skysight-inc/HackerNews huggingface dataset:
Simply using a modern JDK does not fully resolve the issue. See here: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
Wasn't there some YC company that was trying to act as a sales agent/middle-entity for this kind of situation? If not YC, they at least were on HN at one point.

Curious if anyone knows.
Yes the data bits were 2-way toggles, but one important switch was a 3-way toggle: the Examine (press down) and Deposit (press up) switch.
> How much do you use open source, as a developer and as a user

As a user I agree, things would probably be more expensive if nothing was open source. But as a developer, I disagree, my employer would simply need to pay for the stuff I use, or they'd pay me or another developer to build them one. And this is precisely what the article argues, that companies should pay for it. If there wasn't any open source logging library, the maintainer could either work for a company that offers a paid one, start his own company, or work for a company that pays him to maintain one for them.
I have a brain injury [video]
...By adding thousands of libs, turning node_modules into a multi GB folder. Oh, and each of which can be compromised by an unscrupulous actor.

Good luck auditing that.
I’d like to read this but the number of ads navigating the blog on mobile is a horrible UX :(
I agree. And it balances out the survivorship bias of “I always get a lawyer.”

I’m not sure of a good way to balance out and correct for my bias other than just trying to think critically for when I need and don’t need a lawyer.
As a UK resident, reading Anson Mills description of their rice products and how they taste, and what you can do with them is really quite bewildering - 'They can also be prepared in the creamy grits style and all the way to congee, if pressed, or as crisp skillet cakes, both savory and sweet.'

I cook with a range of rices depending on what i'm doing - Arbori, Carnaroli, Basmati and Bomba, but rarely with what I consider an american long grain.

I'll try and track down some of this Carolina Gold and see what I can do with it. Any suggestions for a recipe that shows it off (not knowing what a skillet cake is, for example)?
1 MWh roughly costs 150$ for nuclear, about 50$ for wind/solar.
You're telling me that the magical solution to all our energy problem using solar and wind energy only would be to overbuild THREE times solar and wind infrastructures, for a cost of 3*50=150$/MWh, which is essentially the same as if we were to use nuclear instead.

PLUS 3 hours battery scattered everywhere in the country (to be renewed every few years).

PLUS a full continental electricity grid (basically admitting that not every country can be sovereign of their own energy).

Was this post supposed to make solar and wind look good?
I don't know enough orbital mechanics to understand the feasibility, but it's fun to consider that putting a shade over some of the hotter cities of the world - Phoenix for example, could have a big effect by reducing the need for air conditioning.
No. If my life is on the line, I'm not going to use anything that gives my attacker a fair chance. The e-shotgun looks stupid fun, though, and I'll probably get one for shits and giggles.
The real solution is to throw out all the crap at the top of the stack, get down to simpler and simpler code that can be maintained by the people autonomously without corporate involvement.

E.g., Gemini.
Show HN: Optuna Your Model Hyperparameters
Log4j maintainers didn't like the feature, they added it for backwards compatibility.

> Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
To cut costs companies typically make teabags out of polypropylene plastic instead of paper or alternatives. The problem is not a lack of alternatives but that people aren’t aware (or don’t care) that they are made of plastic. I mean, it looks like paper. It’s a good thing that they are using this seaweed but it’s not a “solved problem” until the negative PR cost to these companies is higher that the cost of using non plastic alternatives. I just don’t understand why more companies are not using this in their marketing campaigns. … It’s almost as if there there really is no competition at all. It’s almost as if most brands are owned by the same company. Unilever ;)
It turns out Paul Graham didn’t say that.
Show HN: Shoelace – A forward-thinking library of web components
Semiconductor History Time Line
Everything from 3 blue 1 brown: https://www.youtube.com/c/3blue1brown

Visualization of Quantum Physics (Quantum Mechanics): https://youtu.be/p7bzE1E5PMY

history of the entire world, i guess: https://www.youtube.com/watch?v=xuCn8ux2gbs

TIMELAPSE OF THE FUTURE: A Journey to the End of Time (4K): https://youtu.be/uD4izuDMUQA

Humanity was born way ahead of its time. The reason is grabby aliens. and Grabby aliens: when we'll meet them, how big they are, and other predictions

https://youtu.be/l3whaviTqqg

https://youtu.be/LceY7nhi6j4

Everyday Astronaut videos (he has 90 min documentary on Soviet rocket engine): https://www.youtube.com/channel/UC6uKrU_WqJ1R2HMTY3LIx5Q

Cool Worlds - a lot of 25-35 min very nice astronomy explanations: https://www.youtube.com/c/CoolWorldsLab

'A Universe From Nothing' by Lawrence Krauss: https://www.youtube.com/watch?v=7ImvlS8PLIo
It’s not the licensing, it’s the amount of incompatibilities JDK 9 introduced.

