skysight-inc/HackerNews huggingface dataset:
Wow, so many literary creative individuals doing unpaid work for fun is way more plausible explanation than random people being just fed up with their lives and wanting to vent.
Should we also pronounce the K in knight the way we used to? English and its pronunciation are democratic, it's about the way it's used by people - it doesn't matter what it was originally or what the inventor thinks. Trying to fight it just ignores the way English has always changed over time. Gif pronounced with a G or a J are both valid - because that's the way people say it.
exhibit A

> even though colorizing text is as simple as writing this \x1b[48;5;011<TEXT>\x1[0m
NPM dependencies go brrrrr again. Long live leftpad and the lack of stdlib!
Zerotier is typically used for privace networks, and AFAIK it routes through a central server whenever p2p is not possible. On the other hand, the Yggdrasil main net is a public network, and each peer is a router. You don't (and can't practically) connect to every single peer, but any nodes in the middle can route things the right direction. Also, Yggdrasil can run on top of existing tcp/ip like zerotier, but it can also run on custom mesh base protocols.
Before I clicked on the link, I was expecting some oversized 555 or 741 type of circuits.
I'm not sure what this is going to achieve for Marak but I can't help but sympathize and I can only imagine he is at the end of his patience - and who can blame him?

The Retool people who decided to literally fuck this guy with his own project should be ashamed of themselves.
I don't have any hard numbers as I don't think we measure children suicide very closely here in Argentina, but we had one of the longest lockdowns with remote learning and it seems to be children did ok. I posit existential dread and deaths of dispair, the modern anomie and so on, have something to do with advanced economic development.
It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had the most popular packages that's probably fine.

If I'm developing an app and wanted to use something outside of that "safe" registry, maybe I could, but I'd have to have a longer conversation with my enterprise's security org about why I'm using some new package that's not in the "safe" registry - and I'd probably have to pin or import it into my org's private repo.

It's up to package authors and this new Redhat-ish company that manages the "safe" repo to figure out how to split revenue back to package authors. The new company is definitely providing a service and should get to keep a cut, but hopefully there's enough left over to give some to the package authors - and that's incentive enough for the package authors to want to get their code included in the "safe" repo.

My company's security org is doing code scans/static analysis and version tracking and software BOM work of everything we're building, but ultimately none of this makes sense if I as an app developer can just add whatever I want and it's assumed to be safe if it passes the scans and doesn't have a CVE listed somewhere. We'd happily pay if someone was willing to try to vet packages (and take on some liability if they're wrong)
Nvidia Canvas update lets artists turn brushstrokes into hi-res deepfakes
The fixed global IP sounds like an excellent use of IPv6.

I'll have to look into running a node or two of this as an experiment.
Preferably as a wireless mesh.
Mounted in some high place.
Marak, author of faker.js and colors.js, with bomb making equipment (2020)
Then the package manager should be changed to make it more convenient.
Another group actually bought a cruise ship, the Satoshi... a fascinating story.

https://www.theguardian.com/news/2021/sep/07/disastrous-voya...
> Is it possible that the algorithm will fail to find a suitable tile and needs to restart?

Yes, the algorithm can fail. Since it considers only local areas when making decisions, it can easily make a placement that dooms progress later on. The best way to guarantee success in a given amount of compute time is to make tile sets easier to solve, for example by making it possible to transition from any tile to any other in a few hops. But this limits the amount of structure in the output.

> I don't understand, why or how you get those rectangular ponds and lava areas in the first youtube video. I expected them to be far more organic or am I missing something?

