skysight-inc/HackerNews huggingface dataset:
I've used NPM shrinkwrap before back in versions 1-3 of NPM. It's a little confusing that the author of this post calls it "new", so I investigated.

Since NPM version ~2 (current is 8), you're allowed to publish a npm-shrinkwrap.json file[0] in your package. That's in contrast to a package-lock.json, which may not be included in a published package.

Back when I used shrinkwrap, it was pre-lockfiles and it was trying to accomplish something similar to what lockfiles accomplish today. (Lockfiles were added in v5 [1])

I dug up this old StackOverflow post to verify that the behavior of shrinkwrap hasn't changed[2] since many years ago.

That doesn't leave me very hopeful. If package maintainers aren't doing this already, and they've been able to for 6+ years, then it's unlikely they will in the near future.

(I'm currently investigating how to deal with bad deps with some Open Source tooling I'm building. Feel free to ping me if you have any thoughts to share)

0: https://docs.npmjs.com/cli/v8/configuring-npm/npm-shrinkwrap...

1: https://nodejs.dev/learn/the-package-lock-json-file

2: https://stackoverflow.com/questions/44258235/what-is-the-dif...
The web isn't immutable.
I agree. There's a kind of social-transactional element to Open Source that people don't like to talk about. Like, chasing clout instead of dollars. If you're a committed maintainer who writes a lot of packages and sacrifices a lot of your free time, chances are you have some self-interest in the mix.

The illusion of universal altruism probably helps insulate people from thinking about the uncomfortable politics of Open Source.

I'd like to read an article covering your insights.
I'm starting to think 100% vaccination is a weird goal. There have been examples of drugs that only caused issues years after taking it. Thalidomide (called "Neurosedyn" in Sweden) is one. Even if issues arise right away, it may take years to gather statistical data to agree on the risk factors. In the meantime, to any one doctor, it may look random.

Injecting every person on Earth with one of only a few, new, vaccines seems dangerous. This has me wondering about two things:

1) Isn't it good to have an unvaccinated control group? 5-10%? Not just based on people who for some reason cannot take any vaccine, but healthy individuals.

2) Shouldn't we only use a single vaccine for every dose per person? To narrow the population affected by potential unknown side-effects.

Has anyone heard any officials/domain experts discuss this?

(I'm not against vaccination per se, and am myself on the third dose already. I'm just worried we're blinded by one danger, and willingly heading into another.)
I was looking at the CDC data for that claim, it looks to me like many of those "co-morbidities" referenced appear to be sepsis, respiratory failure, heart failure, and co-infections:

https://www.cdc.gov/nchs/nvss/vsrr/covid_weekly/index.htm?fb...

Most of those sound like they would have been caused by COVID. So, were they probably a fairly normal 41 year old, until they were in the hospitalized for COVID, developed complications, and died. Or is there more to the model here?

Even more confusingly, about half of the US population is obese, but it is only mentioned in a small percentage of death reports (up to about of quarter in the younger populations). Taken naively, this would seem to imply that being obese actually strongly protects from death. But I suspect that it is instead simply not being listed in the causes of death in most cases.
Rational motives can produce irrational actions, and do so somewhat reliably.
So finally F.L.O.S. Software pays out. Shame that the dev did not apply for some compensation. All in all, not very rational of him.
Also he seems to have somewhat of a Guerilla mindset, based on this:
https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp...

I see "charged," not "convicted" in that article.

Real world: Innocent until proven guilty.

Internet: Always guilty, because justice doesn't scale.
> That's just not how games work. A longsword in dnd is not a longsword in final fantasy, nor is it a longsword in dark souls, nor is it a longsword in minecraft.

That's not a terrible idea. Crossovers between games. Good gimmick.

And a lot of what you're talking about is culturally constructed, it doesn't have to be that way.
If you use Atomic* classes and the available concurrent standard lib datastructures, Java concurrency should not be an issue to any non-junior developer.
I'll leave it as an exercise for the reader to understand the difference between "I am not liable if I have a bug that ruins your production environment" and "I am not liable if I maliciously introduce a fatal bug knowingly into your production environment".
I think I'd be more interested in Crystal if it was easier to integrate into existing ruby code bases via something like the FFI.

As it is from Ruby 3.0 we have built in optional static typing and with interesting projects like Sorbet Compiler[1] we have the option to statically compile making use of that. It's still WIP I believe but it's giving ruby devs some cool options.

1. https://sorbet.org/blog/2021/07/30/open-sourcing-sorbet-comp...
> I ride in my normal road position, about 75 cm from the kerb.

The rationale behind riding closer to the edge of the roadway is that drivers of motor vehicles have more room to overtake. But would a motor vehicle be able to fit between you and another motor vehicle in an adjacent lane when overtaking while leaving sufficient distance between their vehicle and the cyclist?