Also, current JDK versions are still vulnerable: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
I found my people!
> We all opted for centralized package repos though, so now only they know. And they’re not telling us.

I'm sympathetic to the view, but there really are some things that are better centralizing. Reducing code into binaries is something that a "fair" 3rd party is going to be better at than the 1st party. Why? The 3rd party central source is (presumably) mechanically cloning and building, whereas the 1st party is doing much much more. Effectively the 3rd party offers a better guarantee to the end user that this binary corresponds to that particular source.

Also, the Way to measure who's using your code is to put runtime telemetry in there. Distasteful, but so common now with every kind of software, it's crazy. Yes, even OSS CLI programs phone home now (heck, ohmyzsh phones home every time I open a terminal!). For a generic server library, you'd add a check to make sure it's the most recent version and print that out to stdout on startup.

See, it's not user hostile it's to keep them informed of updates! /s
I knew you're deliberately exaggerating but isn't it a little bit over the top?

That ("...private jets..") doesn't happen because the solution isn't exactly the hard part, and the unpaid original maintainers are doing them anyway.
An incremental way to get to this would be to standardize the format for payment info in package.json (or equivalent). Then you could build donation into yarn, pip, cargo, etc. Just run ‘yarn donate’ and choose the amount to spread over the packages you use.

This is a half-baked idea right now, but I think there’s something to it. A lot of the issues with open source stem from the friction of donating. Reducing that would incentivize people to work on libraries that are popular but neglected. It would also help devs capture some of the value they create.
> In-house development

... keeps resulting in shit code, too! There's no evidence standards of quality are rising. In my own extremely limited view of in-house software -- i.e. my own professional experience -- code quality is crap, standard quality practices are very low and actually worse than in FOSS projects (I've seen someone mention more than once that "this crap PR simply wouldn't fly if this were an open source project, it's so bad nobody would want to review it!"), absolutely dumb bugs keep hitting production, and people think of automated testing as "that thing we don't want to do".

In-house code is just code you don't know is garbage because you cannot look at the code.
Landau's treatment in the first volume is the only thing I have read that made me weak in the knees. I sat down and I shed tears. Literally.
Decapitation in Rats: Latency to Unconsciousness and the ‘Wave of Death’ (2011)
Thanks for the followup answers.

I also use vi (no syntax/color highlighting, no plugins, original vi commands only.)

I think you should talk to some other developers and see what's going on with your ability to focus. (I'm one of the top application developers in a particular language and can actually think in that language, so that level of familiarity helps me.)
It is apparently swimming in money
https://www.dailydot.com/debug/wikipedia-endownemnt-fundrais...
This is a problem in open source: everybody wants the fruits of labor without paying for it. The log4j vulnerability is what happens when you don't pay for it.
It happened a couple times.

https://news.ycombinator.com/item?id=29523431
Is this really reasible to scale for a company without their own launch platform though?

As a Canadian living in a "rural" area, 15km from a municipality of 160,000 people with no access to wired broadband internet, I'd rather see whatever funding gets thrown at this startup into actually developing Canadian terrestrial infrastructure.

As a rant, in the 8 years since living here, I've seen cellular data prices double. Yes, double.
I like the idea of sampling the other side of your API in a stochastic manner. That concept seems widely applicable.
Powerful words. That's a lyric from Sole's "Selling Live Water" which is shown in the article as an example of a locked groove.
I mean just ordinary employees really wouldn't get paid at all if not for labor regulations.

Just look into the amount of simple "wage theft" (employers forcing employees to work off the clock, etc.) that exists in the USA.

Of course, this country fought a war over the issue of free labor from black slaves.
>It's a lot easier to upload some zip files to JLCPCB, have them assemble it and then sell them on eBay for 4x the cost than it is to do the initial design.

but the author of BlueSCSI didnt do that initial design

"BlueSCSI created by erichelgeson is a fork of ArdSCSino-stm32" https://github.com/erichelgeson/BlueSCSI
If you are comparing the top engineering shops to open source, you should also pick the top (quality) open source projects. Apples to apples.

Most in-house code is crap.
Are you seriously arguing that you don’t think input validation is required for untrusted input?

There’s a myriad of security vulnerabilities based off failing to escape special characters. Use output encoding if you need usernames to have special chars. There’s really no excuse to not sanitize input it’s a basic security principle.
Libraries still pay for each copy of a book, and in some countries royalties are paid out each time the book is borrowed. The library is not allowed to make additional copies of a book and borrow them either. Public education pays its teachers.

But overall I'm not in disagreement with you, you could say open source is done as part of the greater good and advancement of technology and computer science, and not for personal capital gain. That also means that it isn't meant to be a sustainable career path, or job that you can do full time though.
That's right. It is open source and, when it breaks, you get to keep both pieces.
Sometimes it's not about the literal text, but the meaningnis accurate.

