skysight-inc/HackerNews huggingface dataset:
one thing I liked about cobra is the auto complete support, but I don't like the manual process of define command and parameter and not easy to extend, so I wrote https://github.com/hujun-open/myflags, it is built-on top of cobra but allow uses a struct to define all commands/args and also easily to extend support new types (even existing types)
It includes some very prominent examples of 2022 ChatGPT output.

I am not saying that the rest of the document does not include valuable content, just providing a warning that some of it uses 2+ year old examples.
I researched this for my own argument parser (https://github.com/blyxxyz/lexopt/issues/13) and concluded that it's a minor issue.

This syntax is supported by argparse and clap, the most popular argument parsers for Python and Rust respectively, and it seems to have caused almost no problems for them. It's a problem for the uutils implementation of cut, since `cut -d=` is common, but that's the only instance I could find after a long time scouring search engines and bug trackers and asking for examples.

If anyone does know of other examples or other places this has been discussed I'd love to hear it though, maybe I just haven't found them.

(Also, the more reliable way to write this in general is `-a "$USER_CONTROLLED_DATA"`, since that'll behave correctly if $USER_CONTROLLED_DATA is empty. As will `-a="$USER_CONTROLLED_DATA"` if you know the command supports it.)
Very similar lawlessness here in Canada, with the tax agency making a secret settlement with KPMG for tax evasion (https://www.cbc.ca/news/business/cra-kmpg-settlement-taxes-1...), the Prime Minister firing the Minister of Justice for continuing to investigate a "state champion" corporation despite being told to stop (SNC Lavalin), and a grocery cartel escaping any prosecution for price-fixing, wage-fixing and wont-compete agreements. "Rule of Law" is a neat just-so story we tell ourselves.
Partial disagree: Yes their blogs may be ugly.

But C# is extremely beautiful, you can read and write it like a novel.

Segoe UI is also not the worst font. I give it a 7/10.
I'm not an expert but maybe keeping the immuno-army busy with constant infections keeps it from going bored and attacking itself
It's best to stay neutral because political parties can change. You don't want the next party to classify you as a troublemaker either when they get their hands on the historical dataset.
Well the acronyms I mentioned are definitely US-centric. But if you don't see the rise of populism world wide, and you don't see the right/left dialectic being driven in large part by rural vs urban tension.. then I'm afraid you don't get out much either.
Optimizing by 1700x by not being silly
> We’re told of the hero, who goes against their managers and executives and doesn’t deliver any stories

> Meanwhile in the real world, hordes of awful engineers deliver no story points

Do you think the point here is that not delivering on one specific metric is a good thing, or that not delivering one specific metric can't be assumed to be the whole picture?
That's a very personality and culture related phenomenon. A lot of folks will, but also a lot of folks won't.

Pointedly not playing the game when you have the political power to do so is often the most effective way to point out issues in the system that folks are being evaluated under. It can be a very wise move in some cases, as well.
Can someone tl;dr: why there is even logic to bypass middleware in the first-place, I feel like I'm missing something obvious here...
On setting all software free, indeed, thats the point made in the post by mjg59. None of the AI companies train on their own proprietary software though, which is telling.

On Affero, that was indeed definitely needed, although some folks on HN seem to think that privately modifying code is allowed by copyright, even if the modified version is outputting a public website, thus what the license says is irrelevant. That seems bogus to me, but seems a loophole if it is legit. Anyway, personally I think that people should simply just never use SaaS, nor web apps. It also doesn't help with data portability.

I'd go further and advocate for legally mandated source code escrow for copyright validity, and GPL like rights to the code once public, which would happen if the software is off the market for N years.
With this attitude you will grow a very specific kind of team. They will be very productive according to your metrics, fiercely loyal, and lethal to anyone who doesn't fit in. However, $diety help you if you ever need to innovate.
Most don't understand this issue:

Auth middleware is used for _routing_ (e.g. if you're not signed-in, you'll be redirected to the sign-in page).

This just means a 500 is thrown due to the auth() call returning null on the server.
I really would like you to sketch out the DX you are expecting here, purely for my understanding of what it is you are looking for.

I find needing to write seperate code in a different language annoying but the UX of it is very explicit of what is happening in the memory which is very useful. With really high performance compute across multiple cores ensuring you don't get arbitrary cache misses is a pain. If we could address CPUs like we address current GPUs( well you can but it's not generally done) it would make it much much simpler.

Want to alter something in parallel, copy it to memory allocated to a specific core which is guaranteed to only be addressed by that core and the do the operations on it.

