BjornW

What an awesome project. It looks fabulous!

Reminds me of the Dato Duo I have.

The "Dato Duo" is also a synth aimed at kids. It allows 2 kids to play together. it is made by a Dutch company called Dato (https://dato.mu). Their latest musical invention the "Dato Drum" had a successful Kickstarter and is shipping now. This drum machine allows even more kids to play together.

PS: As the owner of a Dato Duo I can share you a little secret: it's also fun for adults :)

No problem. Good luck finding new colleagues.

Had a look at Quatt's website. Just a quick remark: Requiring to fill in information for a brochure about your product, feels weird & I'm not willing too, but ok. However, automatically agreeing to receiving 'marketing communication' & agreeing with your cookie policy when pressing download is definitely not ok. Not from my personal standpoint, but more importantly also not by law (GDPR) although IANAL. Might be a good idea to tell your marketing colleagues about this. Please remind them not to be behave like assholes. Nobody likes forced "marketing communication"...it's just a euphemism for spam. Take care.

Yes, I ran & still run a Jitsi instance and a website which would connect you to one of 12 participating Jitsi server at random applying to our guidelines in the EU.

My goal was offering a low-barrier open for all way to connect with loved ones. During the peak of the Covid pandemic for many people it was easier to connect with colleagues than family members or friends. So I contacted a few sysadmins and public organizations of whom I knew were running Jitsi and asked if it could be shared via our public website. A few agreed and a few dropped by and wanted to help out. After a few days a commercial hosting company decided to sponsor us with one VPS as well.

Our idea was to connect the servers and use the API to select a server with the lowest load. In the meantime we used a randomizer...we've never used the API after all, the randomizer worked well enough ;)

People told us they've used our free service for yoga classes, library book reading clubs, hackerspaces & celebrating birthdays with grandma.

Overall I'm still very proud what we've achieved in a few days with some servers, opensource software and bit of work.

Many thanks to @saghul, 8x8 and all other people contributing to Jitsi. Thank you!

A similar thing happens in the Open Source WordPress plugin repository.

All of my WordPress plugins are free & Open Source. Most are tiny plugins using functionality (filters, actions) part of WordPress core. Unless WordPress becomes backwards-incompatible they will function perfectly fine for the foreseeable future. From my perspective these plugins are feature complete & unless there's a bug, don't need any attention from me. Sadly the WordPress repository expects me to update the version number or else the plugin will be become less visible in search results and a notice will be placed above the plugin's title stating: "This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress."

So for some of my plugins I occasionally 'bump' the version number to make sure people can still find it in the search & for some plugins I just leave it be because I have better things to do. However it didn't feel quite right to keep people using my work in the dark, so I've added a text to communicate this to them. This is the text from my 'Redirect To Homepage' plugin:

"Is this plugin actively being developed? Yes and no. Let me explain: I consider this plugin to be feature complete and unless bugs are found there will be no development on this plugin. In other words this plugin is in maintenance mode and will be maintained for the foreseeable future. Due to other obligations I’m not always able to keep up with WordPress version’s and updating this readme’s ‘Tested up to’ version number. However, unless WordPress significantly changes the way the login_redirect filter works it should work perfectly fine even though the ‘Tested up to’ might be of a lower version number. As always, when in doubt, test it (and when it does give you issues, feel free to leave a comment)."

I think this balances both interests, those of people using (perhaps depending on) my work as well as my own. A similar approach could be used by commercial app stores to restore autonomy & balance interests.

In the Netherlands (Europe), where I reside there are plenty of jobs offering 36 or 32 hours. I think most employers are ok with it since they often also work 36 or 32 hrs. Quite a lot of people share the 'load' of bringing up a family, taking care of parents or sick family members & basic house chores & therefor will (have to) work a bit less than 40hrs.

The url points to a blogpost at Framasoft with information on the release canidate. If you visit the homepage of Peertube (https://joinpeertube.org) you'll likely find the information you are looking for.

Will have a look at this. Thanks for sharing.

I agree. Pro-active audits will only go so far, there is definitely a need for other measures (which are implemented as well). A Content-Security-Policy is as far as I know still really hard to implement well (as in truly protecting assets instead of being a policy tick-off) on WordPress with external plugins and themes. Sadly, a CSP will not protect against attacks running on a post npm install in your development environment, as this is also a risk of using npm packages.

There are multiple attack vectors I can think of, although most can be mitigated using other security measures. I don't want to rely on audits only off course. To give you an example: using the WordPress environment as a stepping stone to gain more access, running client-side software without out permission (stealing data from visitors, our resources e.g. crypto miners), defacement/fake-news, etc.

