skysight-inc/HackerNews huggingface dataset:
Recent and related:

Important NPM package colors from Marak causing console problems at the moment - https://news.ycombinator.com/item?id=29861560 - Jan 2022 (1 comment)

Creator of faker.js pushed an update of colors.js which has an infinite loop - https://news.ycombinator.com/item?id=29855397 - Jan 2022 (1 comment)

Marak adds infinite loop test to popular colors.js - https://news.ycombinator.com/item?id=29851065 - Jan 2022 (7 comments)

Marak's GitHub account suspended after he erased his faker project - https://news.ycombinator.com/item?id=29837473 - Jan 2022 (53 comments)

Faker.js Erased by Author - https://news.ycombinator.com/item?id=29822551 - Jan 2022 (2 comments)

Popular JavaScript package “Faker” replaced with message about Aaron Schwartz - https://news.ycombinator.com/item?id=29816532 - Jan 2022 (3 comments)

Faker.js Has Been Deleted - https://news.ycombinator.com/item?id=29806328 - Jan 2022 (9 comments)
That site only got a couple wrong.
Why did Putin need to act in Kazakhstan? Honest question, I really don't know of any background prior to the recent events.
Yeah, this is the difference.

Drug dealers are an annoyance but they aren't a direct threat to any government (as long as you let them be in peace). If it's a direct threat to you, then you do anything, even if the benefits outweigh the risks.
I am skeptical of people that "meditate the ego away", for reasons highlighted in this article https://slatestarcodex.com/2019/10/21/the-pnse-paper/, which confirms the experiences I had with such people. While their mental landscape may be totally different, they usually haven't changed much as a person.
It is indeed all, even if you ignore the "popular" qualifier. If a license could be unilaterally revoked, it would fail to meet the Open Source Definition for that reason.
Reminds me of cjdns

https://github.com/cjdelisle/cjdns
> Why wouldn't everyone roll their own solution?

JS devs will do anything to avoid this.
> you don't really have a moral or tactical position other than "shut up and code."

I don't believe that. People commenting negatively on some Linux software/trend do not need any such privilege or permission or show of stake. I think anybody with Linux experience is entitled to his/her opinion on what should and should not be done on their Linux machine and in the Linux software space, whether they produce new code or not.
This is not the way.

Github doesn't have the right to tell someone what to do with their own code. The only right thing to do in this situation is to fork the repositories and fix the situation on the npm side. Github doesn't get to ban this guy because he took a dump in his own backyard.

EDIT: I suppose the literal DoS attack in the code probably puts him squarely in the "malicious behaviour" category which then gives github the right to do this.
Yikes, it's one thing to stop development of somethign but another to intentionally do damage to thousands of people, big companies and small one person webdev shops alike. This guy probably can't be sued because of opensource, but he should be shunned in the future by open source advocates and just the public in general. Why would anyone hire him unless it's to run an antifa/right-wing website?
Some people find this too rough, but the reality is: do not license something as MIT or any free license if you are not happy with commercial users benefiting from your work.

Simple as that. None of them are under any obligation to pay, maintain, promote, or not clone your project.
I have tried several times to relearn typing, but each time I've fallen back to my old ways. Has anyone actually been successful in learning how to type correctly from scratch? If so, how did you do it?
Control your dependencies, don't make them control you.

Pin dependendency versions, don't allow auto-upgrade. And cache your dependencies locally for as long as you depend on them.
Some cities in Europe are already banning old petrol and diesel cars from driving through them. With plans to ban more over time.
Google Messages and every other default messaging app on phones falls back to SMS when RCS isn't available for the recipient. Google hasn't made their E2EE extensions available outside their app. Where's your "there's no excuse" outrage?

You're trying to excoriate Apple for not supporting an extremely poorly implemented "standard" (RCS) or investing tons of money fighting with carriers and partners trying to create some new "standard". It's absurd.

If Apple tried to support the RCS clusterfuck that would be a third protocol supported in their Messages app. Even if it was some new standard hammered out with Google and carriers there would still be an SMS/MMS fallback for the literal billions of handsets that won't support whatever new standard.
The alternative behaviour seems undesirable too right? If you attempted to delete foo.txt in the merged filesystem and instead of deleting the file, it just replaced the contents (with b)

I think the behaviour makes sense. Otherwise deleting a shadowed file either requires extra state (to track whether to show the shadowed file after a deletion), or loses some of the implicit assumptions people make for filesystems (after I successfully rm, the file is gone).
Sweden exists. They never locked down. The Hong Kong flu of the 1950s[1] happened. It was a really bad flu season. Many, many old, very young and sick people died. Civilization was never in danger from COVID. Civilization survived smallpox. The Inca civilization came very close to surviving getting the entire old world disease package and being invaded by people with horses, iron weapons and gunpowder all in the space of a hundred years.

