skysight-inc/HackerNews huggingface dataset:
> Packages are literally remote code exec vulns in the hands of package authors

Something mentioned in this article caught my eye:

> While searching for Marak’s libraries, I found this npm-test-access library. This library seems to be used for what the name describes: to test access to NPM. Marak seems like a very capable software engineer, and it’s unclear to me why he’d need a package like this. So, this make me personally doubt a little bit if Marak is really behind all of this, or if maybe his account got compromised, or if something else it at play.

— [0] https://jworks.io/the-faker-js-saga-continues/

If you wanted to take over other people’s NPM packages by pushing a compromised update to one of your own widely used packages, the first thing it would do is check to see if the victim had access to publish to NPM.

Marek, who has just started publishing malicious updates to his own widely used packages, has just created a package to check for access to NPM.
Comments like this makes me want to quit commenting here. Then I realized that comments like this indeed are the only reason I engage political debate here. Because otherwise Asian people are going to become the scapegoat once everyone believe they have to do something to unleash their unfounded hate over China.
It isn't valid to complain about the code breaking. At least not with any consequences. Because the license explicitly says that the software is provided without warranty.

Likewise, the license explicitly says that the software is provided for free, therefore it isn't valid to complain about people not paying for it.

Nobody's on the side of the big corps here, but "why aren't you paying for this thing that I've given to everyone explicitly for free" seems nonsensical.
And you wouldn't want to broadcast a record of yourself 24/7, would you?

Compartmentalize.
From one perspective it's good to know a published artifact is there no matter what, on the other hand I can imagine I publish some licensed/private code by mistake and probably want to take it down to cover myself - and I wouldn't be able to? Need a 3rd option - Don't know!
Is std::variant forbidden from doing this per standard or is it simply one (or several) implementations that made this choice?
Even if hypnotherapy only brings out incorrect tales if there is improvement in the patients wellness I would view that as a valid treatment, but obviously there are a lot of metrics that are impractical to measure to make valid scientific statements about it. I'm not a hypnotherapist, not do I visit one.
I was thinking of their scoped permissions model described at https://medium.com/deno-tutorial/deno-security-65af9811d9c9

Not sure if you can scope down permissions as part of an module import or if it only works when you initialize the interpreter
You know NPM isn’t the only way to install JavaScript packages, right? You can add a GitHub repository directly. Yanking the NPM package doesn’t protect people who are pulling from GitHub directly.
Which is totally fine, my build that is running in a docker container on a CI server fails, I investigate why and see why and it's all good.

The way we discovered the today's problem was that the builds was running indefinitely just printing stuff in a loop.

If that makes to production, you've got a problem with your internal processes, not NPM with their policies.
Blindly making measurements and taking averages or computing variances is NOT a sensible thing to do! It particularly meaningful for the Gaussian distribution, but there is no reason for sociological data to have such behavior!

The essence of the technical argument is that sample moments (such as the variance or even the mean, for the most extreme cases) are not meaningful quantities for the more heavy-tailed power laws. Therefore, the empirically measured "sample mean" then does not correspond to any meaningful characteristic of the actual distribution.
Mute is self-curation by the author. Whereas Block is the closest thing to moderation for ones' followers. People have different thresholds for both actions.
In the paper more details
I know MS Azure is Aah-zhur, but I hear it called uh-Zhur more often than not.

Don’t even get me started on the fourteen incorrect ways to say Omicron…
Is pinball making a comeback?

Either way…I can see it being real. I can see it being a parody. I can see it being a parody funded by parodists but created by true believers. I can perhaps see it the other way.

All the possibilities are open, just like crypto or something
Institute for Replication
What was the name of the Spanish company that offered a similar idea circa 2010? They had a big community branding and a catchy name – and the focus was on phone calls.
"Don't beat yourself up over or try to force it" is really important when trying do things that takes time to cultivate as a habit where progress seems slow.
> We will also be starting to look at potentially support other devices this month - we’ve always wanted to support more and more devices, stay tuned for updates!