A WordPress plugin may contain hundreds of interdependent npm packages all neatly bundled and minified. Without access to a package.json or package-lock.json it is quite hard to find out which individual packages have been used. Quite often there is also no public repo available of the development files.

To give an example of my process thus far:

Someone in my team wants to see if we can use plugin X. I’m downloading the plugin to have a look at the code. Luckily this plugin has included a non-minified version of the js file. I can derive the use of npm packages from this file. Using Snyk I have a look at the first package mentioned. It’s axios. The included version is vulnerable (high & medium severity) and has been for almost a year (Note: the last version of the plugin is 3 months old and does not exclude this vulnerable version in it’s package.json which I found in a Github repo later on).

Since I have no package.json nor package-lock.json (all I have is the distributed build) I can’t easily update the npm package. I have no clue as to how this package relates to the other packages and how their version might depend on each other. Even if I would update the package, all other users of this plugin are still vulnerable. I contacted the plugin author. He tells me he will update the plugin as soon as possible. The plugin is (as of today) still not updated & has not released a new version. In the meantime there have been two new versions of the axios package released.

Every user of plugin X is still vulnerable to the issues mentioned on Snyk, but is this a real problem in this specific WordPress plugin context? I’m not sure how to interpret the high & medium severity in the context of this plugin. How exploitable are these issues & what is the impact of the exploits in the context of this plugin? Do I need to be a logged in user? Is this something which can be triggered by any visitor? What am I able to do when I can exploit these vulnerabilities? I can only try to find answers to these questions if I’m willing to invest a lot more time into this, which more or less beats the purpose of using a ‘ready-made’ WordPress plugin. And this is just one package of multiple npm packages used in this plugin. Packages which also have their own dependencies as well….

At this moment I’m wondering if any WordPress plugin using npm packages can be trusted at all.

ps: The way the npm ecosystem is structured is, in my view at least, problematic. Often packages are not like libraries as I’d expect, but look more like a function call or method call. I’d prefer to write these short pieces of code myself instead of depending on external code which also includes extra risks. The very rapid release schedules makes it even harder to trust external software (like a WordPress plugin) using npm packages as it seems they cannot keep up with it.

I’m sorry if this seems like a npm rant, but I’m seriously looking for methods on how to deal with these issues so we can use external software (like WordPress plugins) built with npm packages.

For those interested, Kanflo wasn't the first to create an Arduino like clone in this form factor. For instance there is the the Jeenode and its sibblings developed by Jean-Claude Wippler.

See for more info on this: http://www.digitalsmarties.net/products/JeeNode

I'm happy that Microsoft provides these VM's and I hope other vendors (Hi Apple!) would provide VM's as well. So we can make sure the web is accessible for anyone regardless the browser they use.

Sad to see the word 'hackathon' being misappropriated by a bunch of companies seeking people to test their API's and maybe inspire a bit of new business developments for free.

OpenState.eu is as far as I understood part of this, which I find even sadder since nothing about this concept comes near their goals as stated on their site:

"Open State represents a community of developers and re-users of open data. We work on the basis of a number of open data programs around political transparency, education, culture and health care. Therefore we influence policy in the field of digital transparency, open government and freedom of PSI and data collected by the (semi) public sector."

Please stop using the word hackathon for a lame attempt at sharecropping people.

mryan, I was curious and looked at your site epitech.nl In mybrowser (Firefox 28) there's an issue with words being cut off in weird places.

Have a look at this screenshot http://picpaste.com/Screenshot_from_2014-05-01_15_34_39-OpQO... and notice for instance the first sentence where the Y from the word you is cut off.

I've looked at your theme.css and it seems removing word-break: break-all; from it solves the issue in Firefox.

As a non US person I don't get why she would be beneficial for (as not_paul_graham states) "navigating foreign business opportunities." My first thoughts, as a person living in the EU are exactly opposite.

I like the aesthetics of the hardware, but don't like the environmental impact this will make.

In my personal opinion design should strive to solve problems or answer hard to answer questions like 'how can I print without the environmental impact printing has had for quite some time' instead of creating aesthetically pleasing toys.

For this same reason I'm in dubio about 3D printing & fablabs in general. Unless we find a way to re-use materials we're just creating more junk and roadside litter.

Maybe BERG should rethink Little Printer and let it output eatable paper so we can use the freshly printed news as part of our breakfast ;)

Thanks for sharing your opinion, I've been saying the same things as you've said, except it won't help one bit.