To do that currently you need to be pedantic about alignment and manually indicate thread affinity to the scheduler etc. Which ia entirely as annoying as GPU programming.
> the more thinking time it gets

That's not how LLMs work. These filler word tokens eat petaflops of compute and don't buy time for it to think.

Unless they're doing some crazy speculative sampling pipeline where the smaller LLM is trained to generate filler words while instructing the pipeline to temporarily ignore the speculative predictions and generate full predictions from the larger LLM. That would be insane.
Antarctic Sea Creatures Discovered After Iceberg Breaks Away
Maybe they based their on-call protocol on what people say they want in hn threads.
It is safer to just put in the space (much like you put in the quotes to be safe). Python's argparse will also accept but not require an `=` separator (maybe optparse, too - I haven't checked that one).
this particular company paid way below market rate with the promise of interesting work. It without a doubt incentivizes hiring new grads where you roll the dice and hope the good ones will stay because they enjoy the job. It's very hard for them to attract experts at the salary that they're offering.
Euclid Space Telescope found 26M Galaxies in one week; opens data treasure trove
`find` is also notorious for its parameter style. But in my opinion programmers sometimes put too much importance on following conventions. You're not gonna go blind from looking at an incorrectly indented line. If the founding fathers of unix didn't want us creating horrifying monstrosities, they shouldn't have given us unlimited access to argv :)
> which makes trying to simply highlight a section of text a fun adventure

Tip: in Firefox, you can hold Alt to drag and select text without triggering links.
96 years ago we there was a massive financial crisis and depression that killed a lot of people and is directly related to the (lack of) national policies of the time.

USA recovered remarkably well, but only because there was a big pivot away from crony capitalism and towards "socialism" under FDR. Big investments in The People, unions, education, infrastructure.

We are going in the former direction right now.
I’m convinced at least in Europe populism has peaked. With Trump as an example, the counter campaigns write themselves. It’s democracy vs fascism now, not woke vs coke.
I don't think it's a snarky take, just odd - even if we boil down the scope of the show into vowels and consonants (which anyone who watched the show knows its more than that), it's like you're making the case not to update schools curriculum over time for a critical age bracket because "It's not like the vowels or consonants change that much."
The Vercel-like auth company Vercel's CEO invested in default recommends middleware for protecting routes:

https://clerk.com/docs/references/nextjs/clerk-middleware

You wouldn't get a user's info, but you'd get free reign to explore every page of a product
Thanks for posting this.

I think it’s important to clarify up front that there are two distinct classes of package managers. The article does that really well.

Btw, I’ve been thinking a lot lately about what would be good names for those. For example, the article calls them "user-centric package managers" (e.g. apt-get) vs. "developer-centric package managers" (e.g. pip.)

For the same ontology, I’ve come up with "system(-level) package managers" vs. "platform package managers". With the former, I’m trying to emphasize that those affect the state of the entire host system. The latter usually has a development or platform environment as its boundary. Regardless, I kinda like the terms that the article proposes.
I wonder why nobody seems to have designed a front end framework by sitting down and asking themselves how to express things clearly. Every single front end framework seems to have been designed by people just riffing on all the nonsense complexity already in the world. Odd syntax rules, lots of implicit behaviors and side effects, logic spread across at least 5 different domains etc.

Why hasn’t anyone talented designed a front end framework?

And before getting angry and downvoting me for this heresy: prove me wrong first.
I went back to school at 37, and got my degree at 40 (2020). I don’t regret it, though it was very tough. My classes were almost all online, and I transferred a “Associates in general studies” from a community college (obtained in 2008).

Here are my thoughts:
1) You don’t have to study your career path. You will almost certainly make more money in software than as an EE. I do electronics as a hobby, and I’m pretty happy with it. I worked full time while taking two classes a term. You already have a career in software. I’m here to tell you: you probably won’t be learning much you don’t already know. I didn’t. Why do you want to go to school to study ME/EE? If you want it, go for it. But if you’re just wanting to complete college, play to your strengths.

2) School is expensive. I cheated by going to a church college that subsidizes tuition. I have since stopped being a church-goer. I’m still proud of myself for getting my degree.

3) My wife is going back to school in mid-forties. It’s not too late.

4) You’re younger than you think. If you’re not too tied down, tear up your life. You’ve got lots in front of you. I had a wife and a newborn (still have both) and a full time job.

5) US university programs strongly bias toward kids coming out of high school. They are a quagmire of bureaucracy. Ask lots of questions about the program, find out what you can skip, what you don’t need, etc. I managed to get out of an internship requirement due to my 15 years in the industry.