The possibility of expanded device support is encouraging. Pixel devices have always been the most accommodating of alternative Android distros, but as many people have noticed, it's unfortunate that a software project that tries to distance the user from Google services has a dependency on Google hardware.
He was a hypnotherapist and in the FBI at the same time? I didn't think they allowed moonlighting.

You certainly can get memories back this way; the problem is that they'll be fabricated, especially from childhood.

I agree both these kinds of therapy are effective though.
Because in practice the Go solution is the other way around: You can optionally decide to worry about it by turning on the linter that detects this. It's not a very different solution in practice.

I actually kind of like the idea of a minimal language with a robust linting/static analysis community. You can modularly pick what things you want to worry about. The correct answer for the vast bulk of Go programmers is not to worry about this, and the ones who want to, the tools are readily available and already integrated into a tool that anyone writing serious Go code should already be using.
Still there! https://www.zombo.com/
Didn't want to aim at you with the reply, just remembered the collective delusion of 100% coverage unit testing zealots and how this would ironically fail to catch this.

You'd be surprised how far people go to shoot themselves in the foot.
Small Claims Court is absolutely the way to go. You pay some filing fees (usually less than $100) and submit your case. You can pay to serve the corporate secretary, and they will get served. Add the fees you paid for the filing and service to your claim. You will absolutely get all of your money back (minus the value of your time).

I have done this. It works.
Unlike the IEEE.
I think in this particular case it's because many people's first impression of him was as the dad on a cheesy sitcom or as the cheesy host on a family-friendly funny video show. It's not like we had YouTube clips of his edgy stand-up stuff back then, so he kind of got pigeonholed as almost but not quite funny.
I definitely agree with this. I might have dyslexia of some sorts. But my psychaitrist rejects that idea as I could read books easily in the past(when the books contained numbers)...I am medicating for schizoid personality disorder as it seems so idk if that is affecting me..sizodon, proate, and zosert are the medications that I am using currently.
I’d love to hear from the copyright owner (the repo owner). According to github they were contacted and offered legal support. Why didn't they take it or investigate and challenge the notice? I could see how it would be easy to think “welp I help people remove DRM for archival and interoperability purposes and I got a DMCA notice it’s over”. I wonder if the EFF would be interested in lending support.
Some orgs are much more in line with GP’s suggestion. Marketing sites may feel low risk and in my view the iteration speed required justifyies having a trusty stack with known good versions to start from. Personally my method of construction is very conservative and I thrive in B2B SaaS environments, where in Consumer front-end orgs I can be seen as a dinosaur at times. I love new and shiny things as much as the next dev, and enough incidents will hopefully create a more conservative culture of using free lunch-looking stuff more cautiously. Race to the bottom dynamics in a sense, lacking any regulation. The expectation is move fast and break things, I get that, because of the first to market/time is money bias/truth. Inexperienced devs won’t have the scars to push back if there are upstream changes to review while their boss expects the feature updates to be live ASAP. I imagine that with decades regulation will force certain processes—not that I want it more than the next dev who loves shiny stuff and delivering results fast/delighting my boss.
I just crack 'em in half.
> The unreliability of solar and wind plus the state of modern batteries means that nuclear and coal are still better choices for large scale baseload generation.

I'm not convinced that's true. Lithium iron phosphate batteries are pretty good, and as far as I can tell they're expensive outside of China for artificial reasons. (Chinese manufacturers have a deal with the owners of the LFP patents something like: if you don't enforce your patents in China, we won't export our batteries outside of China. The last major patent expires in April I believe, so maybe the situation will change then.) If you could reliably buy LFP batteries in the U.S. for under $100 a kwh, I would expect that to change the economics of grid storage quite a bit. Maybe coal would still be cheaper, but coal has some pretty significant externalities.

