skysight-inc/HackerNews huggingface dataset:
In our setup, the committer can merge their pull request after CI passed and at least one review has approved the code. Seems like a better compromise than relying solely on CI. And pairing is nice, but there's not always someone available to pair with. Heck, I always review my own pull requests completely before requesting a review, because I often miss something. And the easiest way to do this, that I know of, is with pull requests.
Malicious VSCode extensions with more than 45k installs
Good job! Those quotes are insane! I've worked on a few projects where I've had to build this from scratch, I had no idea that a SaaS existed for it...
> For example, if you ask, “Hey Google, what’s the weather today?” we may use the text of that voice interaction (but not the audio recording itself) to show you personalized ads."

That is to say, they use sound data - in processed, not raw form - to build a profile for advertising and whatever other nefarious purposes not for your benefit. That's on top of interns listening to some of the audio to ensure the service works as expected, that is to say recordings of you having sex will be passed around the office.
> Apple have a history of doing stuff locally, on the hardware they designed, that other companies have offloaded to the cloud.

Looking at how they promote using iCloud on iDevices, I doubt that.
Even Microsoft has admitted (between the lines) that cloud gaming isn't as profitable as just selling games. And it's not just one company that's failed either. Google, Onlive, Gaikai, there was a company that made a Cloud console a couple years back, the list goes on. Besides, the latency will never be low enough, and the bandwidth cheap enough, for a lot of people to make it a viable solution.
> Using pull requests for code changes by your own team members is like having your family members go through an airport security checkpoint to enter your home. It’s a costly solution to a different problem.

No, it's like having an editor proofread your article before you submit it. It's a second pair of eyes to make sure you haven't missed something or made a change that will subtly break things, or just misunderstood the requirements and implemented something not quite right, or didn't implement your tests properly and thus are not actually testing what you think you are.

CI isn't some magical fairy that ensures program correctness; it's only as good as the tests it runs. And even the best tests do not guarantee correctness.
Is the author suggesting every commit goes into the main branch, and into production? That seems ludicrous.

The trick with merge requests is to keep them as small as possible while being something that can potentially be deployed into production, ie some kind of fix or feature, not just dead code.
Doesn't your pre-emptive defensiveness on the matter concern you at all? You stand to make money doing this, but don't sound entirely convinced yourself.
It is quite easy to suck at optimizing Assembly unless we are talking about 8 and 16 bit classical CPUs.

First of all, if one isn't using something like V-Tune to profile the microcode of the written Assembly, they are doing it wrong.

Second, better keep up with all those opcodes.
it's a sim of Quantum processes.

If a QC could be made to run for 2^20 (ish) longer and to have 2^3 better quality than SOTA then they could do this on it. That would be great because it would run in about 10 seconds, which I assume is much quicker than the run time on GPU's (although the article doesn't make that clear).

Also we have to solve the (not so famous) it-takes-2-days-to-turn-the-f-thing-on problem of QC, and also the the-f-thing-costs-a-fortune issue also.

But apart from this being technologically out of reach for 70 years it's absolutely a great and important result.
It is possible, but it raises the difficulty setting of many otherwise trivial life tasks. I'm in my fifties and have never owned a mobile phone, initially because I don't like phone calls, but more recently out of general cussedness. (I do use an ipad.) The number of services for which a phone number for 2FA or confirmation by SMS is mandatory is definitely on the rise. I guess at some point going phoneless may become the equivalent of trying to live without a bank account. But for now, it remains just barely doable.
Some good points! There are, however, also changes that you do not want to propagate to your teammates or production unless you are 100% sure that they are the final solution to the problem you are trying to solve. Sometimes, the complexity of a problem is so high that you have to experiment with the code.

When those changes include non-reversible database migrations, for example, it is better not to integrate that code into "mainline" before you've settled on a specific implementation.
Polar Night
Reminds me of my own comment, some time ago: https://news.ycombinator.com/item?id=33314868

I completely agree with your last sentence. The protected garden Apple creates is a blessing for most tech illiterate users.
I have a kinesis advantage (first version), along with several ergodox variants and other odd split keyboards. I still think it's the best keyboard I have, with the biggest complaint being the crappy esc (and fn keys).

Aside from the key well, the integrated palm rest is a big factor of how the keyboard works. The ergodox variants all require to raise your hands to operate, or use a dumb palm rest. But the position of a normal palm rest doesn't work with the shape of these keyboards.

I also don't get why so many try to reach for the small form factor, literally shaving 1-2 cm and loosing a ton of keys and then spend time adding layers later with all the complexity that this entails. This is also something I'm not fond of the advantage 360 -- loosing the fn row (I would likely have upgraded otherwise).

