skysight-inc/HackerNews huggingface dataset:
Poll: Could You Convince Your Employer to Pay for Vetted Packaging?
The idea comes from https://news.ycombinator.com/item?id=29868302 .

Basically, epaulson says that their company would pay for a company to handle Linux packaging, vetting all of the packages, if some liability is accepted by the vendor. It interests me, and I would like to see if anyone would pay for it.

(If I did this, the liability I would accept would be that the contract would be extended, for free, for the length of time that the customer was affected by a broken package. Please comment if your have other ideas for how liability could be accepted, especially if it's how your company would want it done.)

Obviously, I would do as epaulson suggests: give back to the FOSS that I am packaging, probably based on number of users. This would help protect me from people like Marak (see recent threads about colors.js and faker.js) while also giving back to Open Source.

My question is this: could you convince the people in control of spending at your current employer to pay for this vetted packaging service? Crucially, this is not about whether you would pay, unless you are C-level and/or do choose how to spend funds; in that case, please comment so if you can.

Bonus points if you comment with how much your company would pay (or contact me [1]).

[1]: https://gavinhoward.com/contact/
My experience in case it helps:

Open it up, looks like mobile only. I do my planning an organizing on my big desktop monitor with good keyboard so this is a no go

Wants my email a lot. Maybe this guy is harvesting Hacker News emails

Subscription model. I hate those because I always forget to cancel. Besides I have free and open source note takers that are pretty good. Not everything I want but good.

Someone asked about Desktop further down in comments so you gave them a link

https://cloverapp.com/download

Download a large Electron app. Windows 11 refuses to run it because it's untrusted but I are smart and know how to get around that

If can do an Electron app why not just make it a website for people to try?

Asks for my email again.

It wants to connect to me Google Calendar and Email. It looks like a simplified interface to those two tools.

Sketchpad is an interesting idea. They've been tried since the 90's but maybe these guys got it right.

edit: I use Obsidian. They got me to become addicted to their software by having no fanfare or ceremony and allowing me to see what's great about it right away by trying it. It opens to a big download button. It doesn't ask for email. It's free forever for personal use.
We run single worker Uvicorn instances...we just run lots of them (behind an HAProxy sidecar).
What do you think I said?
> I should not have said “other countries” in my original post. There are, currently, no other countries than China and the U.S. in terms of scale and influence.

One might perhaps reasonably compare the EU, which I would suggest is somewhere between the US and China on the where the control lies.
Feature parity. There are still things you could do then and can't do now with this neutered 'hey-lets-be-like-Chrome' API that nobody asked for.
Hmmm… We haven't looked into that, but it would be pretty neat!
I hear that too, and frankly seems a dumb reason not to use a language. Does it get the job done, can you build value quickly, yes and yes
> If you search hard enough

You can find anything online if you search hard enough. That doesn’t mean it’s true. It probably means you’re actively seeking out bias-confirming articles.

> (and quickly enough, they’ll likely be removed soon as they’re anti-narrative)

And now it’s full on conspiracy theory. This stuff is nuts. People like Alex Jones loudly put forward blatant lies that are “anti-narrative” and no one shuts them down. Why does every group imagine they are persecuted?

> you’ll find articles of people discussing exactly this. That the vaccine actually increases your chance of infection.

I would be interested in any relevant reputable articles showing this, but I’m pretty certain there are none.
Tape is fetishized like crazy right now so that’s not surprising. I see runs of 500 tapes on Bandcamp sold out immediately all the time for not-so-well-known artists.
I have setup github several times in the last 3 days on fresh Linux installs. It is very easy.
Falcon + Gunicorn + Meinheld is incredibly under appreciated
Not all companies have an aggressive patent strategy. Historically, I believe Google felt negatively about software patents, and had fewer than other tech companies. Eventually they bought a large portfolio of patents (e.g. through the Motorola acquisition; when they later sold Motorola, they kept the patents) so that they could use them defensively, because not having enough patents became a liability.

Even after that, I believe Google only used their patents defensively: they'd only sue company X for patent violations if company X sued Google for patent violations. When I worked there, that was the impression the company gave off, and some initiatives like "Alliance for Open Media" the other commenter mentioned are in line with that.

I don't think Google is unique in this: older tech companies seem to have more aggressive patent strategies, whereas newer (.com era and onward) seem to dislike software patents but are forced to play the game by more aggressive companies and patent trolls. It's a drag on the industry IMO.

The biggest losers are newer and smaller companies, who haven't had enough time or resources to build up a defensive patent portfolio.
It's because the constraints are so different. Deploying to prod is incredibly expensive in this case and you practically cannot iterate outside prod either.