Civilization can survive an awful lot of people dying and even if COVID had a 2% fatality rate it would roll on more or less without a blip. The Spanish flu didn't lead to the fall of civilization anywhere and it killed a lot more people in the prime of their life. COVID deaths are highly concrentrated in the over 50s.

[1]https://en.wikipedia.org/wiki/Hong_Kong_flu
I did the "heathkit" version of programming: Typing in basic code for a version of lunar lander on a TRS-80 on the sale floor of my local Radio Shack.

Later I learned to write my own kits. And sometime after that, I got others to pay me for the pleasure - Winning!
You're never going to be able to prevent that at a technical level. You can prevent it with workflow, though: 1) sync packages locally and build from those versions; 2) peg to a specific version and don't auto-update; 3) deploy to a test environment and not directly to production.
There was an F-15 that had a mid-air collision, the entire wing ripped off, and it managed to safely land.

https://taskandpurpose.com/history/1983-negev-mid-air-collis...
People got sufficiently tired of deadly smallpox outbreaks to mount vaccination campaigns, eventually we managed to vaccinate enough of the globe to make the virus extinct.
I'm aware, this is through the isp to endpoint destinations, not pinging intermediate hops in the starlink cgnat path to internet.
well yes - didn't they defund in portland, austin, NY and others?
I would also include the restorative justice DA's as a form of defunding the prison-industrial-complex.. which have been coming up all over.
Isn't one of the effects that more criminals are doing more brazen things knowing that they can get away with more?

I'm not saying it's good or bad. I'm just pointing out that the sentiment of defunding police has certainly happened in many places in the US from what I've seen in the news.

I myself don't think the main problem is the police, the main problem is 'the rent is too damn high' - and I mean the sentiment, it's not just the rent - average (non-college-degree) wages do not provide a basic self sufficient lifestyle in most places in the US - so crime is up. imho.
If that is true it's an outrageous overreaction by GH.

Are they now gatekeeping the kinds of code changes you can make to your own repo?
You’re free to update as you like. It’s entirely possible to audit your local packages.

Letting maintainers update your projects is a convenient feature. If it is a liability in your use case you can work around it. Yes it will take more effort, but your use case justifies it.
> You can travel the globe, and your IP will follow you: onto a plane, from continent to continent, wherever. Yggdrasil will find you.

Is there a privacy option?
Fortunately the problem could become more tractable if something like SES / Endo takes off:

"Endo protects program integrity both in-process and in distributed systems. SES protects local integrity, defending an application against supply chain attacks: hacks that enter through upgrades to third-party dependencies. Endo does this by encouraging the Principle of Least Authority. ... Endo uses LavaMoat to automatically generate reviewable policies that determine what capabilities will be distributed to third party dependencies."

https://github.com/endojs/endo
From my post:

> Even self-signing the apps has macOS treating them as if they're radioactive.
Yes, probably but it'd be nice to know. Even the start of the rendering though seems to have some gas being ejected that I was curious about ("Is that the start of the process at 1 year out?"). I dunno, maybe an improved caption would be enough.
Rollback what? You can't rollback someone else's dependencies.
This is scary, and I don’t know why people here aren’t losing their minds.

I think someone should make a big deal about this. What would be the first step?

On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they thought it was hacked, which is almost reasonable.
Capital powers said the same thing about the Soviet Union during early days of the American labor movement. American workers are getting fucked over, it's an abomination and a disgrace, and people are rightly angry about it.
0.25% of the US has already died of COVID-19. It doesn't matter who said it, how can 0.02% be a reasonable estimate for the IFR of the disease?
> Who are you to decide what is useful/legitimate or not?

Common sense.
That seems fine. I don't see any problem here. You can also put those caveats with public talks.
Can fungii replace meat?
Nice. Do you know how to tell him to put the link of the translation below the essay?
Regardless of who is right or wrong, this situation convinces me that using Upwork does not seem like a good idea. I had already been put off by their spyware, but this kind of situation should never have escalated like this if Upwork actually valued its freelancers. Clearly, they value the people that write the checks more than those who cash them, so why would I ever trust them to represent my interests? They will resolve any conflict of interest in favor of their own profits.
ratatype was nice UX
I can tell you're not a chess or baduk player.
That's not true.

The first line of NPM install's documentation[0] says(emphasis mine):

> This command installs a package, and any packages that it depends on. If the package has a *package-lock or shrinkwrap file, the installation of dependencies will be driven by that*, with an npm-shrinkwrap.json taking precedence if both files exist. See package-lock.json and npm shrinkwrap.

What does happen is: if you have added a new package in package.json it will be installed based on the semver pattern specified there, or if you run npm install some-package@^x.y.z the same thing happens. Further, if you modify package.json by changing the semver pattern for an existing package that will also cause this behaviour.

