skysight-inc/HackerNews huggingface dataset:
>Of course, nothing is forcing you to install silly packages that are wrappers for one-liners.

That's the thing... I am effectively forced to install a lot of silly packages, because I need some not-so-silly packages, and these in turn pull in all the silly packages as dependencies of their own (a few levels down the chain).

I never installed leftpad (or any package like that) myself, and yet, at one point it was present in basically every node project I ever did, because of indirect dependencies.

While this kind of dependency bloat could happen in any language ecosystem, in node/npm it is from my experience by far the worst. I think it's because the javascript and node standard libraries were/are so very limited combined with npm making it too easy to publish and consume packages, and being early enough in the game so supply chain attacks weren't yet on most people's mind.

I think, aside from node package maintainers being too nonchalant about pulling in basically silly dependencies, it's also a matter of a lot of package maintainers being very laissez-faire when it comes to maintaining the cruft and doing the tedious work of removing dependencies that are no-longer needed.

An example of that - because it bugs me every time I see this show up in my logs, package lock or node_modules - is the isarray package. It's another one-liner, Array.isArray is part of JS since a long time (even IE 9 supports it and IE 9 was EOL in 2016) and the isarray package will just use it when present (i.e. virtually everywhere), and the author recommends to just use the built-in Array.isArray, and yet it's still omnipresent with almost 63 million weekly downloads, 858 direct dependents on npm (with countless other indirect dependents, and dependents not published and therefore not tracked on npm). And the number of weekly downloads still goes up week-by-week, month-by-month.
Vanilla JS is not something we should be afraid of. I wish we’d consider it more often in projects.

The latest generations, ES2020
and newer, are pretty useful and pleasant to use. If you leverage their features, it goes a long way. Implementing the odd missing function yourself along the way is perfectly doable if you embrace TDD.

My feeling is that people in the JS ecosystem tend to overestimate how much time they’d allegedly waste re-implementing stuff, and grossly underestimate the true cost of deeply-nested dependency trees.
Mentioning Al Gore in the context of climate change is unserious, although I'm sure it's good fodder for Facebook memes.
It makes me deeply sad to see these sort of interactions in open source [1].

> Hmm, I think it's a worthwhile fix. Where did you see malware here?

> I think the author of this repo is free to decide what code he publishes. Say thanks to that it's for free

An incredible amount of people have dedicated sweat and tears and foreheads (from banging against the desk in frustration) to open source across the entire stack, from the contributers to OSs such as Linux to those working their arses off to create better frameworks, languages and runtimes, that we can all benefit from and use with a reasonable expectation of security, respect and privacy.

As a university student, I feel privileged to have been able to grow up in a world where so much work and knowledge is provided for free with no strings attached, regardless of demographic/location, I would not be where I am without it. A century ago this would not have been possible. To all of you who have tirelessly and selflessly worked on OSS for others, without expecting anything in return or imposing politics, ideologies, infringing on privacy, causing damage, collecting vast quantities of marketable personal information or monopolisation, I give you my heartfelt thanks for your efforts, you know who you are. You have created something that will have forever helped to improve our society and empower those that want to learn and create their own designs.

From my own personal experience, I want to give a shout-out to the smaller projects of Rust, Svelte and Elixir. I think it's incredible that the work and ideas of (often) a single person (Rich Harris, José Valim) can grow into larger extremely welcoming and helpful communities with many more motivated contributors that are proud of being parts of those projets and put in an extraordinary effort to try and do things better than before. I'm sure there are plently of other worthy names I'm too young/ignorant to know.

Love it or hate it, Node.js has been very empowering for a large number of people to learn and publish their own full-stack applications, the JavaScript ecosystem has improved enormously since its beginnings, but has a tendancy to change slowly due to its size, unless a disruptive technology comes along such as TypeScript. Websites are a great way to introduce people to the joy of programming with its visual feedback, you can make a small penguin move across the screen, then move on to play tic tac toe. Even as a younger developer, I admit that the days of FTP, no-build-step pages with a sprinkle of JQuery were easier to understand and actually safer for newcomers than introducing someone to a SPA stack (which can easily have thousands of transient dependencies) nowadays.

[1]: https://github.com/Yaffle/EventSource/issues/202
Re: your example. What is "capabilityToken" in this case? What does it grant you, precisely? Is it a directory? A file? Something else? The classical approach to using caps with files is you create a File type of some kind, which encapsulates the permissions and lets you derive from it e.g. sub-directories, files in that directory but not navigate up the tree. Or it's associated with some whitelist of files.