I see this every day in the difference between SaaS and on-prem Enterprise software. If you have a bug in on-prem, Enterprise every customer needs to deploy the patch. You need to update all affected, supported versions, etc. In SaaS, you just deploy and more often than not that's it. This changes the way you do everything and it comes with a high cost. JWST is the most extreme example on this spectrum.
> Suicide nets were a result of western over reaction to relative few cases of suicides

So just to be clear, how many low-wage workers have to kill themselves before we say it matters?
My dad took to wearing a Stetson on occasion in his late 40's, around 25 years ago. In Oslo. I'm not sure exactly which type, but one of the fedoras.

I'm not so sure most people in Oslo would have agreed it was "acceptable" but he didn't care, and it's not like anyone would call him out on it.

I'm in my late 40's now, and kinda want to wear a hat but I think I'll pick something which stands out less.
As an anecdote, that's exactly the behaviour/mentality I've heard from some people I know that still refuse to take the vaccine. They are young and fit, and their reasoning is exactly that, it's easier to just get infected, recover, and get papers for traveling that are valid for 6 months...

Perverse incentives showing up, as usual.
That is also a good point -- if you are trying to get rid of fingerprinting vectors in Chrome, I vaguely suspect that is going to stick out more than using Firefox.

I don't have hard data to prove that, so I won't make a bold claim about it. But it seems illogical to me to say that you're using Chrome to blend in if you're also customizing Chrome (or using DeGoogled Chromium, Chromium itself, or a ton of extensions) in a way that makes it obvious you're a power user that cares about privacy.

In contrast, in Firefox having Ublock Origin installed is probably a bit more common than in Chrome, and turning on the anti-fingerprinting features standardizes a large percentage of your setup with anyone else who flips that bit in their Firefox settings. You can worry somewhat less that you're doing something that is completely unique with your anti-fingerprinting setup. But again, I would hesitate to make strong claims about that without more data.
Just to put some perspective on this, I looked up Boston's bike lanes. There are 8 miles of separated bike lanes in Boston, out of 800 miles of down town roads.

Drivers in Boston are being asked to _share_ 1% of the road infrastructure with bikes.
Controlling volume to a set of speakers via a remote is something we’ve been doing in the analog world for decades. So a general patent on volume control across speakers should be invalidated.

It only becomes novel due to the details of the tech. But even then you could implement the solution in various ways and I can’t imagine every potential method was patented.

So, while I agree the non-obvious can be hard to define. But with patents like this I don’t think we’ve found the right balance.
I wouldn’t call it more durable, but it can be more diverse/flexible (there’s more to covid-19 than a specific spike sequence).

But if it was more durable (long-lasting), they wouldn’t have the 180d limit. They put that limit in because of the (lowwwww) risk of continuing to test positive after recovery, but the worst case report I’ve seen is in the 6 week after recovery range.

It’s mostly Canada trying to be punitive when it comes to travelling by requiring PCR, when a within-24h antigen test would be cheap, easy, catch as many asymptomatic cases as a less-fresh PCR, and near zero-risk of false positives immediately after recovery.
24fps is definitely not just a low-budget option. People with very expensive cameras capable of shooting 60fps without any issues at all are still CHOOSING 24fps.

The debate about 24fps vs higher frame rates is nuanced. It's about trade-offs and style choices. Here's an example of a videos discussing 24fps vs higher frame rates:

https://www.youtube.com/watch?v=WIo7jwsYbxc
https://www.youtube.com/watch?v=e6HZPmSlS5c
Much of the inflation is caused by monetary policy (e.g. fiat money and expansion of the money supply).
Water heaters, cars, washing/drying machines, power walls, battery powered devices. Electric teapot, microwave, cooking stove can operate at half of power when demand is very high. They can report to and receive instructions from a smart power meter.
A rapid or PCR test from within the last calendar day is required to enter the USA. It's pretty hard to get that in many countries now b/c the winter/omicron surge. Plus, it's often expensive.
This is also true for solar panels too though - they require rare earth materials. And large scale wind farms can have accidents and fires and harm wildlife.

Doing anything at scale is difficult.
This is what annoyed me the most. Google was there, they had an awesome solution. Then they just abandoned it. Even in its old, clunky state, it was still immensely useful, and user feedback was -very- vocal about its utility. They just don't care.
My previous comment got flagged, so I'll rephrase in a way that's less sarcastic.

Intel is doing the exact same thing to help Xinjiang as the government which is absolutely nothing. Yet somehow anti-capitalists will only focus on the former. Governments do tend to virtue signal more, but that's because they don't face any negative repercussions for doing so.
It is really not my own favourite of the books I've written, though. (If you want to understand why, you might enjoy The Rapture of the Nerds -- my two-fer with Cory Doctorow, revisiting the same themes a decade later from a rather more tongue-in-cheek, not to say skeptical, direction.)
That's what I suspected... it would be instructive to include the cloth mask on the chart, just as a comparison to show the difference.
Interned prisoners in Xinjiang, China are detained with no due process without having ever committed a crime. They are systematically forced to abandon their religion, their culture, and their identity. They are tortured physically and mentally, with beatings, and electric shocks, and waterboarded. They are forcibly sterilized. They are brainwashed as a condition to even be fed, which they are often not. There is forced hard labor, and if they refuse, they are beaten or killed. Many of the workers are children in elementary school. They are medically experimented on. When they die from the torture, or the cold, or starvation, their organs are harvested and sold for profit. Journalism about what goes on in these camps is suppressed, and those who speak out about it are imprisoned. Dissent is illegal and those who do are imprisoned.

