jermo

Chess is only in chaos because Carlsen did not provide any details and remains quiet. Hence all the speculation.

In his full stream he went into more details (summary https://www.reddit.com/r/chess/comments/x7yzee/comment/inj3c...)

"non-technical example of people using signals when players leave the board (in the bathroom, over a balcony etc) and in technical ways suggests that certain earpieces could pass checks or potentially other small devices"

Works in MiniHack on iOS (unofficial)

That is a link to Chinese satellite launch mission. Would the booster even be noticeable in the US at aircraft altitude?

A lot of projects publish to Central from cloud CIs. That means that private keys are stored in config/secrets. It is debatable whether that makes the artifacts more reliable since you have to trust the CI.

Would like to start using Wren though issues like this put me off: "Stack corruption" https://github.com/wren-lang/wren/issues/761

Using older and more established languages seems less risky.

Matthew Walker's "Why We Sleep" Is Riddled with Scientific and Factual Errors https://guzey.com/books/why-we-sleep/

There is in Gradle 5.1+ but not in Maven, afaik. They are using Maven in their examples, however.

Seems like the Maven registry is susceptible to artifact hijacking.

Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories:

    - https://maven.pkg.github.com/USER1 
    - https://maven.pkg.github.com/USER2

In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything.

Another case - someone deletes their GH account and another user takes it: https://blog.sonatype.com/hijacking-of-a-known-github-id-go-...

Docs: https://help.github.com/en/articles/configuring-maven-for-us...

Disagree about being the death of Maven Central - they are different beasts.

- Central has a global namespace of artifacts. com.google.guava is the same for everyone. This will probably stay the default of open-source libraries.

- GitHub Package Registry has a per-user maven repository, so a local namespace (https://maven.pkg.github.com/OWNER). This is likely to be used by companies internally.

In order to use GH Registry instead of Central, I would have to add a dozen maven repositories to my settings.xml. I doubt many developers will be up for that.

Docs: https://help.github.com/en/articles/configuring-maven-for-us...

One of the easiest is jitpack.io which builds and publishes to its own Maven repository

Thought I'd share something I discovered about Json comparison. This simple line also works:

  return jsonObject1.toMap().equals(jsonObject2.equals);

because JsonObject uses HashMap internally which supports equals(). The downside is it would be slower because toMap() creates a copy.

Btw, downloaded java-commons as Maven dependency from JitPack: https://jitpack.io/#blobcity/java-commons

./gradlew dependencies will not tell you which versions play nice together.

If you don't need full SQL then you can use embedded key-value stores: - RocksDB - MapDB

Have you considered adding Stack Exchange or Quora integration and then using reputation from those sources? Might help in avoiding bots/trolls

The article says it is a 2 year old startup but its more like 3-4. Incorporated in Sep 2014

I believe "reproducible build" is a more appropriate term.

Unfortunately its quite difficult to get a fully reproducible build with Maven as the post points out. Even if you manage to replicate the build environment and settings, Maven produced binaries will be slightly different on each run. File timestamps are saved in jar files so they change on every build.

It recommends using the Maven wrapper to fix Maven's version.

Presumably Kafka Streams KTables

I've found that Project Lombok solves this problem for me. Simply add a @Data or @Value annotation and it will generate getters/setters/hashCode/toString etc. https://projectlombok.org/features/Value.html

From Oracle Security Alert for CVE-2016-0636

  This vulnerability applies to Java deployments, typically in clients running 
  sandboxed Java Web Start applications or sandboxed Java 
  applets, that load and run untrusted code (e.g., code that 
  comes from the internet) and rely on the Java sandbox for 
  security. 

  This vulnerability does not apply to Java deployments, 
  typically in servers, that load and run only trusted code 
  (e.g., code installed by an administrator).

[1] http://www.oracle.com/technetwork/topics/security/alert-cve-...

  > I still missed something on top of Executors and CompletionStage.

You could use RxKotlin. It has Schedulers and Observables/Single/Completable for interacting with async tasks. https://github.com/ReactiveX/RxKotlin

The downside is that you bring in another layer of indirection and, as a result, greater cognitive load for yourself.

Mycode -> facade -> library

Navigating code becomes more cumbersome and stack traces longer. I do like this approach too but it isn't free.