I would posit that's not possible, meaning that there is no benefit derived from riding closer to the edge of the road. I would also assert that it's actually more dangerous compared to just riding in the center of the general purpose traffic lane.
GitHub isn't preventing him from doing what he wants with his code it's just not hosting it for him anymore.
It's not all bad to spend more - consider the extra hospital capacity that so far has helped absorb COVID shock impacts better than neighboring Canada. Hopefully we don't hit the limit of that, even, though. https://www.bloomberg.com/news/articles/2022-01-06/hospital-...

US health outcomes also aren't so bad for those who have affordable access to the system, as I understand it.

But the spending is something to keep in mind when anti-healthcare-for-all advocates say things like "do you want to have to wait months for procedures like in Canada" - if the US continues to spend more money per person, there's no reason it can't continue to have more capacity.
> Ruby just finds stuff without me having to 'import' or 'require' it.

That's either bundler (which `require`s every dependency you specify unless you tell it not to) or the Rails autoloader[1] (which goes hunting for a file that might define the constant, which also allows hot-reloading to work). Ruby itself requires you to `require` everything.

[1]: https://guides.rubyonrails.org/autoloading_and_reloading_con...
> Why isn’t SHA256 good as a password hash?

Because it wasn't designed for it. For password hashing you want a hash that has a salt (so that the same password on two accounts doesn't have the same hash on the database) and is as slow as possible (that is, fast enough to validate on logins) to increase brute-force time.

Historically Bcrypt was a good option, but I think Argon2[0] is the current best option.

[0] https://en.wikipedia.org/wiki/Argon2
There's nothing unique about competitive cycling in this regard. Take two tennis players of comparable skill and give one the best racket and the other a $20 one from Walmart. Or in football, do the same with two receivers and give one the latest Nike Vapor Jet gloves and have the other use no gloves. Or golf with clubs. I could go on and on.

Equipment quality will always have an impact in sports.
> As stupid as it sounds, I could not force my parents to go and wait in the line to get COVID test, after he says “I believe I don’t have COVID now. But if I go to the testing center that is so badly managed and understaffed where only people with obvious high level of COVID are brought to get official result, I will get COVID there!”.

May I ask why you wanted them to? Honestly his response sounds rational to me.
Maybe, but the share price is unlikely to be $20, or anything close to an hourly wage, if the company is paying all of its employees in equity positions.
npm ci is relatively new, before that it was hard to get it to precisely respect the lock file. There is also an issue if your devs don't all decide to use either yarn or npm with the separate lockfiles.
I think this mindset is fundamentally wrong on multiple levels.

1. There is no contract, not even implicitly, that promises software maintenance in exchange for praise. The praise may be a motivating factor for the developer, but anyone who thinks they are entitled to anything just cuz they showed some appreciation has not read the Open source License, which almost always states the software is provided as is without warranties.

2. Genuine praise is not transactional. The only factor affecting praise or criticism should be merit. Any other quid pro quo makes praise into hollow lip service, meaningless fungible gibberish uttered for personal gain. Praise is more like a donation than a payment.

3. Even if praise/fame somehow could function as currency, then any individual is not providing enough of it to earn themselves any significant privileges. Maybe in aggregate the community would have a 'claim' (if the developer agreed to this contract), but even then the obligations incumbent on the developer would be limited and unclear, because no one person can speak on behalf of the community and for most projects their community does not organize itself in such a way as to permit concerted group action that can be recognized as the will of the community.

4. if you feel like you have been robbed of your praise, you simply withdraw it or voice criticism. Or you recognize that your praise was still applicable and valid to the parts of the project that you were aware of at the time of voicing your opinion, so therefore is still deserved. If you think you provided more praise than is merited by the project, then that's an error in judgment on your part. No one asked you to proclaim project [projectname] the best thing since sliced bread and the hope of humanity that is literally gonna change the world. Just be more careful with who you choose to praise.
Take-Two to Acquire Zynga
Cumulative Deaths: Selected Countries and States (per 100K)

https://ig.ft.com/coronavirus-chart/?areas=eur&areas=usa&are...
https://www.oslash.com/ does something similar, with a nicer interface and more collaboration.
> Despite how much some people detest the stale bot [...]

I detest the stale bot :-)

And I really think it only is a disservice to the project, 99% times I see it used. If the code has a genuine, real defect, it will not "go away" magically just because nobody complained again, or the authors didn't have time to look on it.

See, the issue is there. Don't have time? Ok leave the issue open, it acts as a documentation about, well, that there is an unsolved issue.

I really hate when googling about some problem and then finding a promising bug tracker conversation that then... got comments closed because of old age. That's literally swiping the problem under the rug.

