Recent submissions

Comment · 12 days ago
Yeah it looks to me like we're scraping the bottom of the barrel, if this is what's left.
Comment · 25 days ago
I question this framing:

> Caricaturing a little, we can distinguish two groups in modern educational debates: traditionalists and progressives. Traditionalists think that education should prioritize acquiring knowledge, that it should focus on ‘hard’ subjects like science, mathematics, and foreign languages, and that it should take place in a highly structured environment, where students’ time and behavior are tightly regulated. Progressives think that education should prioritize acquiring skills, that it should embrace ‘soft’ subjects beyond the supposed academic core, and that students should be given wide freedom in which to develop personally and socially.

Today's proponents of "classical education", whom I would categorize as quite conservative, sound like the supposed progressives described above, preferring to teach students how to learn.

From Dorothy L. Sayers' essay "The Lost Tools of Learning":

> What, then, are we to do? We cannot go back to the Middle Ages. That is a cry to which we have become accustomed. We cannot go back -- or can we?

> Is the Trivium [1], then, a sufficient education for life? Properly taught, I believe that it should be. At the end of the Dialectic, the children will probably seem to be far behind their coevals brought up on old-fashioned "modern" methods, so far as detailed knowledge of specific subjects is concerned. But after the age of fourteen they should be able to overhaul the others hand over fist. Indeed, I am not at all sure that a pupil thoroughly proficient in the Trivium would not be fit to proceed immediately to the university at the age of sixteen, thus proving himself the equal of his mediæval counterpart, whose precocity often appears to us so astonishing and unaccountable.

[1] Grammar -> Logic / Dialectic -> Rhetoric

https://www.pccs.org/wp-content/uploads/2016/06/LostToolsOfL...

Comment · 1 month ago
I'm a fan of zero tolerance policies for academic dishonesty. The dean getting involved and mitigating consequences for the ~~customers~~ students is classic.
Comment · 1 month ago
I'm sure somehow it's George W. Bush's fault.
Comment · 2 months ago
Comment · 3 months ago
There is indeed a "draft" release (I think they call it a "deployment"), but AFAIK your choice is then to either publish it or delete it. If you review it and it looks good, you publish it and can't change it thereafter (no changes to files, no adding new files, no removing existing files). If, however, you need to change something in the deployment before publishing it, you have to delete the deployment and create + upload a new "draft" release / deployment (can be same version number, since the previous "draft" wasn't published). AFAIK these "draft" releases are visible only to the author.
Comment · 3 months ago
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if you want to add anything.
Comment · 3 months ago
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
Comment · 3 months ago
Emergent product roadmap in action.
Comment · 4 months ago
Do you mean A&E the television channel?
Comment · 4 months ago
Comment · 5 months ago
Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very limited standard library which encourages dependency explosions), some are just hard (e.g. established cultural norms around version pinning and upgrades, well-established reliance on install scripts) and some are easier (e.g. small tool improvements like min-release-age). I'm personally not going to touch npm with a ten foot pole in the next year or two, but I'd love to see significant improvement, so that I have that option again in 2 or 3 years. Stay safe!
Comment · 5 months ago
Days since last malicious packages in NPM: 0 (evergreen)

Days since last malicious packages in PyPI: 30

Days since last malicious packages in Maven: 120

I'm sure this isn't 100% accurate, and there are probably better metrics (average number of malicious packages per year, average number of developers affected per year, etc) but they aren't as easy as a quick Google News search.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton