gred
gred on Hacker News
Yeah it looks to me like we're scraping the bottom of the barrel, if this is what's left.
I question this framing:
> Caricaturing a little, we can distinguish two groups in modern educational debates: traditionalists and progressives. Traditionalists think that education should prioritize acquiring knowledge, that it should focus on ‘hard’ subjects like science, mathematics, and foreign languages, and that it should take place in a highly structured environment, where students’ time and behavior are tightly regulated. Progressives think that education should prioritize acquiring skills, that it should embrace ‘soft’ subjects beyond the supposed academic core, and that students should be given wide freedom in which to develop personally and socially.
Today's proponents of "classical education", whom I would categorize as quite conservative, sound like the supposed progressives described above, preferring to teach students how to learn.
From Dorothy L. Sayers' essay "The Lost Tools of Learning":
> What, then, are we to do? We cannot go back to the Middle Ages. That is a cry to which we have become accustomed. We cannot go back -- or can we?
> Is the Trivium [1], then, a sufficient education for life? Properly taught, I believe that it should be. At the end of the Dialectic, the children will probably seem to be far behind their coevals brought up on old-fashioned "modern" methods, so far as detailed knowledge of specific subjects is concerned. But after the
age of fourteen they should be able to overhaul the others hand over fist. Indeed, I am not at all sure that a pupil thoroughly proficient in the Trivium would not be fit to proceed immediately to the university at the age of sixteen, thus proving himself the equal of his mediæval counterpart, whose precocity often appears to us so astonishing and unaccountable.
[1] Grammar -> Logic / Dialectic -> Rhetoric
https://www.pccs.org/wp-content/uploads/2016/06/LostToolsOfL...
I'm a fan of zero tolerance policies for academic dishonesty. The dean getting involved and mitigating consequences for the ~~customers~~ students is classic.
I'm sure somehow it's George W. Bush's fault.
There is indeed a "draft" release (I think they call it a "deployment"), but AFAIK your choice is then to either publish it or delete it. If you review it and it looks good, you publish it and can't change it thereafter (no changes to files, no adding new files, no removing existing files). If, however, you need to change something in the deployment before publishing it, you have to delete the deployment and create + upload a new "draft" release / deployment (can be same version number, since the previous "draft" wasn't published). AFAIK these "draft" releases are visible only to the author.
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if you want to add anything.
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
Emergent product roadmap in action.
Do you mean A&E the television channel?
Just the factual observation which triggered your stereotype-laced rant.
Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very limited standard library which encourages dependency explosions), some are just hard (e.g. established cultural norms around version pinning and upgrades, well-established reliance on install scripts) and some are easier (e.g. small tool improvements like min-release-age). I'm personally not going to touch npm with a ten foot pole in the next year or two, but I'd love to see significant improvement, so that I have that option again in 2 or 3 years. Stay safe!
Days since last malicious packages in NPM: 0 (evergreen)
Days since last malicious packages in PyPI: 30
Days since last malicious packages in Maven: 120
I'm sure this isn't 100% accurate, and there are probably better metrics (average number of malicious packages per year, average number of developers affected per year, etc) but they aren't as easy as a quick Google News search.
New PR: revert GitHub software and infrastructure to version of June 1st, 2018.
New PR: disable new user signups for 6 months
HR initiative: all future KPIs automatically require three-nines availability; all bonuses are forfeited, regardless of accomplishments, if annual availability falls below target
HR initiative: fire CEO and CTO
> The thing keeping maven safe for now is that most people pin [...] versions
Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and the batteries-included standard library which reduces the total number of dependencies, and the fact that a run-of-the-mill third-party library can't execute code at build time, and the very small number of people with credentials to publish new versions of major Maven plugins, etc.
Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository?
Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.
There are npm supply chain exploits in the news every other day. I'm honestly surprised that something as decentralized as Go Modules is more reliable, but here we are. The fact that we're not seeing these stories about e.g. Maven is not at all surprising, given the limited need for third party libraries and the culture of careful upgrades in the Java ecosystem. If npm proponents want the ecosystem to survive, they need to demand / create better and stop making excuses.
The future may be distributed quite unevenly here, as they say, with a divergence between a small amount of "responsible" code in systems which leverage AI defensively, and a larger amount of vibe-coded / prompt-engineered code in systems which don't go through the extra trouble, and in fact create additional risk by cutting corners on human review. I personally know a lot of people using AI to create software faster, but none of them have created special security harnesses a la Mozilla (
https://arstechnica.com/information-technology/2026/05/mozil...).
They should have had the UTF-8 guys tackle IPv6. Talk about elegant.
> run your systems outside of Spain
So much for digital sovereignty :-)
Disagree with so much here. But if, in your mind, the US is turning authoritarian, this is a "cut off your nose to spite your face" move. They should be taking the fight where it most needs fighting. They should not be making donors like myself question whether we still share objectives.
> they have been silenced by the platform
Where do you see that? All I see is a claim that it no longer makes sense from a financial standpoint (but no comparative numbers provided for the other platforms they are keeping, which is sus, especially given their presence on very niche platforms like Bluesky), and vague justifications based on identity politics and "community care" loci, which is either nonsense or deep argot unsuitable for the intended audience.
He's saying that they have ideological concerns beyond the ideological concerns you would tend to associate with the EFF (digital privacy, open source, patent trolling, etc). I for one am sad to see that this is the case. There are fewer and fewer organizations protecting civil rights without being dragged into left/right tribalism.
> this obviously doesn't make any sense
That's debatable, but it's a moot point; it's pastiche, so it doesn't have the same goals or motivations as the original.
https://en.wikipedia.org/wiki/Pastiche
Three years too late, in my case. I've moved on.
Madrid, Spain. It's theoretically very EV-friendly. These days I tend to rent hybrids. I don't even care if the battery actually works. They check the "green" legal checkbox which allows you to go downtown without getting a ticket, and you can rely on the ICE engine to get you where you need to go.
> Practicality beats enthusiasm for 95% of car use.
About two years ago I rented an electric car for a few days. I felt like I wasted a ton of time finding a charging station, jumping through phone app hoops to get the charging process started, and then waiting for the car to charge. I've stayed away from electric rentals since, even though they're often cheaper.