skysight-inc/HackerNews huggingface dataset:
I see a lot of people suggesting solutions that, while helpful, wouldn’t actually solve the key problem in supply chain security.

- You can’t trust the package registry because of security flaws in the registry itself (as seen here as well as in NPM just a few months ago[1]). The CDN can be hacked, or an insider can attack the infrastructure.

- You can’t rely on code signing since a maintainer can go rogue and sabotage a package at any time (as happened with colors.js and faker NPM packages in January[2]) or a new maintainer could be added to the project and possess a valid signing key but turn out to be a bad actor (as happened with the event-stream NPM package in 2018[3]).

- You can’t audit every line of code in every dependency because the cost in terms of time and expertise is prohibitive to all but the biggest organizations (e.g. Google) and the most security sensitive applications (e.g. certain crypto projects and financial applications).

The two solutions I’m most excited about are (1) auditing package behavior with static analysis to detect when package behavior changes (e.g. new network connections, filesystem accesses, install scripts) like we do at https://socket.dev (disclosure: I am the founder) or (2) package sandboxing of which Lavamoat is the best example (however the performance impact is too high to apply this to every package in an app at present, and it also requires maintaining a policy configuration for each package).

[1]: https://www.theregister.com/2021/11/16/github_npm_flaw/

[2]: https://www.theregister.com/2022/01/10/npm_fakerjs_colorsjs/

[3]: https://www.theregister.com/2018/11/26/npm_repo_bitcoin_stea...
It's even worser, tons of applications are not working properly if your phone is rooted (so if you put there proper adblocker etc.) or without google apps.
"if poems are seen as 'puzzles', that will miss the point for 99% of them"

What is the point of 99% of them?
+1 for “The Linux Programming Interface”
Doesn't work for me here in Fukui, Japan.
I think the limit should be the same for both, but I bet the difference is motivated by the pack behavior of motorcyclists. Loud cars usually travel alone, but loud motorcycles often travel in packs of dozens which may continue passing your house for a minute or two, which feels like an hour...
> that adversarial relationship is basically dissolved since you are also the owner along with your co-workers

This is only true if everyone has exactly the same responsibilities, hours, working conditions and pay. All differences lead to divergences of interest.
There's something about tanks that makes them a priority. Games are set up so the tank can absorb damage done to others, or heal, stuff like that.

Because the roles of each fighter are baked into eg League of Legends, there are reasons tanks play the role of a tank. And yeah, opponents try to kill the other roles first, but the the job of a tank is to make that hard.
Not my experience at all (50+). Having 25+ years of experience in many different technology stacks makes it easy to cut through the BS and understand the core of what a new technology/stack/framework/library is. When you do that you realise that most “new” stuff is old stuff with a new lick of paint and excited evangelists promoting it.
A military veteran is pretty much anyone who served, doesn’t need to be in times of active conflict.

Source: https://www.va.gov/OSDBU/docs/Determining-Veteran-Status.pdf
You cannot zero-trust to your web framework. You cannot zero-trust your data access library, to which you have to give credentials to your production database. You have to trust the database itself, and the operating system that runs your whole stack.

Zero-trust requires certain scale and is expensive; the most successful high-stakes zero-trust system I know is Bitcoin.
I heard they aren't renewing contractors. But not firing employees
Google has publicly described these people as it’s “extended workforce.”

