disconnected

The "free press" doesn't have a "get out of jail free" card of being able to claim that they are just a "platform" and be able to dodge all responsibility for what they print like Facebook does.

If the press writes something objectively false about someone, they are starting at a defamation lawsuit. If they write something that gets someone killed, they will be staring at possible criminal liability. If they print, I dunno, a picture of a child having sex, there'll be hellfire and brimstone (both legal and social).

And no, saying "ha ha, it was just an opinion column" doesn't save them.

"Press" has perks but also has responsibilities. The free press is "ok" with these rules because they've had to follow them for decades. What they want is a level playing field.

(To be fair, knowing ffmpeg exists doesn't mean I'd be able to easily write a video player with it without a lot of research. For that reason I find this tutorial is still quite interesting and valuable.)

The tutorial is still 1000 lines of C, involving SDL, ffmpeg and threads.

Yikes :)

Last time I did something like this (a UI that among other things, played a live stream from a cheapo IP camera), I used python and the libvlc python bindings. Creating a bare bones media player with it was trivial and it worked very well for what I needed. The only complaint I had at the time was that the documentation was absolutely terrible. A cursory look today reveals that they seem to have improved it, so yay?

And yes, the end result in my case came out MUCH smaller than 1000 lines (but lines of code is a shitty metric anyway).

If you "just" need a media player, IMHO, libvlc is not an awful option (in Python, at least - I have no experience with other bindings): https://wiki.videolan.org/LibVLC/

I don't know how long it is "supposed" to take, but you can compile a Linux kernel (27.8M lines of code, though a good chunk of it probably isn't going to be compiled anyway because you don't need it, and another good chunk is architecture specific) in under 10 minutes on relatively modest (but modern) hardware.

On the other hand, something like Chromium (25M lines of code) will take about 8 hours, and bring your machine to its knees as it consumes ALL available resources (granted, last I did this I only had 8GB of RAM, and I was running my desktop at the time... including Chromium). I don't remember exactly how long Firefox takes to build, but I remember it was significantly less time (maybe 3 hours?).

So... it depends? On a lot of things?

(btw, LoC numbers were pulled from the first legitimate looking result I could find on a quick search... take with a grain of salt... also, compilation times are a rough approximation based on my observations... that it with a truckload of salt)

You don't have to be a lawyer to understand that subtraction and multiplication are two completely different operations.

The "web" is built around "human readable" technologies. Even actual implementation details that the user doesn't care about - like the application layer protocol (HTTP) and the source code for pages (HTML, CSS) - is human readable.

The "point" of the web was to serve humans, not machines. If we wanted to serve machines, we'd just throw binary blobs around, which would be orders of magnitude more efficient.

That said, I still have a bunch of "ancient" tech magazines that had directories of URLs for (then) popular websites, grouped by category. That's how we found things then.

People forget that there was a world before Google.

Software certification matters in certain industries.

In automotive and airspace, you will find that being certified opens a bunch of doors for you.

From a company's perspective, these certification don't PROVE that you know what you are doing, but at least they prove that you aren't completely in the dark with regards to all the annoying processes that exist in the industry (stuff like MISRA-C, Automotive SPICE and so on). Or at the very least, you aren't lying when you say that you've TOTALLY heard of them, honest (un-shockingly, people lie on their resumes, even about things that can be easily checked).

This might not get you hired, but it will make them consider you.

The decline of Firefox is largely due to Mozilla's incompetence.

If you look at their own statistics [1], you will notice that (worldwide) usage started declining after the introduction of Quantum (November 2017), and dropped substantially after the April 2019 addons outage.

This would suggest, IMHO, that Firefox loses market share when beloved features - customization, addons - stop working or got worse.

This is unsurprising to anyone who has been using Firefox for a long time: the primary differentiation factor of Firefox has always been customization. Messing with that would always be a risky proposition. Nuking the whole ecosystem entirely and starting over in the space of a few of months was simply idiotic. Disabling everyone's addon's because of an admin screw up was just the icing on the fucking cake.