Now regarding burnout and burden of OSS maintainers, I might lack a bit of empathy here, but I just don't get it. Really the license text says it all: THIS PROJECT IS OFFERED AS-IS. Most if not all OSS licenses have a phrase like this. Just quote those words 100 times if it's needed. My mental health as an OSS maintainer is very well and I cannot see it being changed by some, even lots, of demanding users at any point. Every time someone takes my code and uses it, there is an implicit conversation where I go "hey, here you are take this work for free, I'm lending it to you AS-IS, do whatever you want with it!". Absolutely at no point in time I feel pressure about defects in the code, after having this imaginary conversation.

I guess we need more spreading of the notion of "not giving a sh*t" so the idea gets extended to more and more OSS maintainers, helping them have a happy life not encumbered by the work they decided to release by sheer goodness. EDIT: with this last phrase I mean that one should have the mentality of contributing up to, and not more, what one is able to do within their own limits. The "not caring" I mention is for after reaching this limit: it will help not pushing through the burnout line, and thus as a result being happier in the long term.
Speaking of senses of humor ... I think the OP merely asked a question, and wasn't questioning the feasibility of the phenomenon.

Now 'Military Intelligence' is another thing entirely ... ;)
New Hampshire (USA) may soon enshrine Software Freedom into law
> “The FE also cooperated with the NSA on spying operations against the US government itself.”

It’s long be standard practice for intelligence agencies in 5/9 Eyes to ask each other to spy on the others citizens when it would be illegal to do so themselves.

The NSA for example would find it difficult to spy on Senators, this is there way around it. And there is no denying there has be a reasonable cause to in the last four years.
You can go further and say there is little to no advantage in freelancing. A lot of remote dev work isn’t even 40/hrs a week of constant work. You can pick a low stress job working from home and still make six figures, more than most freelancers with far less stress.

I’ve given up on ever pursuing freelancing because I realized I actually didn’t want to be self-employed, I just wanted to work from home and be in control of my time.
Personally I get very good mileage out of the ruby-install/chruby/rv trifecta. RVM and rbenv tried to do too much for my liking.
A lot of this was covered by the Libertarian Party's position on healthcare reform in the last election, which I thought was interesting: https://www.foxnews.com/politics/jo-jorgensen-big-idea-marke...

There are probably ways that we could combine aspects of greater and lesser privatization to achieve the best of both worlds. I have some thoughts that I've been mulling around for a while:

1. Expand the government to achieve universal healthcare coverage.

-- a. ACA public option.

-- b. A conservative UBI, with the twist that uninsured individuals would be automatically enrolled in the public option and have their premiums taken out of their UBI. (Tangentially, for similar reasons, also pay out a portion of each UBI disbursement in the form of food stamps rather than cash.)

2. Shrink the government and quasi-public entities (insurance providers) to unshackle the invisible hand.

-- a. New regulation to ban copays and set a mandatory floor on deductibles (say, $10k). While major emergencies still need to be covered, and while there still needs to be an entity in between the patient and provider eating the risk of non-payment, it's also desirable from an efficiency perspective for patients to be kept aware of the costs of their care — and therefore incentivized to select more cost-efficient options. The market would then naturally find a more reasonable equilibrium without the need for price fixing, in theory.

-- b. Set up a system of tax deductions and credits for out-of-pocket medical costs. (Preferably such that the poorest would have their costs fully covered in most or all cases, depending on what's fiscally realistic.) This must strike a balance between non-disruption of market forces and ensuring that the poorest in society aren't shy about seeking the care they need. My thinking is that the annual nature of tax filings would be enough to address the former, as patients would still be be out of pocket for up to a year waiting on their refunds, representing an opportunity cost that would be difficult to ignore. To address the latter point, set up a standardized/regulated process for the insurer to send the patient something resembling a credit card bill, which they could pay either up front or up to a year later with accumulated interest.

Parts 1 and 2 are essentially unrelated, and could hypothetically be implemented independently of each other. However, #1 on its own doesn't attempt to address the efficiency issue (thus saddling the government with even greater new expenditures), and #2 on its own doesn't address what happens or who gets left holding the bag when an uninsured patient can't pay their bill (which wouldn't be an issue with truly universal coverage).

I also have a lot to say about what the state should and shouldn't be doing to maximize the general health/nutrition/fitness of the population, but we can leave that for another post :).
K8s Operational View – read-only system dashboard for multiple K8s clusters
> Which is an anti-pattern.

According to you. I happen to live in a single payer, free healthcare system (Spain), and the claims about “how nice it is” are pure BS.

All of my family has medical insurance, even when we could ill afford to pay extra.

- I almost lost my brother on the public health system (they sent him home with some antibiotics, instead we took him to a private hospital were he got surgery that same day, he had internal necrotic tissue).

- My mother needed a mammogram, the doctor suspected cancer. the appointment they gave her was in two years. We went private again, she ended her radio + chemo before the diagnostic appointment of the public sector.

In the meantime, my effective tax rate is over 70%.