I wasn't aware of the glove 80 - that's a very nice option. Thanks for mentioning this. Just looking at this (without trying), I instinctively prefer the thumb cluster of the kinesis due to the double-length keys: these allow to move your hands vertically and still allow the thumb to hit the key without flexing). Considering space/bk/enter is placed there, this is not a small point.

However, this might just be bias after years of kinesis use.
Curious; what field are you in?

I'm using ChatGPT (free version) to solve coding problems I can't Google, and while it certainly isn't perfect, for me it's always been at least as good as, and often better than, StackOverflow.

Also using SD for personal art; I don't want to preempt legal (and social! Is art a human peacock tail?) developments regarding copyright and ownership in that area, so the output is strictly limited to the cases I would be willing to use a template meme or if I have an idea for a friend that I lack the skill to create myself.

For SD, I have enough of an eye for detail to be frustrated by its imperfections even though I don't have the skill to even produce the "wrong" version that comes out of SD let alone fix it.
This got relatively little attention here on HN when it first came out, but it seems to be quite an extraordinary move to start reducing free open access to the WWW between the biggest industry giants.

Essentially Cloudflare is working with Apple (and probably Google and Microsoft soon) to ensure that not using an approved device to access the web will mean you get to see more and more CAPTCHAs.
Strange advice.

Git was designed around the idea of a clean history. Now, one might claim that "designed around the idea" does not necessarily mean that it doesn't work if you don't keep a clean history. However, there's a large amount of tooling within git which outright breaks if you don't stick to a clean history. As such, I am just going to go out and state that if you don't want to keep a clean history, you're at best not getting as much out of git as you reasonably could, and at worse, getting less out of git than if you were to use an alternative which was designed around the idea of not keeping a clean history (e.g. fossil).

In summary, even though I often see software projects already doing a bad job of maintaining a clean history already (which is partly because of pull requests being the wrong tool for small change sets (see kernel development for situations where pull requests make sense)), this approach is even worse.

Want continuous integration to work best? Split up the work into smaller parts which can be contributed as smaller individual units (whether you use PRs or some alternative system). Continuously pushing incomplete changes (even if you round them off so tests pass and nothing immediately breaks) is just not compatible with git.
Where I work we have two code bases. The older of the two in TFS and the newer in git. In TFS we use trunk-based development and in git we do pull requests.
I must say that I very much prefer having a formal, tool-protected, review process, doing integrations and testing on a separate branch from the main branch to allowing developers like we do in git to the added ease of being available to commit directly to trunk.
Even with CI to run tests upon committed code you never want to leave your mainline branch in a broken state. No matter how fast the feedback is, because you don't really know how fast your developers will be to act on that feedback!
I don't know of any one resource that gives a overview of everything, I find that browsing Wikipedia for each topic gives a good overview of each topic though, with the overview being the "Internet Architecture" category: https://en.wikipedia.org/wiki/Category:Internet_architecture

Some bookmarks I have regarding BGP and peering that dives into it a bit:

- https://www.fortinet.com/resources/cyberglossary/bgp-border-...

- https://aws.amazon.com/blogs/architecture/internet-routing-a...

- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bg...
Agreed. It's part of my job to review my colleagues code, and I expect reviews from them ideally within a couple hours, maximum 24 hours. I find this practice also helps with knowledge sharing and breaking silos. And while I wait for a review, I can start another task, do some manual QA, grab a coffee, write some docs for this feature, etc. I rarely find myself stuck waiting for reviews.
Like a heart attack during your sleep? It might wake you up before it takes you out.
I built a Dactyl Manuform recently (https://github.com/tshort/dactyl-keyboard) which seems to have keywells like the Kinesis Advantage, and it's been fantastic.

I 3D printed the default case in the repo - I'm yet to start poking around with customising the parameters and OpenSCAD but eventually I'd like to be able to make the case to fit my hands perfectly (as it stands the default thumb cluster on the 5x6 keyboard is a bit large for me).
For us this wouldn't work. PR's are a great way of giving feedback and teaching junior devs. It also gives people people an idea of whats going on with the codebase and provides a way to align code style.

Pair programming.. sure.. but PP is so resource intensive and often it's better to have people focus by themselves imho.
Does a change being accepted into master equal it becoming live in production at your company? That seems even more ludicrous.
Adoption was also slow because there were lots of legacy switches and routers that did not support it. Upgrades took a long time.
Show HN: Rust Port of Pwnpasswordsdownloader
€1.2B GDPR fine for Meta
Thanks, the washing machine does explain things indeed. In the end, if it’s mostly on solar, it matters not that much. I don’t know.
No, we're not all cool with it, but like with AI we're not going to be given a vote on the matter. They failed with Google Glass but eventually they'll force it on us.