[1] https://data.firefox.com/dashboard/user-activity

the market has finally caught up to the fact that Tesla is years ahead of their competitors.

Incorrect. The stock value is being pushed up by:

1. Unexpected quarterly profits in October;

2. Tesla planning to open a new factory in China and securing a 1.4 Billion dollar loan to do so;

3. Apparent strong interest in the Cybertruck and the impending announcement of the Model Y;

4. USA and China are easing the trade war, which is pushing the whole stock market up (there have been "records" left and right in the past few days).

But the big one is number 2. Tesla moving into China means that they can tap into the humongous Chinese market.

Thanks for the warning, are there any good tools that integrate with pull request checks that can be self hosted?

Recently at work we've done an analysis of a of CI/CD tools. Many of them are self-hosted, free (and open source) and support a variety of workflows - including pull request related checks (either by polling of via webhooks). A cursory search will yield you a lot to play with, so... go ahead and do that.

That said, if you don't want to think about it too much, you can't go wrong with Jenkins.

Some people will suggest GitLab. I'd steer clear of GitLab, though, because of their operational incompetence [1] and their funny ideas about mandatory corporate espionage [2] - I mean, telemetry - which they only backed away from because people yelled at them. That second one was enough to disqualify them in our analysis (the first one just cemented the idea).

[1] https://about.gitlab.com/blog/2017/02/10/postmortem-of-datab...

[2] https://www.theregister.co.uk/2019/10/30/gitlab_backtracks_o...

sigh

That random file you downloaded off the internet was built under a specific set of assumptions - assumptions that only hold true if you are running the specific OS version they were targeting.

IF you download the .deb file for your specific OS, and IF you manually install all missing dependencies, then it works. Otherwise, you are still screwed.

At least you can extract it (IIRC, it's just a zip file anyway). But that's no different from going to sourceforge or github or whatever and getting the source tarball... and we are back where we started.

By the way, I was not complaining about "vendor lock-in". I was complaining about Debian's package management policies and how they can affect your software development process in practice - to make the case that apt is a crap replacement for a proper language/library/development/whatever oriented package management.

What's wrong with apt is that you can't get what YOU want: you can only get whatever the Debian people decided makes sense for one specific version of the OS - which usually means a 2 years out of date version of the library.

If you need a library of a version other than the Debian approved version, you are back to manually downloading source tarballs from sourceforge and figuring out their arcane build system.

Also, apt doesn't let you have two versions of the same library installed. For SOME things, they have more than one version package, but in general, you can't have STABLE_VERSION installed for your day-to-day OS usage and DEVELOPMENT_VERSION installed for your development needs. You only get one or the other (this isn't exclusive of apt - all Linux package managers do this, AFAIK).

Anyway, contrast that situation with pip (python), where you can just grab whatever version you want, have the package manager solve the dependencies for you, and slap it all into a virtualenv where it won't interfere with your system-level libraries. Heck, you can even grab versions straight from git, and it will (try to) solve the dependencies (if any).

It's a WHOLE different level of convenience.

What, nobody mentioned Microsoft Bob yet? :)

That thing was terrible, but I'm kinda sad that a Microsoft Bob-like window manager (or whatever you want to call it) never panned out.

Yes, it blows for productivity, but it had "personality" - it was colorful and silly unlike your average UI today which either looks "industrial" or subscribes to the "everything is flat and bland" school of thought.

Oh well. Here's to you, Bob:

http://toastytech.com/guis/bob.html

Edit: Ninja'd by https://news.ycombinator.com/item?id=21776932

This seems like a really poorly thought out proposal.

From the draft's [1] intro, which provides motivation for the proposal:

When security vulnerabilities are discovered by independent security researchers, they often lack the channels to report them properly [...]

Occam's Razor: they lack the channel to report those vulnerabilities because the company doesn't give a damn about security, not because of some hitherto unsolved technical difficulty.

Companies that give a damn about security already have either a "catch-all" contact for security related things displayed on their contacts page, or have dedicated pages detailing what the hell you are supposed to do to report a vulnerability. Companies that don't give a damn will continue to not give a damn and will ignore your document, and will continue to suck at security until someone starts punishing them - monetarily - for such appalling behavior.