For that to work you need not only a carefully designed set of types but also they must be able to protect their internals. JavaScript historically hasn't had this, I don't know about modern versions, but the ability to restrict monkey-patching, reflection over private fields etc is a must.
Explaining Crypto's Billion-Dollar bridge problem
100%

You've summarised it much more succinctly than I could. Fundamentally it's about misattributing the cause of untrustworthiness.
The declaration of independence can be interpreted to mean that the
government forfeits its legitimacy when it violates anyone's human
rights. If the declaration of independence is considered legally
binding then theoretically you could have a basis in law for fighting
back against the police when they exceed their remit. I'm no lawyer
but I remember something similar being brought up in the courtroom
scene in the movie Good Will Hunting.
John Oliver is more prone to histrionics, but Ezra Klein is genuinely insightful and thoughtful. He’s really a much better/more truthful journalist than joe Rogan or tucker.
New technique rewinds the age of skin cells by 30 years
> In my opinion, any model that predicts any sort of outcome when doing so accurately is overfitted and lacks the proper contextual knowledge necessary

For me, models that do not make predictions are not very useful. Without predictions about the future, it's very hard to tell if the work is useful moving forward, or if it should be read as a historical analysis that doesn't matter in the current environment.

Predictions are critical, they are a primary mechanism to find out if something is useful.
"Misinformation"?

I have been an avid collector of scientific studies about COVID, COVID vaccination, repurposed therapeutics, and PCR test accuracy since 2020. Would you like me to share some of this "misinformation"? You might find it enlightening.
Try largest company in the world (AFAIK)...
I agree and am very pro vanilla JS FWIW. I just find myself reaching for something like lodash's `intersection`/`difference` functions when working with sets, `sortBy` to get more normal (and not in-place) sorting behavior, and `groupBy` to do group by.
I mean, have you seen German drivers?
>"Men are more vulnerable to making certain narcissism-related mistakes"

Perhaps, but I think there is more to this than just narcissism. It's an uncomfortable truth but men are culturally expected to take risks and succeed - unless they are lucky enough to be born into wealth or power. That same pressure is not as pronounced as it is for women. So that is why I suspect men make the leap into the speculative world of crypto far more often than women do. Some men are counting on crypto to make them rich (myself included, sadly) because they just don't see themselves getting ahead otherwise.
This works, and there's also a fun variant where you then losslessly compress the residual between ground truth and the up-sampled image. Since most of the information was encoded in the NN and already exists at both ends, the data requirements in between are modest.
Yeah, there's definitely a separate cultural/inexperience problem at play as well.
> As a small-time user it's only your choice because it's the standard choice.

Thanks to Docker i can mostly reject its conventions (for actually organizing my application data).

Instead, i might have something like the following file paths and container bind mounts:

PATH ON FS --> PATH IN CONTAINER
/docker/app_foo/data/container_x/var/www/html --> /var/www/html
/docker/app_foo/data/container_y/var/lib/postgresql/data --> /var/lib/postgresql/data
/docker/app_bar/data/container_w/app/data --> /app/data
/docker/app_bar/data/container_z/var/lib/mysql --> /var/lib/mysql
*the docker/app_X directories can contain deployment descriptors, instructions or other notes if need be

The containers can use FHS internally and not know about where or how things will actually be stored outside of the container (bind mount vs volume, local vs networked). Thankfully, usually there are 1 or 2 directories per container that i actually care about and want to persist, the rest is disposable (e.g. data vs runtime files and libs).

The hosts can have a non-standard folder at FS root under which all of the persistent data will live, thus backups become easy, and due to organizing stacks/apps in a tree structure, everything that's needed by a particular environment is also immediately obvious.

Furthermore, this doesn't get in the way of the actual OS operating, nor does the OS get in the way of my deployments - if anything ever goes wrong, i can just wipe and reinstall, setup with Ansible and carry over the /docker directory as necessary. Of course, depending on how everything is mounted, it might as well be just reconnecting another drive or a few drives and setting up fstab.

I think that treating your entire system as one large entity is a horrible idea - instead you should have a clear distinction between what's a part of "infrastructure software" and what's your "business software", those two should be kept as separate as possible. The former should be easy to wipe and update and even swap out altogether (within reason), the latter should be treated as critical and backed up thoroughly and often.

Edit: my point is that most existing software is really bad at this distinction and there are far too many opinions and as a consequence your Tomcat install is strewn across a dozen folders, same with many other pieces of software. So why should you live in fear of forgetting some important configuration file or some data directory?

Of course, YMMV, but things like Ansible and Docker (or Podman, or containerd) with the "infrastructure as code" and "cattle instead of pets" approaches is pretty serviceable.
Toast: A Fintech that aims to become the operating system for restaurants
U.S. teens recruited to drive migrants from Mexican border
The tendency is to make for every function a library. Just look at lib directory in the Slackware install tree. The functionality (of the distribution) has not changed too much but the number of libraries needed is astonishing.
I didn't know they load test bridges. Wouldn't that put unnecessary wear on the structure and age it prematurely?
But Arc does use what others have made: it's hosted inside another implementation like Racket.