It's possible to restrict the tile set so that only rectangular regions are allowed. You do this by creating only convex corners. Here's an example:

Imagine you only have 10 tiles. They are made up of Ground (#) and water (~), and you want rectangular areas of water.

your six tiles are

### ~~~
### ~~~
### ~~~

#~~ ~~#
#~~ ~~#
#~~ ~~#

~~~ ###
~~~ ~~~
### ~~~

### ###
#~~ ~~#
#~~ ~~#

#~~ ~~#
#~~ ~~#
### ###

A valid tiling might be

#########
#~~~~~~~#
#~~~~~~~#
#~~~~~~~#
#~~~~~~~#
#~~~~~~~#
#~~~~~~~#
#~~~~~~~#
#########

The above uses all tiles except the all ground tile.

I can extend that water rectangle in either direction, but I can't add a feature like

#~~~~#####
#~~~~#####
#~~~~#####
#~~~~#####
#~~~~~~~~~
#~~~~~~~~~

Because that bottom center tile that allows the bend in the water does not exist in your tile set. Adding more tiles like

> How would do you ensure connectivity of areas or points of interest? Any ideas? Would you path a way before or after running the algorithm?

Great question! Let's say you have points of interest A and B, sitting on the ground

### ###
#A# #B#
### ###

You'll get a world with As and Bs scattered randomly. So let's connect them with a road (+)

#+# ###
#A# #B#
### #+#

Now you get worlds like

##########+#
#B##B##B##A#
#+##+##+####
#+##+##+####
#A##A##A##B#
##########+#

Repeating forever. But now add more road pieces

#+# ###
#A# #B#
### #+#

#+# ###
#+# +++
#+# ###

### #+#
#++ ++#
#+# ###

Now you have roads that slope up and to the right, always starting at A and ending at B.

######
####B#
####+#
####+#
#++++#
#+####
#+####
#+####
#+####
#+####
#A####
######

There are no dead ends because no road dead end tiles exist. Eliminating loops in the road while allowing any direction of travel is more complicated but possible.
What's the point of courts when the government will punish you even if the court finds in your favor? Australia is really heading down the wrong path.
Yes, the author of the tweet completely missed this aspect

I can't find the original article that was a great summary, but this one has most of the points

https://www.nytimes.com/2022/01/08/world/asia/kazakhstan-pro...
It's not the original gift that is the problem, all maintainers start very happy early on but keeping software up while adding more features is costly, someone needs to pay an it's almost always paid by the maintainer in terms of free time.

If you intend to keep it as the original gift, it will be called abandoned.
There's a well-established history of men getting very angry when losing to women in competitive chess so I don't think it's out of some gentleness. Some good background reading https://www.newyorker.com/magazine/2021/08/02/hou-yifan-and-...
How would explain the excess deaths models[1] that often show that if anything the COVID deaths are undercounted?

If the current COVID death total isn't accurate, what would be your ballpark estimates for the real death and case totals in the US?

[1] - https://www.economist.com/graphic-detail/coronavirus-excess-...
I guess at some point they’ll try to pivot this into “it was satire all along” to regain credibility, but there’s no wink here… someone really believes this stuff.
Until there's enough money in the pot that making your packages seem very important happens to be a productive use of one's time. At that point, you have to start dealing with fake downloads, dependencies added for no reason to somewhat more popular packages that aren't paying much attention... and suddenly you need to take money from the pool to pay for your fraud prevention team.
Upwork is the merchant of record.

Robin did, fraudalantly pay - to Upwork.

Upwork took their cut, and paid out to the freelancer.

Upwork discovers Robin's fraud. Guess what? This is why upwork gets a 30% cut. Upwork gets to deal with that.
I hate to defend Facebook/Meta but HN title is pretty blatantly missing context.

Even the linked post says:

> In most cases, law enforcement sends Facebook a search warrant or a government-issued subpoena for data. But Facebook policy also allows for “emergency requests,” where the tech giant will voluntarily hand over data outside of the legal process when police claim a case involves death or “potential bodily harm.”

So, it is unlikely that Facebook/Meta is just sharing your chat history over without just cause.

Regardless, you should be using Signal or WhatsApp for your chats anyways.
As with every other human institution, the issue is "trust", or "civilization" as Bruce Scheneier has pointed out.
It may not be possible to target specific uses of cellphone data channels, but this isn't much of a roadblock for the Iranian government.

