skysight-inc/HackerNews huggingface dataset:
Hi! Author here. I write a lot more Rust than Javascript these days, and I agree - this is absolutely a problem I'd love to eventually see addressed in the rust ecosystem as well. (Although dependency madness hasn't kicked in anywhere near as much in the rust ecosystem).

But rust and javascript each have unique challenges. Per-library sandboxing is hard in javascript because of the language's dynamism. Its hard in rust because any code you pull in can always drop down to unsafe, and in unsafe land you can really do whatever you want. We could probably selectively ban eval() in modern server-side javascript pretty easily because its just not used that much in modern code. But we can't ban unsafe in rust because its sprinkled everywhere.

> One of the practical outcomes of this trope is people trying to solve this problem in narrow, ecosystem-specific, non-portable ways.

I think trying to solve this in every language at the same time would be an exercise in boiling the ocean. There's no need to implement something like this in every language all at once. Much better to start somewhere, experiment, and hopefully if the solution works well we can see how it might apply in other languages.
The constant outrage around pronouns, systemic racism, and others is specifically engineered and pushed forward to hide the rich vs poor problematic and keep people busy and with the feeling that they are fighting the system.
Wow, those all look fantastic. Thank you for sharing!
Codespaces is great in my experience. VSCode devcontainers is another very similar approach that will keep it on your machine but at least containerize the development environment raising the bar fairly significantly for a rogue package to do serious damage on your machine.
I certainly haven't used it that much, but I never felt like the connection quality was a huge concern for a usable DE. It's something like 30 years old now isn't it?
> black people do roughly 50% of violent crimes

Thank you for this information. So do you support the fact that police in this country are working as a judge, jury and executor?

I am sorry, but if I were you, I'd be ashamed to use such justification for people's killings.

Let's focus on the issue at hand, policing violence is a problem that needs to be addressed, putting the blame on one side or the other because "they're more violent" is not a good start to any serious discussion except to shield police from their actions.
Linux solves a part of the problem, it has user accounts with restricted access.

Create a dev account and run node within that account.

This solves the full access problem, but not possible backdoors or leaks of your app.
Come over to r/transhumanism mate :)
If that is supposed to imply that the major coin holders can change the monetary policy to increase the supply, because their holdings give them power over the network, then no - it doesn't, and they can't.
But this is also a problem with using Excel for this. Let two other people edit it, and now you've got 3 different versions of the data. Which one is correct?

Having a single database and giving two other people access to it keeps the data centralised and keeps a single source of truth.
> Well of course Disney future theme park earnings were going to increase from zero. You aren’t considering the actual E/P ratio.

This isn't how investors think. If you know that future earnings are going to increase from zero due to outside circumstances (COVID, in this case), why would you base your analysis on past earnings? The past earnings don't matter, especially when you admit that they were heavily influenced by COVID.

$1 of recurring revenue from subscriptions (Disney+) is worth more than $1 spent at a Disney theme park. The recurring revenue costs less to service and is more predictable going forward. This is why businesses (like Adobe, Apple, Disney, etc.) have been working to shift revenue towards subscriptions over one-time purchases.

> Those “investors” you suggest were the Fed using taxpayer money buy and prop up the stock price. With the Fed money Disney stock price once again reached a new all time high price and a P/E ratio over 90, meaning the Fed was bailing out shareholders at a historic high of $90+ to $1 earned, where an average publicly traded company should be closer to 13-14.

It feels like you are working backwards to try and find the nefarious actions you are so positive about. The Fed deciding to bailout companies and consumers obviously helped businesses (especially consumer facing businesses, like Disney). The entire stock market exploded when it was announced.

The P/E ratio of the entire S&P 500 spiked from around 20-25x to 40-45x due to Fed and Congressional actions [1]. Average publicly traded companies do not trade at 13-14x P/E, and low interest rates for decades have made that a fact. That said, Disney isn't a traditional company because their investments and growth in streaming make them look more like a growth stock. Which is, again, reinforced by their record revenue numbers.

[1] https://www.multpl.com/s-p-500-pe-ratio
The post has two things to communicate:

1. The Node supply chain has serious problems when it comes to security: this is true

2. The strong implication (throughout the article but most prominently in the title) that these problems are either unique to Node or at least worse in Node than elsewhere. This is definitely not true.

---

The solutions cited in the article are good, and definitely benefit the Node ecosystem: --ignore-scripts is a well known option that would be great on-by-default but tends to be enforced in large corp CICD currently. The capabilities model is not too different to what Deno do (this article's idea is somewhat more fine grained but much more complex which could hamper adoption or lead to misuse).

Overall both would be of somewhat limited, but still very worthwhile benefit.