> If people built societies the way computer people build communities, we would still live have small warring tribes and no concept of a law that binds all people and absolutely no concept of a constitution that binds lawmakers.

If people built societies the way Eric Naggum wanted them to build communities, we would all be Roman citizens speaking Latin.

Also, if computer people built the way Eric Naggum wanted, we wouldn't have ARM chips for embedded, for instance. Your mobile phone's chip would be running IBM 704 instructions. We wouldn't want to invent some new, incompatible machine language instruction set, right?
Note that this isn't an apples-to-apples comparison. The GPT-3 position is for a few-shot use-case that has not been trained for this particular task. When fine-tuned, GPT-3 would be expected to perform a lot better. Lastly, GPT-3 is currently operating on the text-002 models, and the 3rd version of GPT-3 is generally the one considered current. These benchmarks are for the original GPT3 model.
The author seems to be writing this in bad faith with a particular predefined narrative in mind. Perhaps it's good for entertainment, but comically
bad journalism.
A modern web-based cloud-hosted access implementation would be a killer app for web-2.0.
"Past earnings do not guarantee future earnings" can be said of literally any investment.
Serious question I have about carbon offests with respect to forestry. If you pay me money to not cut my trees and they all burn up in a fire, do you lose your carbon credits, and if so, do I owe you a refund?
And those "top tier" libraries do exist for some stuff- especially if we're talking about the anemic standard library. The famous lodash library doesn't have any (non-lodash-umbrella) dependencies AFAIK.
This article seems to attract Spring sceptics or even haters. Spring is not that bad.

First, XML configuration in Spring is mostly a thing of the past. Most applications are configured with annotations and component scan these days. While it is true that there is some magic in it, it is relatively rare to cause problems. With proper tooling like IntelliJ Ultimate it is mostly easy to manage and understand. If that still feels too magical, you can use a Java API to manage your classes: https://docs.spring.io/spring-framework/docs/current/referen... Even nicer in the Kotlin edition: https://docs.spring.io/spring-framework/docs/5.0.0.RELEASE/s...

> Importing other Spring files

That sounds like mixing different projects or poor API design.

> Spring is now so complex that it has it's own framework, Spring Boot

That is not true as such. Spring Boot is not an abstraction over the Spring Framework. It is more a convenience layer with useful defaults and some auto-configuration.

From my experience Spring brings some advantages:

- Quick start with https://start.spring.io/

- Auto-configuration of several frameworks like Hibernate, Spring sets up all the project infrastructure for you

- Transactions are provided out of the box

- Useful additions like metrics can be added almost without effort
- Good support for integration tests

- Easy to use AOP

- Powerful dependency injection (for example the support for generics is pretty good)
100k+ is pretty manageable in the Excel GUI. When you get above 1M then it starts getting dicey. I have a junior dev on my team that is very good at python. I only consider him "jr" in the language/tech he's assigned to work on daily, in python i consider him pretty solid.

When we need data work done on csv's larger than I can ask an Analyst to do in Excel I give it to him to write some python against. Finding and exploiting his python skills has won the guy a couple bumps in base pay.
Good article. This is what I was excited about the first time I heard about Deno before I eventually learned what Deno's sandboxing model actually was. I'm not sure this is the exact proposal I would want, but I do want something vaguely like scopes or capabilities in Node, and even if it wasn't perfect I think it would go a long way towards mitigating at least some of the current risk in the ecosystem.

Also agreed that for all their use, it would have been better in the long run if install scripts had never existed. It's not just that they're a security vulnerability, they also get in the way of vendoring code, and can introduce additional non-JS dependencies and errors on other systems/platforms. Again, not to say that they don't have any use, I get why they're there. I just wonder if the benefits are worth the downsides.
Smaller models with better performance are beginning to arrive. Things like RETRO, better training data, longer training time, and scale optimization will have these models on phones and desktops doing crazy things in the near future.
> Their activities and standpoints are obviously important to know about from the perspective of Israeli national security.

The claim here is that the spyware was Israeli, not that the state actor using it was Israel. NSO has customers all over the world.
Hence the invention of things like Git LFS:

https://git-lfs.github.com/
"I liked the idea of carbon offsets, until I tried to explain it as if its aim were something it isn't. Then I found out that it was badly suited to the goal I imagined."

As I remember the aim from when the carbon emission quotas were proposed and introduced, offset trading was meant purely as a transition mechanism, and wasn't intended to have any effect on the long-term situation afterwards. All the carbon emitters at the time got large quotas valid for a long time, so large that noone protested much. Later, the idea was that the quotas should be reduced and then lead to quotas being sold sale and emitters closing down.