Prisoners in Xinjiang are systematically gang raped and sexually tortured, sometimes publicly. If you look in the wikipedia link you will find details on exactly what the sexual torture involves. Unless you have a thick stomach I would not recommend reading it.

This isn't even half of the crimes against humanity in that region. Men, women and children. All of these claims have been corroborated by multiple independent observers. One million people, none of which are convicted of a reasonable crime. Just...let's step back and realize what we're talking about here.

Knowing this, do you believe there is a valid moral equivalence between this and even the most steel-manned, critical interpretation of US-prison-labor? Do you believe that the existence of US prison labor, even with all its (far more nuanced than you may give it credit for) problems precludes or somehow invalidates boycott and criticism of products connected to atrocities in Xinjiang? If so, why?

https://en.wikipedia.org/wiki/Uyghur_genocide

https://www.amnesty.org/en/latest/news/2021/06/china-draconi...
Overlap Gap Property: A Topological Barrier to Optimizing over Random Structures
The status quo is the problem here. So pointing to the status quo doesn't invalidate my argument. Taking security seriously means you take the security of your customers and your users seriously--not just yourself. I'm sure a lot of those companies take their own security seriously. That doesn't mean they shouldn't be doing a better job for their customers, their users, and the rest of society.

It's not just that my feelings are hurt, it's that I personally view this as a societal issue. Our tremendous reliance on this internet thing, and our lax day-to-day security practices and expectations, puts us at serious risk--individually and as a society.

You regularly post about the overcomplexity of security protocols and their poor implementation. I'm sure you're more than just "unhappy" about those things.

SSO shouldn't be hard to implement relative to, say, MFA--especially since so many use SMS. Auditing should be incredibly straightforward to implement, especially if you are using tools like Rails or Django.
It's an indicator that the company favors profits over security.
not me, i was translating for the comment above :D
We probably will have even cooler stuff up there in twenty years. Also, with the accessibility of space opening up, a refueling mission may become possible.
JWST will be so far away from earth that is unlikely any human will ever get near him. Also, Hubble was designed to be serviceable during its lifetime. This isn't the case for JWST.

Maybe technology will develop enough to allow us to send drones to work on JWST, but today this is still just a dream.

PS: I'm just a random code monkey on the internet, so take these comments with a grain of salt.
They indeed are. Google search shows vastly worst results than what it’s engine is capable. This is a deep learning trick to train the search models better and better
Ah thanks for telling me about that! Looks like in dark mode it wasn't quite working correctly.
There is a backlash around it. https://sso.tax is a perfect example that I'm sure you're aware of. But there are two major ways to look at this:

#1 - From a builders perspective, you've got to figure out what features (security or otherwise) that cost you extra and charge accordingly. In the old days SAML was one of those features was legitimately expensive to implement. Now keep in mind that not everything that costs you extra people will necessarily want to pay for.

#2 - From the sales perspective, what are features that people are willing to pay more for. SSO is something that is more and more frequently a business requirement. You want slack? Require SSO? Well you're paying for Business+ at $12.50/mo/user rather than Pro at $6.67/mo/user... even if you care about nothing else that comes in the Business+ plan.

As a Security/IT person, I absolutely hate that features I consider to be "required" (like SSO and APIs) are extra costs when we're the customers. The best I (and others like us can do) is convince our businesses those items should be part of the default feature set and not charged extra for.
> Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version.

No, it pulls the specified version.

The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes.

He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.
I just recently learned about the OSINT (Open-Source Intelligence) community but it seems like a powerful force for validating information online.
I get that part. The interesting part is if building a new instrument will be marginally more useful than resupplying the current one. A few years back there was a demonstration of an orbital vehicle for refueling satellites. So, which is better: spending a few more billions for capturing a few more frequencies of infrared light or spending a few hundred millions for extending the life of the current mission.
>Is the tree size still too big if you're only using Wordle's word list?

Yes, it's what I use.

Wordle has ~2300 words as possible hidden words, ~12,000 more allowed as guesses. To get best scores you need to sample from all ~15k words.

So, to build a tree: for each hidden word (2k), pick a guess word (15k), gain knowledge (729 possibilities, but only one per hidden/guess pair). This reduces your possible hidden list to 70-1kish. Repeat..