It might be possible to do nuclear more cheaply than we've done it in the past, and if so that would be great, but so far it's fairly expensive and we still don't have a good political solution for the problem of what to do with the waste. I'm generally in favor of more nuclear being built, but renewables are a viable alternative if grid storage is cheap enough and/or our power grid is capable of moving power around over long distances efficiently. (There was a story a couple months ago[1] that Chile is planning to export solar power to China via an undersea cable. If they pull it off it would mean China wouldn't need to buffer 12 hours of energy to get through the night because they literally have solar installations on opposite sides of the Earth.)

[1] https://news.ycombinator.com/item?id=29230066
You don't need to touch type, since AR passthrough is available. And a mouse is supported as well (probably the best method of pointer input; hands are too unreliable and tiring for continuous movements). Eye tracking might be a mouse alternative, though.
Calyx's governance vs Graphene is incomparable. Calyx is run by a nonprofit with open books and a helpful, albeit small, community. Graphene is run by a replyguy that speaks harshly about other Android projects. Graphene's technology is interesting as I've been following it since it was the original CopperheadOS. For most users without high threat models Calyx would suffice.
I ran into this two years ago or so and it was massive - because I extracted small values from HTML microdata stored in files and read into strings, from which I extracted those values. The entire file-contents strings remained in memory. I had an array of a thousand small values extracted from a thousand files, for example, I would end up with an array the size of all those files, not of the extracted values. A gigantic difference for my use case.

I ended up writing a hack-string-copy function "substrForceMemCopy" that forced the runtime to allocate a new string by using substr on one less character than I actually wanted and then adding that missing character to force creation of a new string.

Main part of the function:

return s.substr(start, length - 1) + s.charAt(start + length - 1);
Why anti-Muslim apps keep reappearing on GitHub
Homophones are valid words with valid pronunciations and we have a ton of them in English.
Emacs is more like IDEs than it is like vim.
I have been closely following this dispute and can't find a single instance of CalyxOS "shitting on" Graphene. It is always the other way around.
Saying the end users are entitled to those packages because FOSS is FOSS is also a philosophical reason.
I'm not competent to advise people on which countries are "safe" for this purpose, perhaps others know.
If you're thinking about doing this, you should be aware that Hertz is facing multiple lawsuits for falsely accusing customers of auto theft [1].

After finding out about this, I'm personally never going to do business with Hertz ever again. The risks aren't worth it.

[1] https://www.inc.com/minda-zetlin/hertz-customers-stolen-cars...
Norm and Saget
It would never occur to me to consider whether a joke from a standup comic is or isn't sufficiently respectful of a group, is or isn't accepting of something unacceptable.

That's like questioning whether the comedian really did have that conversation with his neighbor at the bus stop he mentioned in the set-up before the punchline.

A standup joke doesn't need to be respectful, it only needs to be funny.
I suppose you can, but in my experience, I think you'll find that people proactively find the dynamic ranges of IPs in eyeball networks and make it very difficult to get mail accepted. If you want to send email from your own server, you will either have to get a 'business/static IP' account or use an IP in a block where you can both control the RDNS and servers are expected to be. i.e. a VPS provider or colo IP range.
Not BUH-zel, as some of us affectionately call it?
> If you propose a new wind farm today, to start construction in 2024 and be online in 2030

And it doesn't take 6 years to build a wind farm!

Hornsea 1 began construction in Jan 2018, started supplying power in Feb 2019, and was completed in December 2020.

Hornsea 2 began construction in 2020, started supplying power last month, and is expected to be fully operational in 2022.

Hornsea 3 was proposed in 2018, to start construction in 2022, and is expected to be completed in 2025.
Facial Recognition as a Pareto Technology
> Aah-zhur

So do you pronounce the "Aah" like the "o" in "otter", or like the "a" in "apple"?

Isn't it fun trying to describe pronunciation with contrived spelling? :-)
I’ve told you who he is. What do you think?
Congrats to cdesai and the rest of the CalyxOS team!
> Why should this one developer collect payment but not everyone else who contributed it?