Running `npm install` in a package that already has a package-lock.json will simply install what's in package-lock.json. `npm install` only changes the lock file to add/remove/update dependencies when it detects that package.json and package-lock.json disagrees about the specified dependenices and their semver patterns e.g. having foo@^2.3.1 in package.json and foo@1.8.3 in package-lock.json will cause foo to be update when running `npm install`.

0: https://docs.npmjs.com/cli/v6/commands/npm-install
Thanks!

I've changed the title (from "Charles Mingus Cat Toilet Training Program").
You are technically correct. The best kind of correct! In practical terms, it depends on the license used. Since most licenses used in open source will prevent you from making these kind of requests, this consequence isn't likely to have any practical implications.
> I don't think you can make a DMCA request on behalf of a copyright holder without their permission

Tell that you Youtube's copyright trolls
You need to start seeing yourself as a survivor of all this even if you're not over it yet. I was bummed the fuck out when I got covid but the truth is made it out ok and circa 50 million people didn't, that's a memento mori if there is one.
I assume every story on Reddit is fiction, r/legaladvice and r/relationship_advice posts are as likely to be real in my estimation as r/nosleep (creepypasta) stories.
you mean roll back package-json.lock or package.json? yeah, but thats not really what i want. maybe my process is crazy here, but this is how i update dependencies:

on a somewhat regular basis, as time allows, i run npm update to bring all my dependencies to the lastest version. then i test (including thorough manual testing / qa), commit, and release with updated dependencies. if some update is broken and i don't have time to fix it then yeah, i can roll back. but the point is to be on relatively up-to-date version of as much as possible, so if something is broken then it turns into a game of trying to figure out which library it was that broke things. i don't want to just not update any dependencies because something is broken.
I saw it more as Epstein's island, but on the blockchain.
Unfortunately, what you see as "renaissance" is in fact the last battle of RSS.

New webpages rarely bother implementing a feed; old ones, when getting new iterations, often drop support too.

I've seen too many blogs without a feed...

It's a miracle YT still has them!
Modern society functions by virtue of a century of businesses cutting margins as thin as possible, trading supply chain fragility for lower labour and capital costs. We're already seeing wild economic issues from a much lower fatality rate disease and the labour shortages/supply chain blockages/etc it has caused. It's very easy to imagine a 30% fatality rate pandemic causing total worldwide economic collapse, causing famine, causing nuclear war, causing photosynthesis to fail, causing a mass extinction exceeding the P-T event. Whether human populations survived is (to be honest), a kind of irrelevant nitpick.

The species as a whole was much more robust when large fractions of the population were engaged in subsistence farming and we hadn't disbalanced the atmosphere and doomsday weapons didn't exist.

Edit: minor grammar correction
I do think people would be served, generally, by being more aware of the fact that distros are not some doing some hardcore security vetting. But the alternative is just to use whatever was pushed up to NPM, right? In that case, Debian packager+NPM push > NPM push by definition, unless the Debian packager somehow provides negative QA, which seems unlikely. (Also, on the incredibly unlikely offchance that some Debian packager reads this comment -- your work is incredibly useful and I very much appreciate it, just trying to be realistic about what exactly is provided by your group!)
>Nowadays, running a website from home is just about impossible. You may not have a public IP, and if you do, it likely changes from time to time. And even then, your ISP probably blocks you from running servers on it.

I'm not sure about the author's country / ISP, but here in Midwest USA, our residential ISPs (cable or DSL, fiber if you are lucky) generally do not change IPs frequently (unless your router/modem is restarted), and generally only block port 25 (SMTP). I've been running a web/ssh server from home in some form or another since 2002, originally with DynDNS to paper over the IP changes.
I was going to mention Comic Sans but decided it wasn't necessary in context.

For many things, I'm a Palatino Person, but I am aware that it is aging poorly. I also love the european public display use of Helvetica, and for novels and other continuous text flow, I'm a cheap date, anything will do.
We have the trail, but it ends with EA, which uhh......
I don't think he cares at this point.

I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.
Apple and other EV hopefuls chip away at auto industry pyramid
I'd like to add that the situation is so severe we should prioritize a solution to COVID at the expense of individual privacy.

This is the biggest problem we've ever needed to solve as a society. Release the documents and we'll find the bugs.
It's all freedom of speech. You can express yourself. It doesn't mean you aren't shouting into an uncaring void though… which is what I imagine most of the HN audience is when you're asking for sympathy when you released your software in a libre manner.
50% of the patients coming into that hospital, that's not 50% of the general population at large.
If you form an llc, and if you pay passthrough taxes instead then you are perfectly well aware that you are a business and that passthrough taxes are saving you paperwork. If not, your CPA can explain this to you.
I want more too - I want state level stuff promoted more -
I want rss for each city/county council member and state level office - not just what they voted on, but what is coming up - also who has given them money, and who has had meetings with them.
Challenge accepted :)

$ echo lorem ipsum > "foo bar"
$ cmd='cat "foo bar"'
$ trap "$cmd" ERR;test;trap - ERR
lorem ipsum
Mostly cmr but the same basic dual experience occurs for me with the whole family.
>and then people simply installed the actual, full version of Python they wanted.