Worst tree is 5 levels deep, mine averages 3 levels deep, pruning and memoization is nearly nonexistant (I checked).

You now have 30M first move outcome nodes, 2k of which are wins. After second move, you have a billion plus (I've sampled these to gain knowledge of what to expect). The next few rounds push the compute time into crazy realms of time (again, I've sampled to estimate sizes).

I'd guess given a lot of computing power, it could be done, since around 3-4 levels most of the games complete. But since you cannot easily store this tree, I gave up for now.

You should be able to store the tree with best move only at each node, which is good for gaming, but loses interest for statistical knowledge of the tree.

Good luck :) Nerd sniping complete :)
"So, it is technically possible to have a NO-OP encryption layer but just a bad idea."

Not just technically possible - it actually exists. There is a NONE cipher that is part of the HPN-SSH patches, etc.:

https://www.psc.edu/hpn-ssh-home/hpn-ssh-faq/

"The NONE cipher switch disables data encryption AFTER you have been authenticated or logged into the remote host. This can significantly reduce the load on the CPUs of both machines and may improve performance even more. Its important to remember that the initial authentication process is still fully encrypted."

If we're sending data over a private point-to-point link we always consider the NONE cipher ... especially if the underlying data was created by borg or restic anyway ...
How can that be inferred? Maybe the results were all bad and I'm refining my search query. Or trying a different search engine.
Funny - as I read, I wanted to disagree with the author (and I guess I do to some extent) but I can’t find fault with his conclusion.

I think the world could be a better place if we all could adopt a small sense of humility and assume the good intentions of others.
That's correct, while using an image for development is possible, it is not the preferred way to operate. Any industrial application in ST will use version controlled files, like in other languages.
this just in, NASA is trolling us and it's actually mercury years
/s
I wanted to say that for 10 billion USD I could also deliver you miracles in the "cloud software engineering world", but the truth is probably not.

If a pure software project would get that kind of money people probably would feature bloat to infinity. The JWST during its design phase were under very strict limiting factors. Volume limit, mass limit, power limit, etc. Compared that with any software project where obviously there are limits but they are much more malleable. You can argue that we need to provision 20% more servers to achieve our goal, but you cannot argue that we need to stretch the Ariane 5 by 20%. (Well you can argue, but the rocket is not going to get stretched.)

So all in all, it seems I'm agreeing with you. But I don't think it's about the quality or grownupness of the participants, but more about the shape of the problem.
this is patent trolling, stuff getting patented is control volume on speakers, swipe on mobile app, double tap to open something... completely obvious non-sense.
What to expect from the world's sixth mass extinction
Leave it to HN engineers to hand wave away going 10x over budget and a decade late.
My opinion? I began writing the stories that turned into Accelerando in 1998, largely to keep myself from having a work-induced nervous breakdown during the dot-com bubble. I finished it in 2003/04. It's journeyman work, and I like to think I'm both a better writer and a deeper/broader thinker than I was back then: it's no masterpiece, and I'm a little embarrassed by its staying power among the folks here.
You may think so subjectively. But there is no objective study whatsoever that would support that.
A timeline that shows every NFT on Ethereum before Crypto_Skulls
I (submitter) hit this with pre-commit, for whatever reason `pre-commit` hooks all seem to specify `git://` addresses, which had been copy-pasted into our config (some by me).

I've never otherwise used `git://`, and I simply changed them all to `https://`, but I suspect it's mostly that sort of thing that'll bite people - something suddenly stopped working because something else made that decision, and maybe it's buried in a dependency used in CI, and a python library for running git operations, so you can't even find it by grepping, etc.

So while mine especially wasn't hard to fix, I just thought it might be a helpful PSA for people to keep in mind and maybe remember if something goes wrong.
I helped run a world-class MySQL installation for one of the world's largest tech firms. The install was the most mission critical system at the entire company and downtime was extremely expensive.

I was hired because during failovers, the engineers were often getting unhandled runtime exceptions in the failover python code. (much of it was untested except when running failover) Often, the engineers would break one thing while cleaning up another thing. All of this was OK, because the system failed infrequently enough and was eventually replaced with spanner.
Can you use a brewing sanitizer like Star-San? I don't know enough about the microbes here.
Literally every commercial entity, including the ones with the actual best security teams on the planet, favors profits over security in multiple ways.
However, hopefully it’s not out of reach of the hardware we’ll have in 20 years. Even though right now our capability is actually less than 20 years ago…
If AWS is an option for you, take a look at the AWS Serverless ecosystem, particularly Lambda, Eventbridge, and API GW. I have worked with these (and other services) for large projects, and they work great, especially for Node.js based applications. Aurora Serverless V2 looks promising too, but I didn't have a chance to work with it yet, only RDS and DynamoDB.
As a counterpoint: I paid for jetbrains and switched back to VSCode as I prefer it for my needs.