Also, realistically, we're kind of already there with cellphones.
Yes, I use WhatsApp, my family uses WhatsApp, my wife's family uses WhatsApp. I found it to be an incredibly effective tool and was a really big fan of Jan Koum and Brian Acton pre-sale to Facebook. And now, I wonder how to replace it. Signal did not become a replacement, if anything it's not that great because user friendliness trumps everything else. Networks are sticky and shifting a network is a damn near impossible task, but then people are using WhatsApp over Facebook Messenger or SMS, so I guess the question is, how do you create another shift? I'm personally developing more and more conviction around the idea of doing something that first tries to tackle this on a personal level before doing it for others e.g How do I get my family off WhatsApp. Well, I might need to run the equivalent as a private server or I might need a way to bridge the chat to pull them over. I might need some sort of really key collaborative feature also.

I definitely think there's a sort of missing tool for family, friends and community. One that's totally private. Maybe like an open source facebook groups. But hosting is a must because no one wants to run it, we just want to know its open source, vetted and we can guarantee it's private. Where Signal was for 1:1 text on Mobile, I think something else could be community first.
Stable release of awesome_flutter_extensions is here! Many more extensions are available now, and everything has been updated for Dart 3.0.0
I think I’m conditioned to have reduced respect for managers because in my experience they are former devs who were “promoted” out of touching the code. As a result, when they offer technical advice, it’s bad technical advice, or at best merely “unhelpful”, usually because it’s obvious (e.g. “did you try {first thing I tried}?”

I pose that such people shouldn’t be devs or managers, but “manager” is a role that tends to be forgiving of under-qualification… because ultimately the good devs don’t need to be “managed.”
> An outsider may not understand the vision and direction of your project. They may not have the same habits and norms for testing, code quality, and style. However, your own team members should share these norms.

Yeah, no. The challenge of running a company is that even within your company, everyone becomes misaligned the moment you’ve aligned. Have you hired anyone new? They don’t understand the company’s vision, nor have internalized your engineering standards. And even once they’ve worked with you for years, they still won’t have aligned on the things that they never ran into, AND they’ll misalign on all the things they've developed opinions on.

> Doing this means that a human only spends time reviewing code that has already been proven technically correct.

Yes, CI is useful for ensuring technical correctness. But technical correctness is one very small aspect of reviewing, and usually not where the big issues come in day to day.

Getting eyes on code is not about preempting things that would fail CI anyway. You probably should be running your full CI suite on PRs, too. To me it’s about catching misalignments on what the product should do, broader misalignments on how it should be engineered, catching misalignments that someone who’s too deep in the weeds would miss, talking through issues realized after the requirements had already been set and discussed, and more. A CI pipeline can’t fix that, pair programming will only address the things that an engineering peer who is as equally in the weeds as the contributor is, and integrating the newest things to production without human review is nice if your product is sufficiently low stakes that subjecting users to the effects of these people problems is okay; but that’s not for me and my team.

Pushing faster is not a pure good without trade offs.
A pull-request based approach is more sane than changing CI/CD to CI/C-MergeConflicts

"pull requests sacrifice performance, including both delivery time and quality"
Delivery time does not matter if your feature is not fully implemented; "Your team members should share your norms for quality" (paraphrased)

The article mentions having "regular, scheduled reviews" which sound like a chore and break flow more than having to review a PR every now and then. Having these on a weekly basis (as the article suggests) while having everyone push daily means you have 5 days of incomplete, unchecked code in your codebase, per engineer, every week.

CI and PRs are not mutually exclusive, you can have your github PR in "draft-mode" and it should still run the same workflows. Have your tests be automated and when the feature is done and passing; you request a review.
Yes, exactly.
Thanks for the clarifying question. :-)

Any kind of artifact in code: modules, functions, classes, arguments, variables...
I am a complete ignoramus in regards anything involving radioactivity, so forgive a bit of a silly question: how dangerous was this kit for kids realistically? If they never broke any of the seals, would this have been relatively safe?
yes thanks for clarifying that. I really do mean, private as in, no one outside of your circles of real connections can see it and it's entirely invite only. Who do I invite into my home and personal conversations? Well not the people on facebook or twitter I'll tell you that much.
What if your browser receives Alt-Svc header and switches to http/3 on one network (say mobile data), but then you switch to a restrictive WiFi that has UDP disabled. All without restarting your browser/within one "session" of your http client. Wouldn't you start having connectivity issues that would be hard to troubleshoot? In that scenario, having http3 disabled is beneficial.
GUI software for professional use takes the same amount of care to develop. I've been involved in data entry applications used for call center agents, cashiers and industrial control. A lot of care is taken about tab-order, keyboard shortcuts, proper use of F-keys, readability of everything, color-coding related functions and stability of known workflows. The advantage that GUI brings to the table is that a novice or one-time-user can make progress by just using the mouse as always. But e.g. with tooltips, a mirrored F-key toolbar (think Norton/Total/Midnight Commander), always on hotkey hints, learning a more efficient workflow is made possible.
It's better in the context of a programming language designed to use it.
> yes, I liked to manually manage memory

I think you are in the minority there, even among Objective-C programmers.