I’ve had to visit a hospital in the US (San Francisco) for a recurring issue. It was way better than anything in my area.
It could be illegal (regardless of warranty or license), but it happens to not be in most of the US.
I’d argue that absent any regulations, there’s no such thing as corruption, just like without laws, nothing is criminal!

But is that the world we want?

The fact of the matter is that corruption, like crime, will always exist, so the system within which the corruption exists better be able to handle it, or it’s a poor system.

The author’s argument is basically the opposite - “the system is fine, it’s the pesky non-idealities that are the problem!”

My point is that this is a totally useless take. It’s like trying to build a rocket and wondering why it collapses on the launchpad because you hand waved away all the non-idealities: “oh, the rocket design was fine, it was those pesky non-idealities that we’re the problem!”
I downvoted because it brings up this pointless trope of "duty to shareholders", as do you. The reality is that company officers have nearly limitless latitude to make strategic decisions as they see fit.
I agree, JS is kind of all over the place.
How would that help if these changes were pushed directly by the original creator himself? Not only form his account but himself as a person.
I honestly detest stalebot - if you don't want to keep on top of your projects' issues/PRs, fine - but don't artificially and automatically close issues that explain very real limitations in your project just because you don't have the time to look at them. If you do that, you rob the next n visitors the ability to understand what works and more importantly what doesn't work at a glance, from the open issues/PRs list.

That security vulnerability or bug isn't going to vanish into the ether because a "helpful" bot closed the issue. It'll still be there - but it'll get lost in every other closed issue.

I will happily just comment on the issue every single time the bot closes it out of spite to force it to be re-opened. Hell, it's probably overdue someone writing an anti-stale-bot that does exactly that.

Related: https://drewdevault.com/2021/10/26/stalebot.html
But not on this private relay feature, apparently.
I hope you feel better that you called out on the righteousness of someone who highlights a problem. How dare someone speak of a problem when you can happily live in an ignorant world where everybody always speaks of how good things are.

In the interest of a civil discourse. I will say that I did mean that I am not surprised by the fact that the stats are not correct because I am aware of the ground reality from my anecdotal sources that point in the same direction. Not that my country does or doesn’t do anything.

The first step to solving a problem is recognising that it exists, and not wish washing it away.

As an Indian, I’m sad that you’re not angry.
I had a dual CPU nehalem around 2010 under my desk. It was a beast. 8 cores, 16 HT. Now I have an M1 Max and I have yet to get it to spin its fans up. So I don't know what your day-to-day work is, but is it possible it's just not CPU bound?
Pretty much "every other vendor" has a legitimate reason; they have little to no distribution network and rely on carriers to sell their devices. That's not the case for Apple who has both a decent network of Apple Stores around the country and sufficient brand loyalty to survive (and potentially even thrive) even if their devices become more difficult to buy.
I don’t think so, aside from using the delete button to remove characters one by one.

One possible workaround is to paste the phone number and then dial using Siri, making the edits as you read off the number: hey Siri, dial ###…
> Other package managers should take note too. Marak has done all of us a huge favor by highlighting the problems most package managers create with their policy of automatic adoption of new dependencies without the opportunity for gradual rollout or any kind of testing whatsoever.

(Emphasis added) - is this actually a widespread practice? That's certainly not how apt packages are handled...my impression was this is a problem unique to the js ecosystem.
> Downvotes in lieu of logical argument in 3...2...

If you want a logical rebuttal, you have to make a logical argument, and not

> At least 70-80% of 'conspiracy theories' are true. Yes, even many of the 'crazy' ones.
Stopped caring about GNU/Linux 20+ years ago.
Yeah we all the market will crash eventually because that is the nature of markets and of humanity, but people claiming prescience about it are either using inevitability or "taking a chance and calling it", neither of which proves anything unless they can give a precise date and relative "size" of said crash. Otherwise it's just saying "I bet the sun will come up tomorrow"
I don't see how this is in any way competitive with the current options. It would't be competitive at sub-$500 pricing, nevermind $2000+.

And then there's the platform bit which is the final nail on the coffin. Let's not kid ourselves here, VR at this point in time is all about the ecosystem rather than hardware and if there is no ecosystem [or backing from the heavyweights], odds are one is going to end up with a very expensive paperweight.
I don’t need to be convinced. I don’t like unions, and I think there is likely a better alternative than a centuries old idea. The thing I personally dislike the most is the all or nothing aspect. I don’t want to be compelled to join and union or compelled to pay union dues. I don’t want to be in a union, and I don’t mind bargaining on my own behalf as an individual.
I think it just depends on if you like the kool-aid there. If you embrace their mission statement as your own, then other concerns might factor less for you.
> It seems to be partially that big corporations are using his library without payment

He doesn't charge for it.
Good on them for making it a six month sentence, that's very fair. Shows good sense.