skysight-inc/HackerNews huggingface dataset:
> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort

So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular?

I'm also a little suspicious of the claim that it's the exact same, because Faker has a lot of functionality under the hood, but you've more or less demonstrated why it's useful in this comment.
I wouldn't call that a trojan. It is being an asshole though.
not to mention that in the case of colors.js he actually owned less copyright than other contributors. they had actually changed more of the code.
It's a really good book. But does anyone know of any more up-to-date high quality biography of Bill Gates including his time leading Microsoft in the late '90s through the trial?
A psychotic person who has the money to pay an attorney to draft a law suit....that is more unlikely that building a unicorn and it's a whole lot more productive to focus on that rather than bad actors out to harras you.
No one reads licenses lol. The intent is the same as a trojan: making software malfunction for the intent of either economic gain or geopolitical goals. Intent matters; there is a fundamental difference between shipping crappy code for fun, and making good code break without warning for thousands of users.
You may try Windows key + D to hide the desktop or Windows key + M to minimize all windows.
If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.
Maybe the easiest way to visualize it is that there is no filesystem at all. No shell, no "libc", no "ssh into the machine", no "cp", "mv" "ls", etc.

They do provide a way to get one filesystem in place, but you can only interact with it using golang calls within your application.
IANAL but i highly doubt that that license would protect you if you were being intentionally malicious (as opposed to say grossly negligent).
Note how I did not state the people doing the stealing are poor. If you think they are, please explain the many images of people driving up in fairly new and rather shiny cars to fill them with looted goods.

This looting is not done by "the poor" and they are not stealing "to fill their hungry children's mouths". They are looting because it is free season, they'll either use or sell off whatever loot they get and spend the returns on whatever they fancy.
I've read many papers on inflammation and it's myriad of causes, so I already do avoid those, and family sibling tobacco as well.

I do hope this info can help the OP.
To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions.

The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone claiming to be the author’s credentials.

Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.
No strong opinion. What's more important though is adoption of some interoperable standard. So far we have a huge amount of AOL/Compuserve-esque era style IM walled gardens that still refuse to interoperate. Which is ridiculous.
Or the crappy audio from the smartphone video didn’t portray the sound well and isn’t a good tool for diagnosing vehicle issues.
> The intent is the same as a trojan

A Trojan is where the attacker gains direct access to a protected system. It is a back door disguised as an innocuous file. The whole point of the Trojan Horse was the Greeks hiding inside of it to get into Troy.

Where is your evidence that Marak Squires gained access to any of the systems that downloaded and used his packages?
>re-invents most of XML.

That's fine though. Only a few bits of XML make the format very cumbersome to support.
I don't see how it's immoral. If someone wants to sponsor Marak personally, they can do so easily. If people are donating to the project under the false belief that the money is exclusively going to Marak, then that's their problem for misreading the details of what they were donating to.
If we applied your logic everywhere, moderation wouldn't be allowed. That also seems pretty bleak.
If you do this with C++ destructors, they will sure enough fire at the end of the scope. Even if your String is long gone, the destructor fires anyway, destroying... a hollowed out String left behind to satisfy the destructor.

But go ahead and try it in Rust, your print doesn't happen because nothing was actually dropped. The String was moved, and so there isn't anything to drop.

https://gist.github.com/rust-play/4bbcc2a4efb641e578e84a1962...
This person just invented a very handwavey GAN
The short answer is...there are many universal data formats for resumes [1]. Longer answer is that actually coming up with a universal data format that encompasses all the nuances of all fields that use resumes is actually HARD and no one wants to halt their hiring process long enough to solve that problem. Longest answer is that if you put your work history, education, and a title in a PDF, then you already are conforming to a universal data format...just not in the way you may be thinking, and data parsing is not the hardest problem in the hiring process.

Until choosing candidates actually becomes automated, no one will care enough to do this.

1: https://xkcd.com/927/
Good. Second Reality 4ever.
Finally. Thank you!
Thanks, I suppose I'll read it myself to get a better idea of the degree of interpretation involved. There's a comment on the Atwood article which makes a point similar to yours above and Atwood's reply is very odd:

https://discourse.codinghorror.com/t/the-ten-commandments-of...