In any case, Objective-C ARC is there for those who want it.
Revenue tells you nothing in terms of how severe that fine is. As others pointed out, it should be in relation to net income.
Yes, "everyone is eventually promoted to their highest level of incompetence" is how I've heard it and there's a definitely some truth in there I think...
The idea in socialised medicine is that we all share the burden- each to their own ability.

Like any other income based tax.
Agreed.

Your selection of password manager is going to be invariably dictated by how many different platforms you need to sync up your password manager with.

And those maintainers of their own password manager are in an arms race.
"Others take 30 minutes"

If you knew what you were doing with Python, you wouldn't have this problem. Obvious solutions include unit tests and pickle.
I understand the hate. I created StrictYAML, which this tool uses, because of it (see the Norway problem - that was me). Type safety is paramount and regular YAML does not have any type safety.

I also understand the hate from the perspective of tools which misuse YAML - putting loops, variables, conditionals, etc. in like ansible or CI tools do, like your tool complains about. I hate that too and haven't done it. I was somewhat inspired by ansible in the beginning but Ive come to understand that it was the wrong approach for configuration management and that a turing complete language is a better approach (i.e. like your rust tool).

I dont want to throw the baby out with the bathwater though. The syntax is a very clean way of displaying hierarchical data, which high level stories need. Nothing else matches - Gherkin is awful at that.
I think it's good to challenge received best practices like this - even if in this case the alternative seems to hinge on something that most teams struggle with even more -- writing sufficient good tests.

I favour a less automated solution: code previews.

The biggest reason I've seen for code reviews taking a long time, is that they're surprising. If an engineer has implemented a full solution without communicating their intention ahead of time, reviewing it is really hard because the reviewer is often starting from zero.

1. Communicate your plan ahead of time

2. Check in with the team whenever meaningful progress has been made, and during/after key decision points (you can use draft PRs for this).

3. When it's ready to land, hopefully enough incremental reviews have been done that the final review is simple box ticking (and yes, perhaps it can be fully automated with CI).

Essentially, I think getting humans to look at your code is important, but it doesn't have to be done in a way that feels like a roadblock.
You know: this always tempts me, but I hold back because nim is not memory-safe (or has a clearly delineated memory-safe subset like Rust), and I would rather pick up an actually memory-safe (even if GCed) language even if some perf-cost (like F#, Ocaml, Swift, Vale ..etc).
IIRC Chrome has whitelisted some domains, but requires a flag to enable it generally.
Link to the recent post about house cleaning to remove 80% of IBM's website (though on Twitter not LinkedIn).

https://twitter.com/bryanfcasey/status/1659941975519375360
Systems administration and car mechanics.
The article actually touches on other methods of review later on.

I agree with a lot of points the author makes: there are other methods of increasing velocity and reviewing code that don't involve costly PRs. But they've become doctrine at many companies, even tiny startups that don't need a lot of process breaking velocity. Know the right time and context.
> it sounds like you’re a young adventurer on the journey

Not exactly, but not very far either (6 years in including 20k+ empl companies and small startups)

Thanks for good advice. I agree with you.
Good article but where is the mention of the car? I don't mean cars with big engines and loud exhausts, just normal cars, doing normal things. Car noise from the tyres, wind and engines is deafening and always with us. You can barely talk to the person beside you on a moderately busy street and we just accept this. Imagine living on that street.
Interesting! What problem is this trying to solve?
I trust 1P cloud storage more with their well thought out security concept than Dropbox or self-hosted nextcloud. The 1P security whitepaper goes into great detail why their cloud concept is not at all comparable to just hosting the vault on block storage.
can imagine that in Berlin, but a city with 10.000 people?
He wasn’t criticising Heroku’s choice. He was critical of the contract developers’ lack of critical thought when adopting the Heroku default.
It is also a big blow to the DPC. There are also many other other questionable DPAs and national legislators, some of which are already under infringement proceedings.

This is big news:

"Furthermore, the EU's Collective Redress Directive must also be implemented this summer, which will for the first time allow collective actions by European user for GDPR violations."
If you're not physically too old, maybe a good time to start a risky hobby like motorcycling, free solo rock climbing, base jumping.
For which purpose? It depends what you want to do with it.
> IPv4 is not going away because it's valuable (as in limited supply creates a market).

That's what I've been telling my bros about crypto.
It's written to trigger me right?

I have introduced prs on low quality teams and guess what happened?

Higher quality, better learning, faster development because we do not constantly fix bugs in production.

Of course automate as much as possible, make the pr cycle short and explain people that creating the pr is not at 99% and you only wait for the button press but more like 70% and expect learning and small rework after.