This what happens now, as I see it. I read about a company recently that decided to replace its vehicle park with zero emission vehicles, but gradually, and buy carbon offsets from someone to compensate for the old vehicles. So someone with one of those old quotas shuts down a polluting plant a few years earlier than necessary and sells an offset, someone gets to brag about zero carbon vehicles quite soon in the process of replacing their vehicles. The offsets mean that both of them can get a PR win, and arguably push both of them stop emitting carbon a little earlier than would otherwise be the case. It's a win-win effect on the transition and has nothing to do with anything other than the transition.
How does this sound? Formulae are supported, but the cell (not column) must be set as the Formulae datatype. The first formula that I am supporting is SUM, as it is easy to code in SQL. What are the other most common formulae that you use? I'll only implement the integer / float formulae at first, but I'll add string manipulation later.

> Also filtering is essential.

Filtering, of could. I've already got a hidden column for all rows isDisplay.

> So nice to be able to see all the values in the filter dropdown, easy to quickly spot weird values.

Perhaps instead of filtering, you'd like to see outliers or the range of values?
Can you cite anyone who actually thinks this?

People complain about these tiny packages they find on npm the whole time, but usually these packages come from people learning how to create their first npm packages, or creating or following tutorials. They aren't serious packages used by typical developers for production apps.

If you go to the isEven github repository you can even see "I created this in 2014, when I was learning how to program." If you hover over his 'organisation' you'll see the text "This is a joke. You'll only see this org if you are attempting to troll me about repositories I created when I was learning to program."
Mentioned in a sibling comment already, but Rust has these features as well, and I think Go ended up getting them too although there was some controversy about the need for them.
No. It is mainly assembling products for which processes have been stabilized. Last time Apple did in India it was huge ruckus, with factory owner not paying workers for months, housing facilities and so on. This time hopefully it should be better.

It would be small plant to cover some sales for high income people in low income countries. To put in perspective it is about ~5 million / year Iphones sales in India. In China that number is 7 million Iphones / month.
> spring still grams devs

Apologies but English is not my first language. I can’t find “to gram” in any dictionary, including urbandictionary. Care to explain?
Deno core team member and TC39 delegate here.

We have pondered about capability based security for Deno in the past. Our conclusion has always been that this is not possible to do securely in JS without freezing all prototypes and objects by default. The reasoning for this is that you need to make sure the capability token does not ever leak. For example as a malicious user I could override `globalThis.fetch` to exfiltrate the capability token destined for `fetch` and use it myself later.

One could also override `Map.prototype.set` / `Map.prototype.get` to exfiltrate a token every time it is added or removed from a `Map` (people will want to store tokens in a `Map`).

One could also override `Array.prototype[Symbol.iterator]` to exfiltrate tokens stored in arrays if those arrays are destructored, spread, etc.

There are many more cases like this, where one can exfiltrate tokens because of the very dynamic nature of JavaScript.

It is unlikely that freezing all intrinsic prototypes and objects is even enough. People will find ways to exfiltrate tokens.
> Who's building nuclear power plants now ? Renewable sources of electricity are stacked on top of non renewable ones so far

You're arguing against a straw man of your own making. No one is positioning EVs as the solution for generating clean energy. They are a solution for electrifying transportation which is a prerequisite for moving transportation from fossil fuel generation to clean energy. Moreover, the current average blend of energy sources in the US grid is already much cleaner than burning gasoline, and on top of that virtually all charging stations are powered by 100% renewable energy.

> EVs generate half their lifetime pollution before even being driven on the street,

This is an argument in favor of EVs. Solar panels also produce all of their emissions prior to being plugged into the grid. This is precisely the mechanism by which they reduce carbon output relative to fossil fuel energy sources which have a large upfront carbon cost and then an even larger ongoing cost. It's the same deal with EVs.

> 3 tonnes personal steel cages transporting 1 person

Well, we have to have some way of getting around, and most of the US is not dense urban area. Space is plentiful in the US, and anyway "steel cages carrying one person" isn't optimizing for space, not carbon emissions. Any sort of utopian restructuring of US transportation is going to involve way more carbon up front for decades to solve a relatively small part (transporting humans) of a problem that we need to have solved in decades.

> This is just another chapter of the "don't worry we'll magically figure it out sometime in the future (_cough cough_ after I got my dividends and retire)"

This kind of vapid, incorrect cynicism isn't helpful and probably violates the site rules. We already largely know how to drastically reduce our emissions--clean energy and electrification. EVs are part of the electrification story. There's not much to "magically figure out" except how to make renewable energy viable for base load generation economically, but since any anti-car transportation solution is completely ignoring economy (not necessarily to be confused with "the economy") anyway, we can elide the "economically" requirement for base load generation in which case we already know how to get from here to there. In whichever case, EVs involve much less "magic" to solve than any anti-car alternative.
It sounds like you're not familiar with Advent of Code. Nothing prevents you from using libraries to solve any of these puzzles. You can solve them any way you like.