But let's leave that aside for a moment. Researchers spot vulnerabilities. Need a way to report them. So what's the solution?

Apparently, a text file with only one mandatory field...

3.5.3. Contact

This directive indicates an address that researchers should use for reporting security vulnerabilities. The value MAY be an email address, a phone number and/or a web page with contact information.

...which contains... er... a catch-all contact for security related things and or a link to a contacts page detailing exactly what the hell you are supposed to do to report a vulnerability? sigh...

But the real kicker is that that the standard doesn't even require that the contact information is up to date or valid:

6.2. Incorrect or Stale Information

[...] Organizations SHOULD ensure that information in this file and any referenced resources such as web pages, email addresses and telephone numbers are kept current, are accessible, controlled by the organization, and are kept secure.

In case the meaning of "SHOULD" is in question see RFC 2119 [2], but basically, they "strongly recommend" that you keep your contact information up to day - instead of, I dunno, REQUIRING it, since having a channel to properly report security vulnerabilities is the ENTIRE POINT of this exercise?

/facepalm

Are we really supposed to take this seriously? This is simply security theater.

[1] https://tools.ietf.org/html/draft-foudil-securitytxt-08

[2] https://www.ietf.org/rfc/rfc2119.txt

You are missing the point.

The point is that with DDG, you have a uniform syntax for searching multiple services that doesn't require any special cooperation from your browser or those services, doesn't require any setup apart from using DDG and only requires you to learn one new concept.

And this will work anywhere where webpages work (like, say, lynx), and will work consistently. There are thousands of !bangs, from things ranging from amazon, to wikipedia, to maps, to dictionary definitions... You aren't limited to a handful of hand picked services that your browser decided to support out of the box, or that you decided to manually configure.

Also, there is generally decent support to switch languages and regions for services that support it. For example, "!w" gets you "wikipedia", "!wsimple" gets you the "Simple English" version and "!wpt" gets you the Portuguese version.

IMHO, this is all extremely convenient.

Electronic voting machines run proprietary code which, AFAIK, was never publicly audited (AFAIK, the manufacturers have resisted auditing efforts bitterly).

How can you trust that the machine will behave as you expect in a "real world" setting, when the results truly count?

IMHO, the biggest risk from electronic voting machines isn't some rando swinging the elections with their 1337 haxx0r skills: the biggest risk is that the machines basically come "pre-hacked" from the factory - either intentionally, or unintentionally (bugs happen).

Ok, I'm confused.

As of my posting, the HN submission title is:

Dow plunges 750 points after China devalues its currency

The article title:

Dow plunges 800 points after China devalues its currency

And the first paragraph of the article is:

The Dow tumbled more than 830 points [...]

So... which is it?

Edit to add: ok, the article's contets are apparently dynamically generated (or are being updated manually). I didn't know they did that. You can disregard this comment.

I don't understand it either [...] Esc is even on the same side as the keyboard

Put your hands on the keyboard home row (where they belong).

Try to reach esc without taking them out of there. Hurts, don't it?

Now try reaching caps lock. Much better, right?

That's why.

Caps lock is useless. Esc is extremely useful (for vi users). So we get rid of caps lock and put something more useful there.

Use the middle square method:

https://en.wikipedia.org/wiki/Middle-square_method

It can be trivially calculated with pencil and a paper and will be random enough. You just need to pick a seed and off you go.

If it was good enough for Von Neumann it is good enough for you.

To put it into perspective:

https://solarsystem.nasa.gov/moons/saturn-moons/titan/overvi...

According to this (at the time of reading) a one way trip at the speed of light is ~75 minutes, so you will have approximately two and a half hours of ping.

Ouch.

Still, it raises an interesting question: how would a hypothetical Earth-Titan network protocol work?

According to this:

https://www.ycombinator.com/legal/#trademarks

Hacker News is trademarked.