Employee is generally used as the legal definition, but if you’re only job is to work for company X under their explicit micromanaged directions you fit the colloquial definition of employee even if your paycheck is signed by a different company.
Yet the vast majority of articles are deleted for reasons other than legal.
This is the idea behind prediction. It’s used to reduce delays between client inputs and seeing the actions happen. More important in high reaction time things like fighting games.
Ok I'm not Raph but, FWIW, my 3d sculpting app is written using SwiftUI (https://sculptura.app), which is not a view around a database (in fact it was previously UIKit... SwiftUI is so much better). I recently implemented a piano-roll editor in SwiftUI: https://github.com/AudioKit/AudioKitUI/tree/main/Sources/Aud.... I have little doubt a DAW, at least, could be implemented in SwiftUI easier than with UIKit or AppKit.
It may be an outlier, but consumers are especially vulnerable to issues like this while switching banks. One small hiccup can make you lose a very large % of your cash on hand, since usually you aren't working with >= 50% of your funds on a daily basis.
Show HN: C2html – HTML Syntax highlighting for snippets of C code
Google used to do this, but they rolled it back because the hard honest truth is most people don't like taking surveys. Behavior is a better and more available signal.
Sometimes I have. But I find myself increasingly unproductive that way. When it comes to experimentation, it is a different story altogether - then a bit of lucubration lubrication is just what the doctor ordered. I usually make the most interesting discoveries that way.
Screw all of you now I'm hungry and there's no empanada places around.
Of course you would use your own website, but you understand it in a way your users don't. From experience I can say you won't anticipate many of the ways things could go wrong. Some of that can be done by recruiting individual test users to observe, but aggregate stats on usage are also incredibly valuable to understand how people are using the site, where they get stuck, what features are important to them, and more. There's no need to identify particular users, but tracking user behaviour in general is incredibly valuable when operating a serious website.
I like Tolstoy's conclusion in What is Art?, which I'm doing an injustice by summarizing as "universal emotional communication" which is contrasted with paid work, technical prowess, esoteric work, formulaic-derivative or pure aesthetics - anything that requires effort and "cultivation" to understand is not art.
The problem is not Clojure (or Haskell or …) The problem is having to unlearn OO thinking and understanding a very different way to view the world. But that is a good thing! If you are not struggling learning then you are not really learning anything new. Just a different flavour of what you already know (another OO language with a slightly different syntax and slightly different API).
They were running Apple to the ground in the 80s and then kicked Steve Jobs out in 1985.

Jobs starter Next which was acquired by Apple in 1997, bringing Jobs back home.

Hence gp’s comment about Apple’s long history of doing this…
I endured 13 months. In my mind, very little skill development happened during those 13 months. But here I am, years later, and that line item in my history still carries some sense of market validation - that, because I successfully navigated the recruitment funnel and was at one time an Amazonian, that I must have useful skills.
How to Get Kim Dotcom to Want to Work with You
My R1 had a cat, and that was way back in 2004. This definitely isn't some kind of absolute truth, CA-legal sportbikes have required cats and EFI for a while now. I'd have to check to see if there's a displacement threshold that excepts the small fry though.
There’s no way you could do anything real time with full HTTP request round trips for updates
Why Our Brains See Faces Everywhere
Hello to everyone!

This is a tool I build to use in my own blog (where I mainly talk about C programming).

I considered using other available tools but they either:
1. used client-side javascript to work
2. only highlighted based on the keywords
3. only could be used online

so I thought It would be fun to write one myself. It turned out pretty nicely in my opinion!
This is so cool! Is there a dev blog?! I’m particularly interested in the netcode and things like path finding and object collision detection at scale.
He's referring to not the star trek hologram, and not really the holographic sticker. This is one holographic plate illuminated by a laser, viewed from different viewpoints: https://en.wikipedia.org/wiki/Holography#/media/File:Holomou...

And it's not like those things with the bumpy lenses, that show you an image from a few chosen viewpoints, either. You can look at that mouse from a wide range of angles and distances.

Handwavy, short explanation: All the light arriving back from the mouse-- in different directions-- is encoded into the speckles on the plate. When a coherent source of light is used to illuminate the plate, again, the light exits with the same characteristics it had entering the plate.
well, there will always be a divergence (no two people have the exact same needs or wants) but i would argue being co-owner with others helps as a forcing function to help converge interests (you wouldn't be happy with a co-worker slacking off since they're also wasting your money/time not just 'the companys')

and there are many successful co-ops where people have different responsibilities, hours and pay, i don't think that is a requirement for co-ownership (though the variance is definitely less than traditional top-down orgs thats for sure)
You mean emacs :)
Are people still using raw "rm" and not aliasing to "trash-put"?