He seems to think these are, in part at least, quotes. And it's not just the "guy in the room" bit - when the commenter points out the book contains no 'commandments', Atwood doesn't say 'Oh, I just summarized it in list form'. He says he doesn't know where the text came from (?!). It's like the Atwood piece is itself derivative of something and it's not just the book and Atwood's own writing? Weird.
Well as long as there is a lot of tech hype about it we will continue attempting to cut through the bullshit buzz words and point out the good and the bad and the worse.
> vector-based UI just doesn't look that good on those

Counterargument: Fonts are vectors, and with sub-pixel hinting they can look pretty good on low-DPI monitors
I think you misread "days" as "weeks
Awesome! This sounds great.
I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day.

Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.
I mean... don't torpedo your own project that other people use and you won't lose funding.
It's not as simple as just scaling the UI to the size of the screen though, because the UI elements should be bigger at the same screen size if the scaling is higher. That's why, like you mention in the article, you'll be able to tell when the setting has been changed simply by looking at the scale of the UI: because it will be wrongly too small once the setting is activated.
> As of April 5th 2017 with the release of Windows 10 Version 1703, SetProcessDpiAwarenessContext used above is the replacement for SetProcessDpiAwareness, which in turn was a replacement for SetProcessDPIAware. Love the clear naming scheme.

This is the kind of thing I hate about "New Windows". Once upon a time MS used to strive for backward compatibility. These days every few years there's a new function you need to call. You can't get optimal behavior just by writing good code from the start. You need to do that, and also call the YesIKnowHowPixelsWork api call, and set <yesIAmCompetent>true</yesIAmCompetent> in your manifest to get what should be the default behavior. It's a mess.
I don't know that I'd ever really "trusted" Wired as a news source, but yeah, reading something that has obviously undergone some kind of hard ideological editing completely unrelated to the content of the article makes it very hard to bother continuing to read.

(And ironically, the message that pregnant women are hesitant to get vaccinated, is completely lost amongst the ideological nonsense. Notice no comments about the actual putative topic of vaccine hesitancy during pregnacy).
I went 64->128->8088.

When I went with the 10 MHz 8088 with a 40 MB hard drive I also looked at the alternatives of getting either the Amiga 500 or just getting a Lt. Kernal 20 MB hard drive for my 128.

The driving factor for needing more storage of course was for my BBS at the time.

In all I’m happy I went the IBM compat route.
Do you also have no issue if GitHub just transfers Marak's repo to the new team? Or all the stars? Since obviously most of people are starring the "project" not him.
ISPs and hosting providers can and do take abusive accounts offline if necessary.

Routing means that endpoints can usually be identified with reasonable accuracy.

In the early days, access was through a very small number (single digits, double, a few dozens, a few hundreds) of organisations, mostly US-based research universities. When I first had access to the ARPANET / Internet, if I was abusing resources, I got an email, or visit, from the campus systems admin.

A substantial portion of present-day ISP and datacentre operations is geared at abuse detection and mitigation, both ingress and egress.[1]

Unmanaged mesh ... seems to present a much greater problem here and the entire question is simply hand-waved away. As you're doing here.

________________________________

Notes:

1. Much of this information is informal, but as a recent high-level overview (2017) see: https://abusix.com/resources/isp/what-security-should-an-isp...
I'm in Australia, we do make use of the warm weather a lot. but we still used these indoor racks as well as the tumble dryer.

Reasons why:

Smoke and ash in the air from bushfires/burn offs.

Free power from the sun (solar) and its just too damned hot to go outside.

Small items like socks and jocks are tedious to hang up and we can use the above reason to bang them in and get them done quickly.

Didn't get time due to work etc commitments and leaving them on the line in summer often means sun-bleached clothes.

(bonus reason) Wife is terrified of spiders, and I've been too lazy to clean them out of the clothesline area :-P
I just wish we had some good alternatives.
Faker.js is why software should move a lot slower. There's no other industry this unprofessional. "But....vetting every single dependencies (supply chain) is tough and we can't really know which one to trust (which is why we have certificates)!!". It will never happen tho, because software is too ephemeral for anyone to give a shit about, "leaking millions of personal info" doesn't feel as bad the thought of myself "falling off a faulty chair".
"Future-proofing for the introduction of leap months."
> a lot of engineering work of dubious to negative value

Part of this is that FAANG is often willing to spend $20M to try to move the needle 1%, or $100M for the next big thing, even if there's only a small chance it works.
True, I've never dealt with that issue.