Personally I've decided it's better to strive towards helping out with both new methods like your suggested Tor nodes and 'old methods' like petitions, than doing nothing at all. Only the latter will definitely preserve a status-quo and change nothing. Not for 1 person nor a thousand.

You are correct that just clicking links and tweeting about issues such as the detainment of Bassel might not be very useful, regardless on which website this happens. I've felt like this many times before. Yet doing nothing will most definitely have no effect positive whatsoever. Therefor we try to do something, maybe it is utterly futile and maybe not, but at least we've tried to help a fellow human being getting out of a dire situation.

Personally I hope getting signatures will send a signal to other entities (perhaps more powerful) that helping out with this cause might be beneficial for them. Just because so many people, strangers and friends a like care. Signatures might be useful to fuel other channels like calbear81 is suggesting.

The worst thing in my opinion would be just forgetting people like Bassel and many others in countries with oppressive regimes.

I was referring to yhud previous comment on being naive. Asking questions such as yours is indeed not trolling and apologize for the confusion.

As for your question there is as far as we know little news coming from Syria and rejon who is commenting here as well is on the case to get more info.

Please refrain yourself from making comments that can be read as plain trolling. Feel free to ask questions or comment with arguments instead of these oneliners.

Mhh why do a lot of Android apps need 'READ PHONE STATUS AND IDENTITY' permission? Seems unnecessary and makes me not want to use your app.

Thanks for sharing! I wished more people would share code of projects they are no longer interested in. The educational value ('how did he/she built this') is worth a lot, regardless of the 'quality' of the code. Thank you!

Not entirely. If you're building an application based on GPL licensed code, which is not handed over to the an other party, you're not required to handover any adjustments you've made in the GPL licensed code. That's what is referred to as the 'Services as a loophole' construct (ab)used in the GPL. See also this 2007 article by Tim O'Reilly: http://radar.oreilly.com/2007/07/the-gpl-and-software-as-a-s...

Btw, The AGPL tries to prevent this loophole and does require you to share adjustments made by you on AGPL licensed code even if your only using the software as a service and the other party will not receive the application/code.

PEAR has had a lot of issues, but recently the PEAR community is addressing them. For instance you do NOT have to deal with the PEAR process if you want to use PEAR to distribute your code. You may setup your own channel* and do whatever you please. Secondly PEAR is in the process of setting up it's packages at Github to make it a lot easier to collaborate on code.

I think these changes are great and PEAR's future is looking a lot brighter due to the people driving these changes.

*Personally I think it's a good idea to have some kind of vetting process in place. If you look at for instance the WordPress plugin repository as an example of a repository without it you'll notice loads of crappy plugins or abandoned code. I presume that with a vetting process (and maintainer process) one could prevent this from happening.

Nice! Low power usage is great, but I would like my data to be protected as well. Usually manufactures of devices like this are lacking in making sure my data is protected. After checking the specs I'm missing (for me at least) two basic requirements:

- please make use of https for logging into the device or using the apps on it. Lots of people use open wifi and are not using tunnels like the more technically crowd here on HN.

- Please make sure the device itself is fully encrypted. Devices of this small form factor are easily stolen and full disk encryption is at least making it harder for a common thief to end up with your personal data.

Without these measures I'm not really interested in using these devices for my personal use nor in advising others to buy them.

Good to hear! Next one will probably be in Sept instead of August due to holidays :)

This is why I visit HN. Great hack!

In my experience commercial vs non-commercial is a can of worms. Not to mention that using it for code is not recommend as you can read on the Creative Commons website.

Especially if you (the one licensing your work) are not including a definition of commercial use. Since the license does not include a definition (unless things have radically changed lately) of commercial use, your interpretation of commercial may differ from those using your work. Which for both parties may cause issues.

If you do include a definition than at least the people using your work should have some clue as what constitutes commercial in your interpretation. However 'translating' this across judicial systems/countries/cultures/social spheres will again most likely lead to issues you probably want to avoid.

In my personal opinion the commercial vs non-commercial clause should never have existed in the first place. Maybe it should be shelved just as the Developing Nations license[1] was shelved.

disclosure: I was part of the Creative Commons Netherlands team which introduced the licenses in The Netherlands. I'm still involved in the CC community albeit less active then I used to be.

[1] http://creativecommons.org/licenses/devnations/2.0/

You are correct. If you have more questions do not hesitate to contact Creative Commons. As a former CC Netherlands team member I can assure you they are very willing in answering your questions. Do not forget that there are also some CC mailinglists on which you may find answers as well.