In this case, Sagan did say 'billions' a lot. And he also tried to emphasize the scale of the universe (something the general public has difficulty grasping). It might be a misquote in the literal sense, but the meaning is actually quite accurate, and I don't think Sagan should be upset. 'Billions and billions' is a good shorthand for that.

Sometimes you have to modify a quote a bit to give it context. Just saying 'Im your father' is a bit too generic. But 'Luke, I am your father' lets the listener know we are talking about Star Wars. Same with the 'Beam me up, Scotty'.

I have no idea if this applies to Mr Graham, but just needed to put my useless opinion out.
There might be a good framework that I'm not aware of, I think you have a good question.

But some of it is probably not learning and setting up frameworks for stuff until a problem has become a bottleneck. Ask your customers (consumers or other business unit) what is needed right now and enable the scale that works in the short term. Don't just schedule programming time, management time, daily standup time, weekly meeting time, in your calendar and try to fill that up to look socially acceptable. The solution should follow the problem. It seems that often people forget that. After a while of using business frameworks, sometimes the frameworks prevent the problems from getting resolved rather than enable them. Maybe huge companies can't afford any downtime if the traffic spike is 500%+, but smaller companies are often changing and need some flexibility.
> - receiving donations wouldn't be fair to any current or past contributors that made the projects what it is

Hard disagree on that. Maintaining (bug triage, pull requests review, bug fixes…) is actually the hard work and the part that deserve the reward IMO.

When I contribute to an open source software to fix a bug/add a feature, my reward is that the software I use has an annoying bug gone/the feature I want. I don’t need any reward. On the other hand, the thankless maintainer deserve it.
It would certainly help if the IRS did something to encourage open source. You can donate a work of art to a museum for a deduction but you can't donate 20 hours of labor. The IRS is deliberately becoming more strict [1] so many current non-profit software foundations e.g. Apache are actually the exception to the rule.
> It essentially talks about a services and support business around open source.

Which is _exactly_ what we are doing...
If the R is expressed in tons of carbon per dollar over 10-30 year spans it is a climate issue - especially because governments and businesses are already loathe to spend on climate action.
I admit to a certain level of exaggeration but, at the same time, we are talking literal peanuts to a large company. They could spend a million dollars and it'd be a rounding error on their balance sheet.

In all seriousness, taking actions like I identified above would cost the companies virtually nothing but result in huge long-term benefits by signaling to the rest of the open source world that "we love your work and will be right beside you helping if the chips are down."

This is, of course, not a suitable compensation model for popular open source projects. Thats a separate conversation.

But it would at least be something.
Empty dishwasher or hang laundry when stuck on technical problem. Answer often comes far quicker this way. ;)
Free Dictionary API
Talking about capitalism is fun, but people still have to pay to keep their homes warm in the winter, and be paid to build and maintain these things.
>Now just subscribe all of the non-tech business people at organizations

Ah, if only one could "just" get a mass of people's attention and send the message
No advertisements randomly inserted in the middle of a piece of music!
This project is AMAZING. Earlier this week I had the exact same idea of a project while disentangling a bowl of spagetthi code. I'm glad I've seen it here today so I didn't have to reinvent the wheel. Also, I'm impressed by the quality of the documentation. It's pure eyecandy. Kudos!
Related [1] [2]: the Han race was really only constructed in the last 100 years, along with the national mythos of several millennia of uninterrupted dynastic civilization.

[1] https://www.hrichina.org/en/content/4573

[2] https://www.youtube.com/watch?v=vhFPZL2L8uM
Actually, the full name is Eclipse Adoptium Temurin now. O_o
>> Given this situation, why will they pay for what they can get for free?

> If everybody consumes and nobody contributes, how long will that last?

That doesn't answer the GP question, which is all about incentives.

The answer is, at least some parties won't pay for what they can get for free. So the options are:

a) deal with it

b) require payment

c) come up with some way to incentivize more donations
Japan’s Nintendo game console pioneer Masayuki Uemura dies at 78
That's a good point. We as developers trying to make a living doing it are competing with an ever-expanding sea of OSS. And therefore we'd be mad to contribute to it, for free even.

On the other hand, from the viewpoint of all of humanity, it is great that there exists a huge amount of software that is useable by everyone for free.
> Equating (per unit weight)

You don't need to equate it per unit weight for GP's point to be relevant: there are several orders of magnitude less fission waste than waste from PV or Wind. The entire volume of the dangerous wastes produced by the French nuclear park during its whole life (40 years) can fit in an Olympic swimming pool! (3 200m³).

Of course there are other wastes (up to 4 million cubic meters by the French definition of a nuclear waste, which includes every piece of gravel from a nuclear plant: the walls of my wife's office will one day be considered as “Nuclear waste” by the French authority), but the most dangerous of those isn't specific to nuclear: it's asbestos!
- (any language you like) -> (js/web asm) compilers that are really good (emscripten); the real realization of write once run anywhere?