They'll just shut down every cell tower within their borders. Iran is already willing to impose full internet blackouts (https://en.wikipedia.org/wiki/2019_Internet_blackout_in_Iran).
I believe DNS works like normal with there being AAAA records for yggdrasil's 200:: ips. y.matrix.tomesh.net vs matrix.tomesh.net is an example of that
Was going to mention that a lot of ISPs de-prioritize ICMP but I get a sense that OP might be aware of that.

It'd be cool to see what a long running mtr in TCP mode says about Starlink.
I like the minimal feedback as it is right now: you just have to try again.
The replies here (and on twitter) really are making me realize a lot of the hurt that will possibly stem from marak's actions really were ripe to happen given the sheer number of javascript developers who don't understand at all what they're doing.

IT people for some reason tend not to be great at introspection which tells me this won't be fixed because this is more than just one asshole dude, this is a systemic issue with js and web development as a whole. This sort of thing would be really hard to accomplish in Linux for example because of the mentality they adopted early on when Linus had his first burn out moment, but the fact that even after leftpad nothing has changed really shows how systemically broken web dev is.
Ethereum co-founder recorded explaining how to “disguise” ICO ETH purchases
There's a shingles vaccine, though it's only approved for over 50: https://www.cdc.gov/vaccines/vpd/shingles/public/shingrix/in...

Doesn't seem to be much out there about whether that is because of insurance coverage or if that is the population they tested in or if there are additional factors.
At my current job I'm trying to establish the same. Have to say, the recent news are water on my mills!
> Sorry that happened to you. My family is dealing with multiple health issues too.

I'm sorry to hear that. What's worrying you the most at the moment with relation to the health issues?

> $110k USD is likely to be a very large amount in your country, as it about 150% the median household income in the US.

It is a very good income for this part of the world, and also a good income for the US as you say. While higher pay can get you part of the way, there's some things that it can't get in my experience. For example, if I take out private health insurance at Allianz, it doesn't cover pre-existing conditions. Company-sponsored health insurance does usually cover pre-existing conditions.
Predicting the supreme court would become more conservative during a conservative presidency and senate was not a hard prediction. Ginsberg was known to be in poor health, but I guess you could count that as a successful prediction.

But the other details are all wrong. There hasn't been a Protestant on the supreme court in awhile, let alone a fundamentalist.
A mathematician explains what Foundation gets right about predicting the future
I run locate and found both colors and faker on my laptop as dependencies of Postman. Color's license is MIT. Faker's is custom but basically MIT too.

The maintainer has every right to change his mind and/or stop maintaining those packages at any time. However the outcome (Fortune 500 companies using his work for free) is consistent with the choice of the license. With insight that was a mistake to start with. Maybe a FOSS license plus a commercial one would have bought him money but maybe those packages wouldn't become as popular as they are now. Everybody should dual license for mutual protection.

Finally, breaking other FOSS projects and not only commercial ones is not the nicest way to complain against companies not paying him. Furthermore, honest question, did he ask them for those money?
I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.
I have not seen a serious plan to tackle climate change that wasn't just political rhetoric. I think almost nobody takes it seriously, they just see it as another hook to push their politics.

If we were serious about it, we would be focusing on technological solutions, not social control or politics. I've seen companies working on that, but otherwise it's barely part of the mainstream narrative. We need to reject political motivations and look for how to solve the problem (and mitigate changes that do occur) in real life with the technology we have available.
What about this https://hbr.org/2021/09/who-is-driving-the-great-resignation ?
The truth is that it become a race to the bottom with a lot of open source projects, specially the ones that are not hard to replicate.