People should start making their shells act like in the 2000's and not 1990.

I only use raw "rm" when I need to delete a large folder that should not go in the trash bin.

In fact distros should start caring for user friendliness and even ask to do that on installation.

A system with no trash bin is what, before Windows 95?
> That means that they can expect the warehouse managers to get pretty desperate…

It would seem to make sense for all the warehouse managers themselves to form their own union.
Everyone calls it MEV because of this very paper. They coined the term. You did answer your own question in (3).
Doesn't look like it's released. Are you mistaken?
At 7 I was banging on an electric typewriter and red LED calculator. My mother could explain how pressing a typewriter key triggered a typebar and left an impression with ribbon. Fascinating. She couldn't explain how the calculator worked, but she let me punch the numbers in when she was balancing the checkbook and how it all added up. Magical.

A few years later and I was typing in c64 basic programs from the back of magazines. Then it was I showing my father how to schedule and print little league baseball games, and my mother how to track her bowling tournament results.

Thanks for sharing your story. It is amazing what kids can do with just a bit of a nudge.
> Edit: it’s also 100x more interesting than making a website or an app and arguing about which fotm framework to use.

I am not a pacifist. There are some people doing bad things, that need to be stopped. But there being many npm packages is one of the stupidest possible explanations for working on it.
All designed by hand.
Camera Films Itself Getting Launched Out of a Centrifuge at 1,000mph
Especially for someone in a director/lead position at Apple, it’s quite common for a change like this to be accompanied with an explanation to their team. MacRumors and The Verge are the ones who turned it into a story.
Superb to see accessibility being there right at the start.

Also really nice to see that this is not just a "how to use React" tutorial - kudos to MS for avoiding that. Looks like a great course.
Reminds me of the classic joke:
A surgeon is at home, and the plumber comes to fix his sink. The plumber works for 15 minutes, the sink is fixed, and he hands the surgeon his invoice.

“$850?” the surgeon exclaims, in shock. “I’m a surgeon and I don’t make that much!”

“Yeah,” says the plumber, wistfully. “I didn’t make that much when I was a surgeon, either.”
Okular does that already, except easier than MuPDF and with the option to copy as an image as well (and more).

Edit: I tried installing MuPDF, and it doesn't hold a candle to Okular, which is far easier to use in practically every way, and which is far more capable. MuPDF is fast at rendering pages, but is extremely limited (e.g. it can't even scroll or display pages side by side).
Crazy to see such a similar idea kicking around 14 year later:

https://rogerjohansson.blog/2008/12/07/genetic-programming-e...
Yeah, I don't criticize Waterfall because I've never seen it or been part of it. I criticize it because I watched several million dollar mistakes happen under Waterfall process projects and one multi-billion dollar mistake (years late and they delivered the wrong thing, brilliant!).
I don’t understand why the package registries/managers haven’t yet provided options to compile-in dependancies of dependancies on release.

E.g. package A depends on B, if you install A, B is baked into it at the install step. That way, your active dependancies are only that which you purposely install, and some compromised package X dependancies down the chain won’t bite you when you do an automatic upgrade.
See thread @ https://twitter.com/googlefonts/status/1522778639305101312?t...
Yep, you nailed it. I've been looking at low-JS and vanilla JS again recently given the amount of hype around these kinds of frameworks (and the perceived maturity of the browser).

It still has the same problems you describe. You worded it way more eloquently than I can.
I definitely think the error could be improved but I'm not sure it should really say "just shove it in an `Arc<Mutex>`," because that really is only sometimes the right solution and it might lead people to make poor choices by default.