People have been killed for a lot less than $100M though.
> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain?

I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history.

Also, if we really want to go that way, Google Search is also just a product that spits out strings. And a few orders of magnitude more over-engineered ;)

> But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been.

Well, they have a larger team now, which can reasonably prevent a single person from doing that kind of damage when set up correctly. What other root cause are you looking for? Mental checkups for open-source maintainers? Redefining the "free" in free software?
Channel 4 seems to work well. Publicly owned but not publicly funded (taxation, license fee, etc).

The corporation created which runs it has certain conditions placed on it to create programs in the interest of the general public that may not get created by a private corporation looking to only make profits for shareholders.

Of course the current UK government wants to sell it off...
No, "several previous jobs" and "each time, two days of effort" does come out to a week or two.
> Instead one should write tooling that produces decoders that preserve the original encoding of signed data.

That's an interesting idea. How do you evaluate the tradeoffs in this design? I.e., what does it buy you compared to saying that you need to sort in tag order, for example? (Assume that you have something like an automatic tagging environment for sake of argument.)
Does anyone know if drinking coffee black stops autophagy and "technically" breaks a fast? I seem to recall reading that a while ago, but can't find the source.
Google has 411m hits for Node.js and 66m for nodejs. I'd guess somewhere in the 66 million people calling it nodejs, we could find a real diamond in the rough if we heard them out at the next interview!
It's really nice to have a project that someone's thought through about how to build sample data a lot more than I have time to think through.

Could I/anyone else build this? Of course. Could I do it so thoroughly, provide support for it, and still do my day job? Not easily, not as easily as I could install this project and use it.

Also keep in mind it's not like those 8 contributors are throwing a full 40 at this project every week.
Packages are written by people not algorithms. People you have to explicitly trust to install the package.
Why isn't there a universal data format for advertisements? Same question.
The amount of unnecessary drama and politics surrounding NodeJS has ensued I will never use it.
Weren't Lego sets very popular around Amiga best times?
This exists, it's called crev: https://github.com/crev-dev/crev

As you note, this doesn't require a blockchain. crev uses a web-of-trust model which is pretty well suited to the task.
"Prize-winning poet Shelley Puhak is the author of the new book The Dark Queens, from which this story is adapted."

I don't know if the author is a historian, and she doesn't present herself as one. I'd take that into account when reading the article/story.
If it isn't LA's responsibility why is Union Pacific asking LA's DA to stop releasing suspects who were arrested for theft? [1]

[1]:https://twitter.com/CBSLAKristine/status/1482115852216385538...
I completely agree with this take.
>"The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful."

This Tuesday is the 10-year anniversary of the SOPA/PIPA blackout [0,1]. Half of the tech internet crippled their own functionality for a day, in an act of political speech. (Was GitHub part of that?)

Tech culture has surely changed since then!

[0] https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA

[1] https://hn.algolia.com/?q=sopa
>I'd love to see a "pure" x86 implementation without any of the user-hostile crap, and see how far the community can take it;

And who would make the tens of billions of investment to build a fab for that?
Oh it definitely exists, and this might be one place where it could help, but it's not sexy, and it won't make you rich, so nobody is bothering.

A lot easier to pretend NFTs are more important than collecting stamps.
Nothing. But my ideology is mainstream, and it is incompatible with the other one. The other ideology can have Voat. Why should they also have Reddit?
I would simply get rid of the political actors telling me it's immoral to maintain social order.
the diet soda thing sounds like a *tol sugar thing.

look into the FODMAP stuff that monash uni is doing..
https://www.monashfodmap.com/
Thank you! I will try those videos out.
DNA Mutations and Randomness
Early firewalls, like Checkpoint for example, did exist. They were, however, not widely used outside of the enterprise. I worked for several small ISPs and typically only larger enterprises even bothered. Small companies and even universities had public IP on the desktops.
Wow this is a game changer / landmark advancement
Some of the best hospital clients I've had have been doctors who are smart enough to understand that info tech knowledge is almost as important to them as medical knowledge. If you spend the time with them to advise on how to best implement their ideas for new systems/processes then you can end up with the best possible win/win result.