The hard problem imo is solving more generally for supply chain trust. We implemented --ignore-scripts enforcement last year and have only really see it have a relatively small impact, despite it being relatively new as an idea in the past few years (which motivates more exploits due to its novelty). In reality, most supply chain attacks are either targeting prod envs, or integrated build dependencies, rather than piggybacking CICD repo install steps: the later attack gives you the same env access and has no package-manager-specific mitigation, so it needs a more general solution. Capabilities also have limited use outside install scripts because limiting them also limits the "benign" functionality of your normal application code.
These sorts of abuse work on the implicit threat of retaliation if you don't agree to the abuse. A union provides a roughly equivalent counter-threat, which acts as an incentive to not be so abusive.

Would we love to not operate on threats and counter-threats? Sure, but that would require the mutual consent of both parties, and the ones in power have rejected that outright.
I've been working in tech pretty much my entire career (about 20 years at this point) and I haven't had an 'every day is exciting to me' situation in at least 10 years.

There's so much bullshit everywhere nowadays, and despite a red hot tech market I'm having difficulty getting decent job offers outside of healthcare, insurance, b2b, and fintech, which I'm guessing are probably the worst fields for that bullshit (part of that is probably where I live, admittedly, those are the biggest industries here).

Finding some fun again playing around with VR development in my spare time, though. Maybe I'll make the shift to that in a year or so after I build up more experience at it, make a small game or two, and start feeling excitement again.
look into the lightning network
> the main problem isn't that we have malicious actors manipulating records, it's that records are incorrect, incomplete, or become stale. Blockchain technology does absolutely nothing to address the real problem.

Or they address it in a blindingly stupid way: How do we deal with records that are incorrect, incomplete, or stale? Blockchain maximalists: treat it as authoritative forever without a mechanism for correction!
If you distribute HTML via http it is the web. If you distribute it some other way it is something else.

You can certainly take notes with HTML but it seems people would rather use markdown. So far as "alternative to PDF" I'd say SVG is based on similar capabilities (vector graphics.)

For either one of those cases people might use "the web" to store or deliver those HTML files.
It's heresy to say that the races, having evolved in different environments for millennia, likely have different average levels of intelligence, consistent with patterns of scores on IQ tests and college admissions tests. Charles Murray's book "Facing Reality: Two Truths about Race in America" (2021) expounds this heresy.

The proposition can certainly be debated, but it's important that it is debated rather than shunned as heresy, because if it is true, pushing to make blacks represented according to population in high-IQ professions such as law, medicine, and engineering will erode standards and reduce productivity in those fields.
there is already a project that does most of this: deno. there are of course other motivations that differentiate it from nodejs but i think this should be part of a new runtime that was build with this in mind, deno is the way forward. Of course putting your projects in appropriate jails/zones/containers/vms is also an option, but that has always been true
Package curation exists in other languages, too. C++ has Boost, and Haskell has its Haskell Platform. It helps avoid the pitfalls of languages with large standard libraries (where stability guarantees make "batteries included" turn into obsolete and bitrotting "dead batteries").
I'd like to qualify his statement. I like the idea of moving away from Windows, but playing certain kinds of games with close friends and family is a big part of my leisure time. And as much as I want Linux to be ready, some of the games I like to play simply don't work on Linux. At all. All of the games I like work on Windows. (MacOS is, of course, much worse. Of the games I've spent most of my time on over the past 2 years, only about 20% even run at all, let alone with decent quality settings and frame rates.)

None of the games I like rely on anti-cheat. I think Linux is leaps and bounds closer to being capable of being used as a gaming desktop than it was just 10 years ago, but it's still very much true that game developers (and hardware engineers) focus on Windows first, and make sure it works there, while Linux is largely an afterthought.

If I had chosen to run exclusively Linux, there would be countless times I'm left in the dark while my friends and family were playing games without me. Obviously this might not apply to certain classes of game players, but for me, that's way too high a cost to give up Windows.
If you are on a Mac, using Transmit (https://panic.com/transmit/) you can mount a SSH/SFTP connection as a local disk and edit there in your editor of choice.
True. I will add that it is customary to justify it by demonstrating it is some sort of acronym or contraction.
Perhaps try $1Hugs?
Throw apt/snap/pacman/whatever into the mix and the answer is still "nothing". People act like package managers are somehow the end all but they're no more secure than going to a random official site and downloading some shit, it's just streamlined the process somewhat.

In fact the latter is probably more secure, since the more the packages depend between each other the worse it gets. One random dependency can be hijacked and will be autoinstalled everywhere. Or someone can delete it and break half the internet as we've seen time and time again.
Engineers often fail to realize you can't cheese a judge and if you try to, the law will come down much, much harder on you.

Either one of two things will be the case with this approach:

1. The algorithm will be too imperceptibly different to be treated as a different program. Adding some tiny decimals somewhere won't make it unlikely to make the same mistakes, and the entire class of algorithms will be treated as one.