I think a lot of the problem is really with the confusingness of the concept of static lifetime in rust to begin with, where it's kinda used for both "lives forever" and "doesn't reference anything that lives longer than it"[1]. I hope someday these meanings get different names, tbh.

But when you see that error the naive thought is like... "ok better make it live forever" but it really just means you need to make it something that you control, and there are other ways to do that than a refcounting mutex.

[1] https://doc.rust-lang.org/rust-by-example/scope/lifetime/sta...
Yes, Apple management will have to suck it up. They set the policy, their employees vote with their feet.
Yep, that one is my bad. That's why I added the edit.
If you want to go even more minimalist then roll your own pure lambda calculus evaluator and figure out how to do if-then-else and math in it. It is good fun!
That’s not what synergy means. That’s also not how oxen work.
> Ukraine continues asking for boring old-fashioned tanks and artillery, probably because their generals believe that can help them take back lost territory.

Ukraine has explicitly asked for Western aircraft, F-15s and F-16s in particular, and UAVs such as Reapers. Those requests were public knowledge 5 weeks ago.

Ukraine's command believe tanks and artillery will conquer territory because that's actually happening on a daily basis, most recently around Kharkiv. They believe better artillery will enable offensive operations in late May or June, and they're correct. Right now Russia has an indirect firepower advantage they're using to advance slowly in Donbas. When that advantage vanishes because the enemy has longer range, more mobile and accurate weapons they will fold and territory will be ceded back to Ukraine.
Swarm of micro flying robots in the wild
I honestly cannot remember ever typing sl instead of ls. Funny little “utility” in place there. It doesn’t appear to be part of a minimal Ubuntu installation, have you found it install “out of the box” with any Linux distros?
Small engines are much less efficient. Especially if they are air-cooled and/or two-strokes.
Here's mine for 2032.

1. There will be more robots, and these will be of greater geospatial and socioeconomic distribution, reducing human workloads but further centralizing human wealth. Most of them will be specialized automatons and Musk's promise of an general purpose walkabout humanoid assistant for under the cost of a 2022 vehicle ("complexity and cost of a car is greater than that of a humanoid robot") will be a laughable historic footnote.

2. The environment will continue to degrade. The last coral reefs and forests will become fervently defended, the reefs will die anyway.

3. Water shortages will be averted through emergent filtration technologies.

4. Food shortages will be a real problem due to supply chain shocks, partly due to climate, and the quality of food available to large portions of the human population will degrade in terms of freshness, choice and nutrient content. McSubstance-style synthfoods will continue to be culturally normalized, as we can see from marginalized populations in the developing world today.

5. The number of people using sit-down computer terminals will further decrease. We may see less typing, less sit-down, less manual procedural programming, less human programming and less human architecture. At least one autonomous software architect and implementation system will have eliminated substantial numbers of programming plumbing tasks. Voice interfaces will improve to decent for abstract concepts such as search, visualization, and associated process modeling.

6. Although online education resources will remain available, the social exclusivity afforded by elite universities will continue to bring unequal opportunities to the first world.

7. Statecoins will be a nontrivial portion of the global economy, led by China.

8. Law will become more transparent and objective (rule-based) with autonomous enforcement and greater physical and virtual surveillance becoming culturally normalized worldwide.

9. Supply chain will be rewritten with autonomous systems to allow for greater reputational transparency in general sourcing. Significant numbers of sales and purchasing jobs will be eviscerated. The technology may start in and escape from an economy that doesn't want this change to occur for sociopolitical stability reasons, to become a global phenomenon.

10. Personal transport may increasingly tend toward an abnormal luxury for most of the world, as the 1950s suburban utopia fades from memory and a new dense urban service-fabric replaces it.
Weekends in China: https://en.wikipedia.org/wiki/996_working_hour_system
Thanks for sharing this. I have to admit, this is an absurd amount of code for a todo app. Is there a specific goal you had in mind when creating this? Are you trying to show the capabilities of SSR (or maybe Redux)?
Re caching:

I had a look into it, and it seems we set the following headers when retrieving user images:

> cache-control: public, max-age=3600

So I believe your browser _should_ be caching these.
You could look into Python Eel. It's pretty useful to create a quick web based desktop GUI with Python. I'm currently working on a project with it that uses React for the GUI.
I've found people's views on remote work say more about their personal ethics than universal truth.