Good luck, and I’m proud of you. Education is a worthy goal.
Walk the Shoreline of Your Ignorance
In one of the systems I worked with each ticket had an "assignee" (who did most of the work), a "tech lead" (who knew what's going on and could provide status and guidance), and an "executive owner" (the person you'd escalate to if needed). I suspect those were custom fields and schema could be extended further if desired.
I don't really see why the UI is despised. Windows 8 was bad, 10 brought sanity mostly back, and 11 is in a good state now IMO.
> Possibly compilation and linking. That's very slow for big programs like Chromium.

So instead of fixing the problem (Chromium's bloat) we just trow more memory and computing power at it, hopping that the problem will go away.

Maybe we shall teach programmers to programm. /s
Open source doesn't mean Facebook didn't use it for their own long term profit strategy of getting into that space and getting people to come where they are.

The written interactions behind their decisions are absolutely damning. Of course meta can get away with it because justice is for the little guy and not corporations but claiming "fair use" protects them is rich, considering Facebook's and other companies roles in banning content left and right under the "copyright" banner.
To prevent infinite loops internally.
The Balance of Giving and Taking: Why Community Involvement Is a Long-Term Game
Are there notable uses of Genode?
SeL4 is old news - not a criticism, but has anyone added another formally proven layer or component? (Edit: I mean new components beyond the microkernel, not improvements to the microkernel.)

Also, I suspect some people - maybe some on HN :) - get emotional overload when they see the word 'proof' and their intellectual functions stop. It's not a panacea for the infinite problem of secure IT; it isn't a way to create or discover a perfect and flawless diamond of software. IIUC it means it's proven to meet specific requirements in specific conditions, and those requirements and conditions can be quite narrow; and it says nothing about other functions and conditions that are out of spec. Is that roughly correct?

What does it mean in practical terms? What does a security professional see when they see 'formally proven software'?

What are the specs that SeL4 meet (no, I haven't looked at the OP in a long time)? Isn't that the essential information here?
I lived 14 years overseas (federal agency), in various countries, and my living quarters usually had a safe room, typically just a bedroom steel door with ballistic and forced-entry protection . Additionally, my quarters usually had a guard, or guards - sometimes all day, but certainly at night. In one country, an armored personel carrier with a .50 cal on top was just outside my door.

I never thought much about it, although I did feel rather safe. I dismissed the feeling, just a price of doing business.

Fast forward to retirement in the US. Of course, no guards, no safe room, and glass doors with zero ballistic or forced-entry features. I confess to being so greatly unsettled at the, what seemed to me, the extremely insecure nature of my retirement residence that it drove me to a therapist who described my insecurity as a form of PTSD.

I sleep easy now, no longer panicking at the normal groans of a house, nor need to take anti-depressants - but it was a long haul to get there.

I'm making no point, just relating a personal experience.
That depends entirely on how you implemented your middleware.

This vulnerability also isn't explicitly about auth: it's about attackers being able to send a colon separated list of middleware to skip. That could affect applications in all kinds of unexpected ways depending on what they are using middleware for and how they designed their application.
I've never worked on a team where story points aren't translated into time. I've found story points to be a completely useless level of indirection. Genuine question, has anyone here ever found them useful?
"A listing on the classifications website simply says that it has been refused classification by the IARC Global Rating Tool with no further information provided."
"live in a large city in the US and no real hobbies to speak of". "I’ve been feeling a bit left out and lonely". " I’ve always been a loner and never sought out others’ company." "I’m socially awkward and can come off as having a bad personality".

To me those sentences above are key to address your issues. You simply need to forget about dating and improve your social life. Embrace curiosity and a sense of wonder, explore hobbies, meet new people, listen others and share your life.

You live in a big city so opportunities are all around you.

Focusing on dating without having a social life is like trying to run without being able to stand on your feet.
Sculpt yourself some https://genode.org/
How well does it scale up?
I don’t think it really matters. All you have to do is write middleware or handlers that assume upstream middleware have run, and then that’s vulnerable to this attack.

For example it’s common to write middleware on /admin so that all of your /admin/* handlers don’t have to repeat the same authz logic. And the platform breaking invariants that you should be able to depend on is why it’s a security bug.
Does anyone know which versions of Next.js that is supported?

I don't seem to be able to find a promise from Vercel, but https://endoflife.date/nextjs mentions that 15 and 14 gets security support.
Companies chose to save cash from tax cuts rather than invest it into growth
Reminds me of this: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...
Causal relationships can be hard to discern. Some say that FDR's policies extended the downturn to 10 years whereas recovery from previous downturns was much quicker.

(Also, it is not clear to me how any of this is relevant to "The wealth gap growing, and the median person being better off aren't mutually exclusive".)
(yet another) two kinds of data scientists
That's a tale as old as time, though. In the 1980s, I got in trouble for using "this sucks" or "this blows" around grade one or two. It's now common slang, but it was still too close to its sexual origins at the time (which of course was over my head, but I of course wanted to emulate the older graders).
I feel like containers and Kubernetes are microkernels revenge.