2. The algorithm will be different enough to make different decisions, which means one program is probably "better" than the other(s) and they'll be taking a bigger risk by deploying cars to the road that are more dangerous than others.
On the contrary, it's quite obvious that the rich emits far more than the poor. Even if the rich can accelerate their switch to renewable, they still couldn't fly more. They can't buy too many cars / houses, etc. Also, any reduction in CO2 emission from the rich would help the rest of the population as the allowed average footprint would increase.

Can you explain your reasoning here?
Distributions like Debian are very trustworthy especially when compared to NPM.
We released a version of GIMP for Android. It is really the full Linux edition, but running on your phone or tablet. It is FOSS and the source code can be found here: https://github.com/CypherpunkArmory/GIMP
>Using the poor as a reason not to cap carbon emissions is a bit perverse.

And yet the wealthy, historically speaking, seem to have a real penchant for taking advantage of the poor in perverse ways.
In many countries HTML is the format of official documents. This is because both PDF and WORD are very proprietary and may contain american trickery.
And nurses do not have advanced training? And the burden on them to prevent death isn't very high? And they haven't made the choice to become nurses...with the purpose of maintaining life?
Your argument falls apart.
Oops, I corrected "Pinto" to "Punto". For some reason, typing that just feels like it's a dirty word.
I was exploring the actual implementation[0] of a capabilities feature in Nodejs and was utilising seccomp (via libseccomp) on Linux at least to achieve a greater degree of security than might otherwise be possible by remaining in userland code. The idea is that you'd write your code, import whatever you like and define your capabilities upfront at initialisation. The problem is there's quite a big disconnect between what you are doing in JavaScript and what's happening with system calls in v8, libuv and the other native parts that it's difficult to predict what you need to block and what's actually going to happen. So I don't think my approach is really viable in a general sense, although capabilities in general I think would improve the situation if the wider community were to adopt the approach.

[0]. https://github.com/roryrjb/node-seccomp
We are still fiddling endlessly with edge cases in Kubernetes or AWS. I don’t see much difference.
Remember, kids: most of the software you have ever used is no longer functional. That browser you used 10 years ago doesn't run today. That server software you used 10 years ago is EOL today. Services come and go. Code dies.

Do yourself a favor and plan the sunsetting of every piece of software and service that you use for your business. At the moment you start using it, plan how you will eventually move away from it. It always happens, and planning ahead leads to much fewer headaches.

This applies to life in general, too; have an exit strategy.
I am aware of Friedrich Hayek. My comment still stands.
Author here! I didn't even know that existed. Thanks for the link!

That looks like it has the same problem as Deno's solution, in that its too coarse for my taste. I want to explicitly give permission to a library, not to the process as a whole. (Since I don't want some errant library deep in my dependency tree to nuke my production databases.)

I love the definitions of scope though - that looks like exactly the sort of thing that I want here.
Personal opinion, I'm sure many will disagree, but I've never been a fan of Ruby. It tends to be slow and, at least last time I used Puppet, there was a lot of dependency issues (from downloading them, to ensuring you run the right version of Ruby among other things). Whereas with Go downloading a single binary takes a whole lot of headaches away. Sure concurrency/performance won't matter much in the case of Puppet like software but depending on a single binary vs lots of dependency is a huge bonus.
I envy you if you can go through your whole career like that.
Interesting and yes, I didn't know. I haven't heard of ePub though. Apparently it's an open standard for ebooks. For those as unaware as me: https://en.wikipedia.org/wiki/EPUB
OpenBSD makes for a fantastic desktop OS. The major issue you'll run into is the availability of software (e.g. no electron apps).
Years ago I helped my work compile a documents CD which had a web menu with file links to "download" the files to your computer from the CD, it worked well.
Avi Loeb is there talking about aliens.

I think this is an advertising circus, like the "consumer Electronics Shows" or ComDex shows, etc. Anything entertaining, interesting, or weird is on the menu, as long as it gets people into the place where the focused blitz of advertising can happen to them.

there's probably people doing rituals and invocations on the gathering. In today's atmosphere, and with this kinda crowd; I'm wondering about the possibility of more concrete actions, too: I wouldn't trust the kool aid or any other refreshments there.
+1... I haven't read through it in a while, but I read it frequently earlier in my career and have found that really valuable. In the cases where I've been asked about situations that I had no first-hand experience in interviews, it's been helpful to draw on knowledge from that reading. Being able to say, "well, Company X got to scale Y using technique Z" sounds more compelling than taking guesses.
It's interesting that no one said prescription ADD medication. I guess they don't work?
Would your grandmother?
it depends what 'AI' does here,
developers needs helps/advices from someone knows the tech stack, definitely not from someone does issue-management without knowing much of the technology (aka, a non-tech bossy PM you could see in some dev team, no offense to PMs...)
>In JS you need a handful of third party packages just to tell if a number is odd.