People who would (or do) slack off without direct oversight think everyone is that way. They don't understand that the people in these positions are highly motivated, driven people.

These people aren't Homer Simpson.
> Are people still using raw "rm" and not aliasing to "trash-put"?

as a regular user of rm for decades without any issue whatsoever this reads like parody.

I understand it probably isn't, and I understand the logic behind the design choices that are prevalent in a modern OS..

but some of us just want the machine to do what it's told the first time, and we're competent and confident enough with our holstered foot-guns that we're not a major threat to any system that is being administrated properly.

>In fact distros should start caring for user friendliness and even ask to do that on installation.

I felt a great disturbance in the Force, as if millions of scripts suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened.
Their US-centric narrative that all our problems would be solved if people like them were afforded their rightful majority rule, and control over the lives of the rural, the old, et al.
>The office is where the very expensive labs are.

I know right. I mean to be able to test his his AI algorithms, instead of just walking into the supercomputer room with a briefcase full of punchcards he would either have to make a long distance trip or else FedEx in his punchcards(and expose Apple to the risk of losing them or having them leak).

Sorry, this is 2022 and we have high speed Internet and networked computers. And we don’t have to physically load punchcard into then supercomputer.
>NOx - In atmospheric chemistry,

NOx is a generic term for the nitrogen oxides that are most relevant for air pollution,

namely nitric oxide (NO) and nitrogen dioxide (NO2).<

https://en.wikipedia.org/wiki/NOx
I have never heard of the trash command. I learned unix from stackoverflow etc. and this was never mentioned as the first option eventhough it makes a lot of sense now that i read it
Finding my work more interesting than nmp install is stupid?

Edit: I’m really kind of blown right now. You’ve decided my job interest is stupid. I’ve loved remote controlled cars since I was 4, I’m now in my late 30s. I get to program big remote controlled vehicles. I love it. But I guess that isn’t ok. ={{
find /tmp -type f -a -name 'foo*' # no "-" for the -type

this is bitten me more often than I'd care to admit.
I can only hope it goes into effect in my neighborhood. It's pretty hard to go a day without wearing headphones throughout just to think straight
A group of 90 decibel bikes is not going to sound anywhere near like a bunch of straight piped Harleys inside you house. It will sound like you’re next to a hair salon. Hair dryers are 90 decibel.
It seems you think that having a phone, on you at all times and charged is easier/better than a key/fob. I honestly don’t see how one can think that is a better solution. This solution REQUIRES that I can’t leave my house with my (charged) phone!!! That’s a massive restriction!
I don't have any experience with sklled trades unions, but labor unions are almost universally despisedby anyone with first-hand knowledge. They are largely organizations of professional-class parasites subverting the class struggle and sabotaging worker morale for corporate benefit.
I think (1) is a bit harsh relating to the terminology. Technically front running is based on plainly “non-public” information. The term has been generalised and expanded to include crypto transactions which are slightly more obfuscated from the average user who doesn’t sit and watch the mempool. I think the term is completely appropriate.
I think 'regular people' would find this neat, more so than the niche content that is usually posted to hacker news. This is fun. Are you saying that any effort not expended on solving [insert existential risk] is wasted?
I recently had a conversation with an "absolute beginner" and it was a stark reminder just how much knowledge I take for granted. It really is extremely challenging to try and build up a base of knowledge starting with no prior experience, and it's great to see examples of this done right.
I'm sure you already know the answer to your question, but the answer to your question is that it's to make the subject of the article comprehendible to people who do not know what a trilobite is.