- better api surfaces: e.g.

- web gpu (or wgpu written in rust) for browser games of gpgpu, or

- web usb, allowing for browser based access to e.g. a software defined radio receiver, so you could e.g. send someone a url, make a p2p session, and do remote radio rx/tx for anything you like

- more consistency across browser vendors, for good or bad (see manifest v3)

- more demand-time invoked, one-off compute instances per user, and for cheap or free - see gitpod, vscodeweb

- more synchronization protocols for connecting remote computers together:

- - it would be so easy for somebody to come up with e.g. a BOINC/SETI/F@H-like volunteer compute library all in the browser by using Jax (XLA + free parallelism) -> compiled to webasm + some kinda (isomorphic to a) monoid homomorphism/distributed computation/work queue scheme to just point a bunch of people's computers to a page to do collaborative compute by just sharing a URL
So it’s not possible to interface with Metal or the Accelerate framework on macOS using pure C? I’ve found some outdated C wrappers for metal but nothing up to date, and wondered if something in the later versions assumed Swift or Objective C library consumption…
The main idea is to cultivate bacteria instead of plants, but if they say it in this way it doesn't look so futuristic.

The problem are:

* How big should be the device to keep the bacterias inside. They grow, but no infinitely fast. For plants in 2D you need like a 100mx100m (300ftx300tf) to survive [1]. Yo can try to stack them in 3D. Using a few shelves I guess you can multiply the efficiency of the surface x10, and be optimistic and assume bacteria are 10x more efficient than plants. So you need a 10mx10m (30ftx30ft) room to cultivate your bacterias. That's like 9 normal rooms in a home, much bigger than a replicator in Star Trek.

* You must keep the house-sized bacteria block with only good bacteria, and keep all the bad bacteria away. Specially if you try something more advanced as discussed in the article to use genetically engineered bacterias to get food that does not taste horrible. It is possible, but you must be very cautious every time you open it.

* Plants come with their self building solar panel. So you save a lot of construction. Cultivating bacteria need a lot of energy, so yo must cover the farm surface with soar panels, or wind turbines, a nuclear power plant or burn enough oil.

[1] https://homesteading.com/subsistence-farming/
There's a whole old elephant in the room, but we're not really talking about it because it's an elephant everyone loves to hate. And yet.

This is a model that MPAA and RIAA use. And their equivalents in countries that have functional copyright legislation. Most first world countries have one. Don't get me wrong, they are mostly rent-seeking racketeers, but if you try to weasel out of paying for stuff you're using for your own profit, you're bound to get one.

Either some law pertaining to maintenance of "digital commonwealth" or some other nice name is passed in enough countries so other countries have to follow suit if they want to be in good company, and organizations with teeth, one per country, are set up to make sure the "digital commonwealth" tax is collected from everyone, big and small. They will even distribute money among creators, by usage or something.

Microsoft would probably love to be such an arbiter. They have Github. They have all the stats. They know if your company had been naughty or nice, how many times they downloaded your stuff, and how many times their employees were demanding shit in issues. It's child's game to join the party, just have an account with them.

Or we just piggyback on the existing copyright legislation and give RIAA and their likes more power and custody of making sure OSS maintainers don't starve. They will surely protect their interest with eagerness, who wouldn't like more profit?

Of course, companies will try to fight tooth and claw. They will tell you all sorts of doomsday scenarios, how the poor megacorporations won't be able to afford it, how they will have to raise your subscription fees. Gee, haven't we seen those crocodile tears when free roaming in EU was going to be established? We also know how it ended: they all sucked it up, complied, maybe their profits took... well... not a hit, but a nudge maybe. Companies who have to buy music know how to pay the music tax to copyright racketeers. They will get used to that.

They will also be happy to pay just one entity and be done with it. And if you dare start a company using F/OSS, you're in for the largest financial hit. The little man always suffers the most in such schemes.
We benefit far more than we can repay, but "stealing" is too strong. It's what the author who adopted an open source license explicitly intended to allow.
What infrastructure would you like to see? Running high bandwidth cable in rural areas is expensive.
Apple Watch users' vein sliced when 'swelling battery' shattered the display
>and both wind and solar installed capacity is growing at a nearly logarithmic scale.

Boy, that sure sounds promising
I did not look up any documentation to verify this but since I did override all allocation functions I could keep statistics of how many calls I was getting for each function, and when I commented out the glBufferSubData calls I could see my stats drop. The contribution was somewhere around 300 calls/s I think... this is with the panfrost driver with gallium/mesa on an ARM platform. My plan is to use persistent buffers which are memory mapped once. Hopefully that will get rid of these allocation calls.