Exactly, no one said _only_ the lead maintainer should be compensated. _All_ of the labor, not just the labor that happens to have a day job that benefits from it, should be compensated. That includes non-coding labor like support or community management, too.
Putting aside the abysmal support service, I'm guessing the root cause of the missing bank account digit, is due to the last digit being a check-digit.

Some backend system probably interacts with other systems that expect the routing number without the check digit, while others expect it with the check digit.
Antenna gain relative to an isotropic radiator is a thing. Absolute power gain from a passive antenna is not. There is no such term as electronics gain.

I really don't know how to explain this any more clearly; we're probably talking past each other. In engineering, we don't use the M-W dictionary. Things have to be spelled out more precisely, such as (in this case) exactly what the reference is for a given gain figure.

When you see the term 'dB' used in technical writing, it's only a unitless ratio, not a power level, unless explicitly associated with a reference power level. In typical RF discussions, you'll frequently hear 'dBm' or 'dBw' used to describe absolute power levels relative to one milliwatt or one watt, for instance. But the antenna people are more likely to use 'dB' by itself to refer to the gain of one antenna over another, or perhaps 'dBi' to refer to gain over a theoretical isotropic antenna. The latter quantity normally does exceed zero, but only by focusing the existing RF power, not by generating or amplifying it.

A related term is ERP, or effective radiated power. Imagine connecting a 1-watt transmitter to the 70-meter dish at a Deep Space Network tracking station. The ERP will be over ten million watts, but it won't even cook your lunch. It's effective power, expressed relative to what you could deliver to a target antenna with an isotropic radiator. Not actual physical power, in the sense of work divided by time.
The reference, for those understandably not inclined to google/ddg/brave it: https://www.youtube.com/watch?v=rwG3HWubpZI

RIP, Bob
I don't know what happened in this particular case, but cocaine use can cause hidden cardiac damage. Heart attacks in relatively young people often have prior cocaine use as a contributing factor.
somewhere underneath all of this vulgarity, i see your point and it's quite interesting. really wonder whether the whole "block" attitude is actually detrimental. never really thought about it that way, and have always imagined it is the only way to "be" on the internet. but maybe something better exists, but nobody imaginative or powerful enough has yet uncovered it. thanks for your POV.
Seattle (and the rest of western washington) was mostly cut off from eastern washington by road starting late wednesday until a few hours ago today due to a massive amount of snow, closing the mountain passes. I-5 was closed a bit due to flooding as well. Rail through the mountains was also affected, but I don't know timelines.

A lot of goods move the other way (imports come into the western ports and are trucked east), but some goods do come from the eastern part of the state and country.

Staffing is probably also a factor.
Now we should start spelling it "Buzzle"!

But then it wouldn't be an anagram for "Blaze" any more. (That's Google's internal build system that Bazel is derived from.)
https://bugs.chromium.org/p/v8/issues/detail?id=2869

"Issue 2869: Substring of huge string retains huge string in memory"

Status: Assigned (Open)

Reported 2013
Fantasy authors have been routinely finding themselves banned from Amazon and their royalties confiscated. They tend to only get reinstated if they have enough social media clout that there is enough noise, eventually someone from Amazon notices, and just as mysteriously they are unbanned...and in many cases, they never get their payments back.

Never ceases to amaze me the level to which the world's richest man apparently feels it necessary to stoop.
You're new so I won't hold it against you. Aaron Swartz would have 100% approved of this.
Nobody can break into the dev box and steal the key while you're away on vacation for two weeks.
Mecum & Barrett Jackson are neat to attend, but between the rotating locations and variability in inventory plus the buy/sell fees, BAT is obviously way more favorable for buyers and sellers. BAT provides the same provenance and documentation that you get with the legacy houses, but in a much easier to use interface. You can just hit the /auctions page and start scrolling all types of enthusiast vehicles, opting to register only if you want to bid. They provide 24/7/365 opportunities to bid, versus waiting 2-3 months for an auction to bid, even then you need to jump through hoops and be available during the <5 minute auction window. Plus the social element where anyone can comment on auctions is better than the comment sections on many car sites.

