehicles, all of which are model year 2019 or earlier. A Toyota spokesperson confirmed to The Drive that it has no plans to offer an upgrade, paid or otherwise, to vehicles affected by the 3G shutdown. Perhaps not coincidentally, the automaker also announced that it has "enhanced" vehicles built before Nov. 12, 2018, to no longer require a subscription for the key fob's remote start feature to function.”

The old ‘be cautious of what you build on’ advice applies here.
Ask HN: Long-form info-dense videos on YouTube you would recommend to anyone?
I like watching 30-to-90 minute videos to learn about some new domain, and I feel like YouTube videos could have less fillers than Netflix documentaries in that duration range.

Examples of videos I watched and would recommend to anyone no matter their expertise:

* The Secret Life of the Electric light: https://youtu.be/W79s0PsHhDc

* Fun to Imagine with Richard Feynman: https://youtu.be/P1ww1IXRfTA

* A mind-expanding tour of the cosmos with Neil deGrasse Tyson: https://youtu.be/AyAK3QBnMGQ

* The magic of chemistry with Andrew Szydlo: https://youtu.be/0g8lANs6zpQ

* The Beauty of Bézier Curves: https://youtu.be/aVwxzDHniEw

* All about musical scales: https://youtu.be/Vq2xt2D3e3E

* Woodturning a modern chess set: https://youtu.be/bmTcWoXTxi4

* How Imaginary Numbers Were Invented: https://youtu.be/cUzklzVXJwo
The machinery for quorums could be built on top of PGP. Multiple people can sign a package, and the trustworthiness of their endorsements can be evaluated based on a web of trust — including by downstream users, so you don't actually have to rely on the robustness of the package manager's authentication at the moment of upload.

Because PGP is not universally loved, I think it's important to reiterate that the fundamental theory behind quorums is just multi-factor auth. But PGP does solve some of the hardest parts.

From there it's a matter of defining which authorities to trust, and then gating acceptance of a release once a quorum is reached (however that quorum is defined).

Finally, the idea needs buy-in and participation from package authors, which could be encouraged by privileging releases with multiple endorsers.
Interesting as bargain. Maibenben(Chinese) mini computer AMD Ryzen 5 Vega graphics, ssd, more ports than usual desktop. Using Budgie Ubuntu Linux FAST AS HELL! $400 OR LESS (newegg.)One 8GB Corsair(?!) Sodimm add another yourself in other slot. 4K video outputs. Boots 12 seconds. 4 cores 8 threads There two more generations of AMD CPUs yah separate video cards "gamer setups" sure. But for the price nothing close till $550! Think Chinese want dollars. $439 at moment. Chip 14 months old they have more recent AMD chip models. Bluetooth dual WiFi one is 5G for more.
Really surprised me how fast it is. Never been on one as fast- fast enough for me- rare.
little trouble setting bios to boot off AMD disc cause of UEFI.

I Booted into windows 10 sign on then used Windows reboot outside UEFI choice. Set bios to boot off DVD and used legacy where available in bios. Install disk Ubuntu Budgie says something failed along way but let it Go and it continues & completes install in short time.

As usual installing AMD video driver has bug in kernel 20.04 but google it and the error solution comes up actually works. Latter optional as Ubuntu installed drivers just fine.
Hm, what if we filled the sky with satellites to cool down the planet?
Finally! Emoji macros are a reality!

Do we all remember the dark days of the Before?
There are salary discrepancies everywhere in the world. If you mean the salaries across countries, you're comparing apples and oranges. €100k in Berlin goes much further than $100k in Houston (a random big city in the US, I don't think Berlin is comparable to NYC)
This part is really beyond baffling to me. I could understand pre-configured format strings being allowed to do some crazy shit, but I can't for the life of me understand why log4j would opt to allow any logged string to be given access to a powerful lookup/configuration language, even beyond the specific JNDI issue at hand.
Everything stated about the risks and current deficiencies is true. Meanwhile the OP works for Google on OSS, one of the "untenable" approaches to funding it that is lamented. Nothing else presented is close to an alternative solution; there's no "ask" that would fix the situation, let alone an attempt to lead by example, so what's the point of this post?