You really don't, but for some reason JS developers have decided that this is the optimal way to check if a number is odd.
The interesting thing is that Maryland drivers are among the worst I've seen over a wider spectrum of factors. Sober California drivers seem pretty safe. Virginia drivers are miserable on interstates because they pass one another at 1-3mph differentials (I assume this is a response to the reputed harsh soeeding enforcement there) and are victims of often-wrong signage, but are otherwise uninteresting. South Carolina drivers cause dangerous situations by trying to give away their right of way. Maryland drivers aggressively fight back agaibst merges, change lanes erratically, and crash in a quarter inch of snow at shocking rates, despite the fact that their salt trucks have higher mass-flow-rates than their snow storms. The only drivers who stand out vs Maryland are in big military areas where there's a significant minority of people driving 20mph faster than traffic and merging erratically while doing so.
Cap and trade is a cap for everyone… trading doesn’t increase the total cap.
Stay at Microsoft show them that your are loyal and that you want to work on other projects.
In theory yes. In practice, no.

While immutable assets (I imagine you mean container or VM images) are easy to audit, they don't solve all problems. How do you spin up a database and add database-users over time? Do you just just rebuild your container-VM from scratch and loose your data? With Ansible, I can just enforce a new database user as I run a new service against this database.

Also, how do you spin up the host which runs your static VM and container images?

There are tons of problems which can't be solved by immutable artifacts. Yes, immutable containers/VMs for application code. But it doesn't work well when dealing with databases, caching systems and object storages. People deploying Postgres, Redis and/or Minio on k8s or openshift are facing a totally different set of problems which are already solved by mutable state.
> In JS you need a handful of third party packages just to tell if a number is odd

But you absolutely don't.

I get that you're taking a worst-case example, but it also stands that if Node developers would actually take some time to write stuff themselves -- the leftpad situation was absolutely stupid, because `.padStart()` exists -- then the situation wouldn't be nearly as bad.

At my workplace, if you can write the functionality in (depending on the scale) a day to a week, then you're not allowed to use a 3rd party package for it. You can _look_ at what other people have done, but doing it in-house leads to less work overall in the future.
No, no, you don't understand.

Announcing an acquisition from the perspective of the acquired, is typically considered Bad News. So the exec rulebook imposes that you will try to soften the blow by talking up how great things are anyway and how marvellously his tenure has been. That is the most important bit, from his perspective. His target is to get you to read paragraph after paragraph of spin, so that when the Bad News comes, you'll be (if not persuaded) at least willing to consider it might not be too bad after all.

It's like supermarkets placing daily essentials (bread, milk, meat) at the far end of the shop, so that you'll be forced to wander through and likely buy other stuff.
>You are not supposed to have a GUI view when you have 100K+ entries.

Why not?
This is the current social network in nutshell. Almost anyone has technical capabilities to make them, but you need to find users. Someone with influnce can pull specific kind of users. It is becoming like a cult. Like ycombinator is its one kind of cult.
My recollection of learning to drive many years ago was that I took driver's ed, drive my parents around a bit, but then didn't drive much/own a car until after grad school. And therefore, didn't really have much driving experience until later. (And didn't really learn to drive a stick until many years later when I bought a car with one.)

I guess I'm skeptical that having some more classroom time and a more rigorous testing improves young person driving a lot--much less makes much of any difference to how people with a few years of driving under their belt drive.
They deserve each other.
Cases where I've used it for replies:

* accidental semi-spam (people sending emails to someone at one of the domains I own, mistakenly) where I wish to notify them that they got the wrong email, but don't want to divulge my main email (and name).

* support emails from services that I signed up with using "Hide my email". When replying, the "From" defaults to my main email, but again, I can switch to "Hide my email".
Biden may express concern over India-Russia ties in meeting with PM Modi
> Its hard in rust because any code you pull in can always drop down to unsafe, and in unsafe land you can really do whatever you want

There is a quasi-standard "cargo geiger" tool that can manage unsafety requirements in Rust imported crates. (Of course, this should really be an officially provided feature in the first place.)
>anybody could have founded it

No they couldn't? At bare minimum: A lot of people were babies or were not even born yet when Amazon was founded. A lot of people were not in the financial position to go do a startup in the 90s. A lot of people did not have computer science or business skills at that time (and still don't). A lot of people just did not ever care about buying and selling books online. I'm sure you can think of a lot more examples here.

And if Amazon was trying to push a new AmazonBucks cryptocurrency as the new global currency with Jeff Bezos holding a large percentage of them, then yes I would probably call it a scam. Remember when Facebook basically tried to do that a few years ago?