BAT started with a lot of traction on Jalopnik and has since grown to be way more upmarket. How (or can?) can a similar model be applied to other markets such as horse yearling sales-- typically dominated by Keeneland/OBS which hold a few sales per year?
Interesting, Comcast is blocking this site.

Nice site - I feel like it doesn't good a job at teaching these just validating, which is fine just the name is kinda misleading.
How there can be more than two ways to spell words that sound like “to” is just too much. When people do that, I wonder if they’re messing with me or if their minds have fallen prey to a language of many sources. I pray that we will one day have eliminated all of the homophones. Then we will have truly won. Eye think ewe agree…
yes, a VPS would absolutely be cheaper. Even if you get the port unblocked, you're still not going to be able to set reverse DNS for spf records unless you have a business connection with static IPs. An IP alone will probably cost you the same as a VPS that will run a tunnel back you your home box.

In my experience, a business connection is usually twice the price and half the bandwidth.
>2. You can't tell anyone how to circumvent DRM, regardless of purpose. This is the sort of violation being alleged here.

I'm curious: why would this be the case? This is a restriction of speech that doesn't contain copyrighted content enacted by a copyright law. This seems like charging someone, by using an anti-burglary law, because they taught someone else how to pick a lock .
> Honestly we even have the technology to do it now just limited will if things ever get real bad that would change very quickly.

COVID tells me that’s highly unlikely. We literally have a movement rejecting known-to-save-lives technology for non-scientific reasons. If things get real bad people will dig deeper to try to protect their own lifestyle right now, even if that means screwing things up 10 years from now.

And enough of those people have enough wealth and power to effectively counter even movements supported by the majority of humanity.
Mirror of the latest master from 29. Dec 2021:

https://workupload.com/file/DzgMhFtcxdj

https://www15.zippyshare.com/v/pRAuHpYQ/file.html

https://mirrorace.org/m/14t3h
you don't need to go to shitter... it's right there in the article (that you and OP read... right?? lol...)
"I'm sorry to hear that. What's worrying you the most at the moment with relation to the health issues?"

The usual- costs, coverage, quality of life.

Are you sure nobody will cover it pre-existing? I saw Cigna has an international plan that might. It's likely the premiums will be very large. Maybe medical tourism could help with costs, like in Thailand.

On a side note, maybe it's possible to manufacture the drug yourself? I mean, what will the company do - sue someone who's already broke from paying for the meds?

I guess the other option is to find a different job, with a local company, that will provide insurance.
>they say having a shit job with a shit boss is a shitty situation they should not have to put up with. And, frankly, that seems reasonable.

The sidebar literally advocates for abolition of work.
My freelancing story:

Worked in digital agencies. Met a lot of contacts. Started taking on side projects. Produced good work. Kept on getting referrals. Quit my full time job and freelanced for 5+ years. Wasn’t always easy but I kept my costs low and steadily increased my rates.

Easiest way to start? Freelance for an agency or a consultancy. They always need someone, like right now, to work on a project.
actually I am decent at learning from videos. Problem occurs when there are no videos to learn. I sometimes wonder how will I learn after college?
> (I’m a fan, but I don’t think he did a ton of proofreading on this.)

I suspect you (and parent) may have misunderstood him. IMO, he meant a pandemic (like COVID-19) - just like WWII - was predicted by a lot of people. What people could not predict (for both scenarios) was when it would happen.
That sounds about right.

For the average Australian user, it means you add ~ $200-350 / year to your effective ISP cost. Not end of world for most, but certainly not trivial for all, either.

The regrettable history of Australian internet provisioning (specifically our national broadband network) and electricity pricing (specifically the rorts and corruption, and higher-than-rest-of-world pricing) are described much more eloquently by others.
How is this legal? They're using trademarks out to wazoo to make money?