Which then wouldn't work for all the repository python programs. The repo's python is what everything is built and tested against, so there is no replacing that.
In theory, probably something like: (1) recruitment and growth of the sub either organically or inorganically (2) selective upvoting of particular perspectives if not direct posts (3) propagation and cross pollination of content across platforms e.g. Twitter + Reddit, etc.

But there's really no way to know, and the natural trend towards extreme opinions is inherent as is. The game would be to push perspectives towards more extreme views over a longer period of time.
This is very nice. I mostly use Material Design Icons [1] now, but lately they feel too crude to me, and these Iconoir icons are very lightweight.

Still, MDI are very consistent and have a lot of icons now, I think over 4000 last time I checked. Probably, the biggest free set out there.

[1]: http://materialdesignicons.com/
16 bit certainly suffices as a delivery format. Many listening environments provide far less dynamic range (e.g. cars) and environments where the lowest level details aren't buried in the ambient noise floor are going to be few and far between. Even though it is possible to encode information below the noise floor in practice information that far down isn't going to be perceptible. (A practical definition of "perceptible" might be "able to be distinguished in an ABX test by a trained listener".)

As for how much safety margin is "enough" during initial capture... We're looking at a stark choice between either 2 or 3 bytes per sample. 2 bytes seems to be borderline, while 3 bytes seems to be plenty. It would be hard to quantify a safety margin more precisely than that.
I don't know the author, but when I read an article by someone who obviously knows something about Postgres (knowing something about Postgres myself), I feel it's much more likely that they made a slight language error.
Although that theory has been questioned recently, and chickenpox vaccination is being considered:

https://www.theguardian.com/society/2021/may/02/the-chickenp...
AlphaGo - The Movie
https://youtu.be/WXuK6gekU1Y
Yggdrasil was very aware of B.A.T.M.A.N. and cjdns.

https://yggdrasil-network.github.io/2019/01/09/history.html
I'm one of those active users. Perhaps "dead-end" is more accurate; I'll be on it until the networks I'm on turn off, but newcomers are a rarity these days.
open source =/= free software.

That's the first mistake you are making.
He’s also going on about a wild conspiracy theory about Aaron Swartz getting assassinated because he was on to Ghislaine Maxwell, or something like that. And linking it to his open source comments in a way that doesn’t seem to make sense.

He’s almost certainly going through major mental issues, along the lines of schizophrenia or something similar. He needs help.
First you agreed to ToS when you uploaded things to npm. I haven't read the terms but it should be enough for npm to publish on npm no matter the license.

Secondly and as important if you publish something under an Open Source license(1) then you _cannot
unpublish it_. You granted copyright to
_everyone_ for and existing both now and in the future to distribute and use it(2) (legally it's a bit more complex but that's what it boils down to).

(1): Assuming you had the legal right to do so, but if not you are liable for any fall out, not npm (because ToS, they still need to take it down reasonable fast, but they might be able to sue you).

(2): Within the constraints of the license.
It's not a time tracking tool per se. It counts keystrokes, mouse swipes, takes screenshots, and so on. It's a spyware nanny cam.

https://www.buzzfeednews.com/article/carolineodonovan/upwork...
It still doesn't mean you can't call the guy out for being an asshole. However, that's the only relief you'll get in matters such as these. Other avenues would be to tweet about it and make it known that this is what you can expect from the same guy in the future so avoid him for future work as he won't be acting like an adult.
> That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally.

There's no contract that says complaining is banned.
> Does a straw have one hole or two?

Is your answer the same if the question is about a person instead of straw?

Both possible answers are technically correct, because "hole" has at least two relevant definitions: (1) a hollow space inside something, (2) an aperture connecting two spaces. A straw has one #1 type hole, and two #2 type holes.

#2 is probably more practically correct, because most of the time when one wants to talk about a straw's holes, it will be the apertures that one wants to talk about not the hollow interior.
If God meant for people to be naked, they'd be born that way!
Then solve that problem, and stop subsidizing incompetence and corruption.
I wonder how these apps go approved by app stores? Unless they mean web applications by apps. That’s not very clear as many app stores have very explicit terms that ban such behavior and offenses.
> You can say that about any popular sub, what would their motivation be?

Social media has pretty much destroyed the fabric of western society, so theres that. I don't know that we need state actors to get involved in order for that to happen, it seems to work on it's own, but I can imagine if some actor was looking to create more tension and unrest, targeting and subtlety trolling large discussions would be pretty effective.