If the author made the project GPL, someone else would create a similar library with a more permissive license, which would end up taking the market and making the original library irrelevant.
Sure you're using a service to abstract yourself away from RSS, But at the end of the day those services are still getting that content via RSS
On what basis?!
The greatest player in the world, Magnus Carlsen, is characterized by his refusal to quit when behind and to get blood from a stone in the end-game.
Yep, that was the reference.
The "personas" PDF available in the link is by far the most interesting part of the post to me.
Just take the last thing in this article. It links to an obscure blog by some crazy person that hasn't updated in 4 years.

What's the point of this? Cruelly mocking some mentally ill person's posts from years ago, as proof that "the future is unpredictable"?

Or claiming brexit is economically worse than covid. Massively disrupting the world economy for 2 years is less bad than some regulatory changes in a single country? "A crewed moonbase by 2031"?
I know. I’ve been working on making more subtle jokes :) I was hoping someone would go look and make that comment though.
The TV news yesterday said 50% of Covid positive patients were in the hospital for non Covid reasons. This is incredible to me. Is 50% of the general population Covid positive? Are people heading to hospital more likely to be exposed to Covid than the general population, perhaps via doctor visits. While that does seem possible, 50% still seems incredible to me. Is there something wrong with testing?
Sure. But that works both ways.

If you're not going to support the development in any way, then you don't get to have an opinion on what should be done or complain about bugs.

Honestly, even then, I think we're stretching it. Maybe at the surface it seems like it should be that way, but this isn't just some tiny package that a few companies are using. We're talking about tens of millions of downloads every week. This package has essentially gone and become public infrastructure, much like log4j.

The companies relying on it should realize as much and understand that it's in their best interest to ensure that the package keeps on being maintained.
Are these really RCE vulnerabilities? Looking at it systematically I only see this as an RCE vector if you're doing one or more things very wrong. This assumes that packages are immutable and an author can't update a version that's already there. This is how NuGet works, and IMO is how any remotely sane package manager will work. There's no reason for a version to be mutable in this context.

Pegging to a specific version limits exposure. Syncing these packages to your own on-prem/isolated environment limits it further. Deploying all changes to a test/staging environment where they're reviewed first limits it even more.

I mean yeah if your build process takes @latest of all your packages and then pushes it right into production, that opens you up to a lot of risk. It's also incredibly stupid for anything beyond a personal project (and probably even those).

This doesn't strike me as a weakness in package management, it strikes me as a weakness in doing package management wrong.
Free as in freedom is not the same as free as in beer.

This model where someone develops something for free and then those that benefit the most don't contribute back isn't sustainable. I don't know if the packages owner was conscious about it but this was a political act and hopefully the impact will be positive.

From where we are we have two options:
(1) companies find a way to make open source financially rewarding;
(2) companies use their own crap instead.
In America, most unskilled software developers make somewhere in the $80k to $140k range. A living wage is around $20k for absolute bare minimum essentials. Skilled devs still get around $200k.

Point is, maybe 10 people. And that’s if you like ramen.
They are weak but Kazakhstan is much weaker.
> the millenial hard work essentially ruined their health

Is this referring to a specific trend or statistic?
There is probably a tax dodge in there somewhere.

Something like, the employer provides free low speed electric car charging to the public because this is good PR and shows that they're green and encourages customers or clients to hang out on their premises.

But then since it's available to any "members of the public" yet using it involves parking your car at that company's building for eight hours, there is high uptake of the service by employees, and the company is sure to mention their green initiative when recruiting new workers.
All societies are heavily gerontocratic, democracies or not. Of course for any crisis this always happens, see climate change, 2008, etc.
If that’s the case I would expect Upwork to charge a lower fee when freelancers are not using the tool
That is how words work, they evolve as the consensus pronunciation evolves, they do not stay forever static.

This gives us an easy solution to make everyone happy though! We gust have to change "graphics" to be pronounced as "jraphics"
I want to see a technical plan to solve it. With carbon trading the one sure thing is that somebody is going take 1% of the money going by and spend a small fraction of that lobbying politicians so they can keep their privilege. Many cheap but unreliable schemes such as ‘not cutting down forests’ and grinding up olivine rock at the beach will waste decades.
No. It was the LA flight immediately prior to the LA flight that crashed.