They are for all practical purposes fulfilling the same role.
Taylor is a famous management researcher, that created an entirely new school of management, which by its turn evolved even before his death to become something completely different from the theories held by Taylor himself.

Just to point out in reference to the sibling comment, Taylorism is not a pejorative term, it's the correct name of a school of management. Any pejorative implication on that name is a perfectly deserved result of the quality of the ideas in it.
Not sure, but I think that applies to any 'port of entry', too. So every international airport deep within the country.
I appreciate this. I do indeed talk myself out of it because I keep coming back to the thought of "it's a lot of money, an amount of money that could sustain me if I lost my job for a while". I've dismissed scholarships because I figured I make too much and I'm too old for them, so now I'll give them a closer look.

Do you have anywhere you recommend for a CS degree? I've found it's still the same price as any other degree at the colleges I've looked at.
This attack isn't only about auth, auth is just the most drastic obvious example. Middleware is often used for a wide range of sanity checks. You could bypass, say, limit checks and ask the server to return an infinite number of items per page, quickly overloading the server and resulting in DoS.
Adolescence reveals a terrifying truth: smartphones are poison for boys' minds
https://archive.is/ysoFM
There are a couple important things to also keep in mind:

First: just like there can be individuals who lift up an entire team but are not ticking off tasks themselves, there can be apparently individually productive team members who slow the entire team down for any of a number of reasons. In my experience it's usually either that they are a) fast but terrible, b) have really weird coding styles that might not be bad but are very difficult for others to work with (architecture astronauts and people who barely speak the language often fall here), or c) are process bullies who try to set up the entire review system to enforce their preferences in a hardline way that suits them but delays everyone but them. Each needs to be dealt with very differently, to varying degrees of success, but my honest opinion at this stage is that no matter how productive these people seem by themselves it's mostly harmful to have them on a team. Behavioral issues in senior people tend to be really tough to adjust, and take a lot of energy from a manager that is better spent helping your top performers excel; that said, if you can get them to adjust sometimes it's worth the effort.

Second: pair programming works great for some people, but it is terrible for others. I've measured this on teams by trial and error over fairly long periods, and unfortunately it's also the case that people don't segment neatly based on their preferences, so the obvious "let them choose" method isn't ideal. There are pairs of people who really love pair programming and desperately want to do it all the time who are almost fully 2x as productive when split apart instead (yes, including downstream bugs and follow-ons, meaning that they really are just having two people do the job of one), and there are people who hate pairing who see similar multiples by being forced into it even though they hate it. My rough intuition is that there are two independent variables here, a social factor that measures how much you enjoy pairing, and a style factor that determines how much benefit you derive from it, with the two not correlating much at all. There might even be a slight anticorrelation, because the more social people who love it have already naturally done as much knowledge sharing as is helpful, and the people who hate it are underinvested there and could use some more focus on the fact that they're part of a team.
Scientists think they discovered what existed before the Big Bang
> You see, the reason that Tim’s productivity score was zero, was that he never signed up for any stories. Instead he would spend his day pairing with different teammates.

I'm very glad this essay turned out to take this position, because when I read the first couple paragraphs, I was ramping up to write a mean internet comment about how stupid measuring developer productivity through story points is.

A friend of mine is exactly like this Tim guy he talks abou: he spends time helping other people fix their problems, or takes extra time doing things the right way. His personal velocity suffers, but the team and the code base is greatly improved on net. He was put on a Performance Improvement Plan at one company, and told his job was at stake at another as a result. No question it's kept him at a Senior level when he should be higher at this point in his career. I sort of take it personally, because I worked with him at the company that gave him the PIP, and both he and I quit as a result.

When I see companies trying to measure developer productivity (and tying it to employment and advancement) I think about Seeing Like a State by James Scott, and the concept of legibility: imposing by force a set of rules on a complex, messy system to make it easier to steer from some office far away. Makes it very convenient to managers, and often leads to disaster.
Also discounting that the mind and body themselves are self regulating technology. For instance I have the conscious ability to push pain off into the distance and be unaffected by it, for others they can “take their mind off it” in various ways. Reminds me of Lawrence of Arabia, “the trick is to not care.”

There is more, much more, regarding our humanity and the mind body link which science does not have qualitative ways of exploring.
In these videos zooming through the universe, is it just an optical illusion that seems to give a sense of depth and parallax motion, or is it something they've deliberately done to achieve it? I love the effect's subtlety and much less Ken Burns effect of making 2.5D in your face.