This article misses the mark completely by assuming that Microsoft still needs Windows to stay afloat.

This hasn't been true for years.

They have realized that it doesn't matter whether you use Windows, Chrome OS, Android or Linux, or anything else: everything is in the cloud now, so the OS is pretty much irrelevant.

Azure, Office 365 and heck, even Linkedin are doing great:

https://www.theregister.co.uk/2018/07/19/microsoft_huge_2018...

So I very much doubt that Microsoft is sweating it about Chromebooks.

EU citizens have turned into pests overnight.

More than USA citizens with dubious DMCA takedown requests?

Across a span of a year, all of this volatility cancels each other out.

Bitcoin price was around $19k in December 2017. The price tumbled all the way down to around 7k in February, came back up to 11k, and now it is hovering at around 8k (numbers massively rounded, but you get the picture).

If we consider this span alone (~6 months), Bitcoin's value has fluctuated by more than 50%.

But if we consider a full year, things are even crazier since bitcoin was worth around 1k then.

Source: https://www.coindesk.com/price/

The above is great if you are selling bitcoin.

It is not so great if you are chained to any sort of contract (loans, phone contracts, car payments, etc).

If the contract stipulates "X bitcoin per month", your loan/rent/whatever went up 8x in one year. If you are chained to that contract for several years (phone contracts in my country are typically for 2 years), you are massively fucked.

Yes, packaging Python applications for distribution is yet another nightmare situation.

Back in the day, we used one of the various "freeze" applications (cxfreeze, bbfreeze, probably others) and some tools developed in-house to package and distribute them for various platforms.

It has been a while since I actually needed to do this, so I don't know what the current state of the art is.

It is not cheating, since no rules were broken.

That said, that power and water isn't free. The city must be paying through the nose for all that power and water.

It has been a while since I played SimCity 3000, but IIRC those deals become extortionate after you hit a certain scale.

"People" keep rattling on about how RSS needs to be revived.

Do these people live in some sort of alternative reality where:

- The guardian

- BBC

- Reuters

- Ars Technica

- LWN

- Hacker News

and a fuck ton others don't have an RSS feed?

Or some sort or reality where Flym (or the myriads of RSS apps) don't exist?

Because I sure as hell don't.

Instead now I need to write a stupid page where I say "[MY NAME] will manage your data this and this way".

Are you referring to the Data Protection Officer (DPO) requirement?

I believe this is the relevant article: https://gdpr-info.eu/art-37-gdpr/

If I understand correctly, you only need to appoint a DPO in cases where you are either a public entity (you are not) or in cases where your site requires "regular and systematic monitoring of data subjects on a large scale", or in a couple of other special cases where you process extremely sensitive data.

Presumably you aren't doing that on "your" forum/webpage, so you don't need to appoint a DPO.

I think you are making a bit of a storm in a teacup here.

That is more difficult than it may appear.

Sometimes you need people that are pretty immersed in a culture to know about these things and avoid shooting yourself in the foot.

Hyundai, for example, almost made the mistake of releasing a vehicle named Kona in Portugal.

Kona is a pretty harmless word in most contexts, but "kona" reads exactly like "cona" for a Portuguese speaker, and "cona" is slag for "vagina".

Oops.

They renamed it Kauai for the Portuguese market, IIRC.

I have a Gentoo system without systemd (I despise the thing for reasons I don't want to get into right now), and I also have Docker running right now.

Worst trouble I had with it was compiling the necessary modules into the kernel when I installed it. The rest was relatively painless (as painless as administering a Gentoo system can be, anyway).

Your post needs a huge dose of clarification.

That is immaterial.

The promise of autonomous cars is that they will be better drivers than human drivers.

That autonomous car, by going 3mph above the speed limit, already failed at the most fundamental level: following the rules.

And it was not even an obscure or ambiguous rule at that, as I assume that there are signs prominently displaying the legal speed limit. But even if there aren't, the rule book covers those situations in an unambiguous way (or at least it does in my country).

Accidents are excusable. Shit happens.

But deliberately failing to follow the rules? That cannot be tolerated.