They trimmed it back to normal a couple times, then just turned it off.

Sounds too simple to be true, but it is true. There's a toggle switch on the console that cuts off power to the trim system. It's there in case of runaway trim.
> Lex Fridman (pronounced: Freedman) I'm an AI researcher working on autonomous vehicles, human-robot interaction, and machine learning at MIT and beyond.

Honestly does not sound too reputable to me on this specific subject matter.

Edit: I realize now that you are saying to listen to the podcast guest, not Lex Fridman himself. Is this the episode? https://www.youtube.com/watch?v=oIOGUYOPAsA
> they're impossible to shut down

They're impossible to shut down without (potentially) affecting innocent bystanders. If they don't care, they absolutely can and do shut down towers.

In this case, if they judge anyone broadcasting or using this network as subversive, then there are no bystanders, only accomplices. And, thanks to the tyranny of the inverse square law, it becomes much easier to sniff out broadcasters/uplinks as well.

The easiest way to mitigate this is to do both -- rebroadcast a cell connection over WiFi, and do so intermittently and in varying locations to complicate triangulation.
How was this accomplished?

The original was like

while(true); render();

now its like

while(true); render(); sleep(); ???
Mainstream != routinely, and yes, I agree.
Yikes, it's one thing to stop development of somethign but another to intentonally do damage to thousands of people, big companies and small one person webdev shop. This guy probably can't be sued because of opensource, but he should be shunned in the future by open source advocates and just the public in general. Why would anyone hire him unless it's to run an antifa/right-wing website?
Wow. Where to begin. :)

> …there’s only one client…It’s encryption that lasts as long as the owner thinks it should last…

I think this is a big leap. It’s a open source client with verifiable builds. If a future version removes encryption, users will migrate to Wire, or Threema, or Matrix, or whatever. How does there being only one client make the encryption non-resistant to an adversary?

It’s genuinely unclear to me what you consider the difference between:

- Multiple open source clients, distributed as source or prebuilt binaries, possibly signed and verifiable, possibly downloaded over TLS, depending on what Linux distro you use. <— This is the state of the art for most open source software.

- A single open source client, developed in the open and distributed with verifiable builds where feasible via broadly reliable and unlikely-to-collude third-party distribution mechanisms (the app stores). <- This is how Signal works.

- A single open source client, developed in the open and distributed with verifiable builds everywhere. <— This would be nice, if the app stores would support it!

> The point of defining an adversary is…not just noticing if they do

Well, no, I disagree. As a prominent example, Certificate Transparency.

“Noticing”—aka accountability—is extremely useful. As I noted above, there is a multitude of free, secure Signal competitors. The only thing that keeps millions of users using Signal is trust based on accountability. Building better accountability mechanisms means that if Signal violates that trust, users can switch, before they discuss hiring hitmen/buying meth/overthrowing the government on an unencrypted channel.

> …threshold signatures…

TBH, I didn’t read this part of your post that closely. There is a lot of work being done on binary transparency, and your proposal seems broadly in the same direction, but I’m not following this space very closely.

What I don’t follow is why you think it requires multiple clients.

> …you can just switch to a better implementation…

Aha. And here’s your point—not that a single client thwarts encryption, but that a single client for a sufficiently sticky centralized service would reduce the ability of users (who may not care that much) to switch away, should the encryption be disabled.

And sure, I think this is true to a degree. But as Aol/Google Talk/WhatsApp-post-ToS-change can tell you, messaging is not that sticky!

Anyway, ultimately the market has spoken. Ping me when everyone is using XMPP/Matrix/whatever. In the meantime, I hope the Signal Foundation keep building usable secure products for people like me. When they sell out, I’ll switch to Threema.