That said, you have to know what you are talking about or admit you don't. Doctors are used to being mislead by the best, and if you try to mislead or bullshit them they will know and you've lost their trust. Admit when you don't have in depth knowledge about what they are asking for and they will respect you for it. In a lot of cases you may be able to learn from them, as there interest is specific when you will have to deal with the entire environment.

The other important thing is don't waste their time. A lot of Doctors are working 18 to 20 hour days, and don't have time for you to be disorganised. If something is going to take a long time to do, then tell them so they can plan around the job. If a quick task suddenly looks like it's going to take longer, let them know as soon as you can so they can plan.

Keep at the top of your mind that the clinical staff you are supporting are their to save the lives of real people, they are not there at your convivence. Remember one day you will be a patient and you don't want your doctor to have to stuff around with a unhelpful IT specialist.
Is it just me or does a subreddit with only 90k members seem too small to matter?

Especially amongst India. Their population is huge, you would need a much larger reach to influence culture.
I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).
A computer that requires the firmware to be replaced to boot Linux is already at the point where 99% of users are just not going to install Linux (I've personally ported Coreboot to two of my laptops, and even I would never buy hardware that required me to do that before I could run Linux).

And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based attacks have existed for over a decade, and the Hacking Team leak included a firmware implant targeted at some ThinkPads. Do I think most users need to worry about this? No, I don't, and I don't know that there's enough people who do need to worry about this that it should be the default (I have thoughts on this, I'll write them up later this evening). But to deny that some people do need to worry about this is just inaccurate.

And Microsoft has required secure boot and TPMs on all certified client systems since Windows 8.1. Almost all shipped hardware already has all this functionality. If Microsoft had any interest in being evil here, they've had the opportunity to do so for years.

Anyway! Even if you can't replace the firmware, the secure boot database is in an unprotected variable store, so you can just replace it even if PSB is enabled. You're welcome.
A standard requires people to agree. When I was in college, I was told that a resume was a list of buzzwords and past jobs. 1 page max. That got me quite a few jobs. When I interviewed at Google, people were like "this is it?" when looking at my resume (not that it mattered). I started doing interviews and saw the resumes that ended up at Google and they were all multi-page affairs with details about all the projects you worked on at a job. I started doing that, only to be told "wow, that's a really long resume". (Hint: if your role requires 10 years of experience, applicants are probably going to have a long resume!)

The key point here, I guess, is that a lot of people have told me my resume is in the wrong format, but I still got the job. What's the right format for one employer is the wrong format for another employer. So there is no way to win. I now have no clue how to write a resume, but it also doesn't seem to matter.

(Still bitter about how few people ever look at my Github, though. People put that as a custom field in their automated system, and then the interviewers have nothing to say about my projects!)
> I don't really get the example of being able to work from home, but I would expect differences are extremely regional/national.

In some countries (the US is an example); there's a social class aspect to vaccination; highly educated people are more likely to be vaccinated, and also more likely to work from home.

However, if this was a big factor you'd expect vaccines to appear dramatically less effective in near-universal-vaccination countries, like Portugal. That doesn't seem to be the case.
> That's what resumes used to be, after all -- a kind of a take-home test where you really do have enough time (and perfect knowledge) to get everything 100 percent right.

The only thing this filters for is people who have been looking for a job for a long time and/or are people focused on presentation instead of content, good luck with that.

We’ve hired incredible engineers across that have had typos and major resume mistakes many times and they had no communications problems on the job.

A resume is a background/interests check for the hiring manager. Giving them a spell check is about as useful as measuring the ratio of times the letter ‘a’ appears relative to ‘e’.

> critical business communications at least -- this level of correctness does matter, and it matters a lot.

This sounds like someone who is unable to contextualize when that would be relevant. Unless you’re writing user documentation there are zero times in an engineer’s day-to-day communications where writing nodejs instead of “Node.js” would have any impact at all.
A Science Journalist's Journey to Understand AI
Well said.

https://devblogs.microsoft.com/oldnewthing/20081211-00/?p=19...
>I'm not sure if you're being satirical, but open source x86 cores do exist --- they're around a 486 in terms of compatibility.

And they will stay at that level, is the parent's point, which is 25+ years before today and thus affordable to clone and fabricate. It's not about 486 or for that matter 8086 beinh difficult...