chha

We tend to avoid using github repos, but go for published packages from the usual sites; Nuget, Pypi, Npm etc, using Repository and Firewall from Sonatype to act as a proxy between us and the package repos. All packages are analyzed and tagged with various metadata by Sonatype. Firewall lets us define policies for what we can use, and will filter out everything else.

This only works for published dependencies, but based on a couple years experience it works really well. No issues with malware (so far), we don't let packages with known vulns into our codebases and we are notified if a vuln is discovered in something we use.

Just discovered this amazing work inspired by old classics such as Total Annihilation.

tl;dr: Open source modern 3D RTS. Source appears to be located at [1].

[1] - https://github.com/beyond-all-reason/Beyond-All-Reason

Impressive for sure, but I have to admit that the first thing I thought it would be was the launch of the Apollo 17 lunar module: https://youtu.be/9HQfauGJaTs?si=2smTf9G3tomXPpot

Filmed using the rover camera remote controlled from Houston, with a latency of about a second from a command was sent until the camera responded

Not sure about jfrog, but Sonatype does something similar. They basically hash all components/packages from a bunch of different repositories, and then tag the hash with various metadata you can use to create policies.

I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for.

I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.

Wikipedia to the rescue: https://en.m.wikipedia.org/wiki/List_of_aircraft_flown_by_Er...

VAT on EVs isn’t the only mechanism, there is also a one-time toll related to vehicle weight in the works.

First thing I thought of was food commercials, where the goal isn't to replicate the actual looks of the food on offer, but rather what people would like the food to look like. [1] Nice video though, I'm only used to shops having poor plastic imitations or sun-bleeched photos in their windows, if anything at all.

[1] - https://www.youtube.com/watch?v=MflT0I7ZPCs

Also reminded me of European Air War and Total Air War. Loved how you could affect the campaigns, at least to a certain extent.

Absolutely, but I fear such a solution would lead to a lot of people signing just to be compliant, not beacause they did a thourough job reviewing. If we could connect it to a reputation somehow, it might have something going for it

Yeah, that could work, at least for larger orgs. Not so sure the majority of users would comply with such sn extension, or even have the knowledge to review for eg. security issues. Having a working PKI solution that could work regardless of ecosystem would be awesome. If nothing else, I can research which key eg. Microsoft uses, and then allow anything signed by that key as an initial threshold.

Norway here, but I didn’t get it. First guess was that foehn meant foot/feet, but I was way off according to the other comments

This is a universal problem in most of package repositories regardless of language. PKI is difficult, and for it to work the users have to do some homework and place trust somewhere.

> I am unsure whether a jet liner can descend to a breathable altitude (say, 10000 feet) and feed "fresh", or ambient, air into the plane. That seems like a nice redundancy to have and I wonder how realistic it would be to implement ...

This is already in place, and has been since planes began going high enough to require pressurized cabins. The engines basically suck in lots of air which is compressed, resulting in a higher temperature. Most of this goes into the combustion, but some of it goes into other applications, such as the environmental systems supplying the cabin with air.

It doesn't have the same effect as opening all the windows in a car, but considering the outside temperature[1] that might not be such a bad thing.

[1] - https://www.engineeringtoolbox.com/standard-atmosphere-d_604...

Even 100.000.000 isnt all songs. There is still loads of music missing, with changes hppening every now and then as labels pulls specific band lineups not covered by their agreements with Spotify.

There is nothing by eg The Blues Brothers outside the two movies and their debut album. Nothing by Spocks Beard prior to Neal Morse leaving the band. Other albums are stripped of specific songs because a guest artist wasnt part of the overall deal.

There are probably countless other examples as well, and as artists are moving away from physical media completely I fear that entire artist will disappear in the future because they happened to be pulled from streaming services.

Sure they do. But then you have a tunnel under the runway that will flood and potentially freeze. Crumbling concrete and nonflat surfaces is not something you want on a runway or taxiway.

> Do Timpani players themselves play with ear protection? (Pretty common for drummers in pop music.)

I don't. Most of the music I've played in an orchestral setting hasn't really been that loud; there are certain sections of a piece where you might play louder than usual, but most is fairly low in volume. Wearing earplugs would mute everything else, including details you might need to hear, feedback from the conductor etc during rehersals etc.

As an (amateur) percussionist/drummer I will typically only using custom earplugs if I play a really piercing instrument for extended periods, such as bells, chimes orchestral cymbals, or if I'm standing close to them.

A drum kit in an orchestral setting is usually not that loud, at least not from my experience. Drum kits in band settings on the other hand... In those settings I'll usually wear in-ears whenever possible, which gives me a mix of whatever I need to hear, as well as a little bit of my drums so that I can hear what happens onstage. If not possible, I'll wear custom plugs which reduces everything more or less evenly with ̃~25dB.

Or as they say: Welcome to Norway! [1]

[1] - https://www.theguardian.com/world/2017/dec/13/norway-becomes...

Not quite that long, but the Norwegian national broadcaster NRK did a week-long trip one one of the coastal shipping routes in the nortern part of the country. Might be of interest for you. I know they used to offer the whole thing as a torrent, but it can also be found here: https://tv.nrk.no/serie/hurtigruten-minutt-for-minutt

Back when it was popular it was one of the early players which supported a lot of different formats, as well as early radio streaming. Competitors either cost money, wanted you to install IE toolbars, or simply didn't have the features Winamp had. It could be expanded with loads of different plugins (games, visualizers, EQs and other dynamic effects, ++), and could even be used to broadcast streams with the proper plugins IIRC.

For my part, having an updated version of Winamp would be great. I've got a big music library sitting around, never really became friends with foobar, and Plex and Apple Music struggles with some of the formats I've got.

FM is also on the way out, being replaced by DAB. Here in Norway the switchover has already been done, other countries in Europe are also working on it but taking longer time. [1]

[19 - https://en.wikipedia.org/wiki/Digital_Audio_Broadcasting#Cou...

Aftermath - The Remnants of War by Donovan Webster[1] is highly recommended and has a section on Zone Rouge.

[1]: https://www.amazon.com/Aftermath-Remnants-Landmines-Warfare-...

Came across this at random, and finds it a fascinating contrast to my (and probably lots of others on HN) daily job.

There's also The Double Sunrise[0] flight, which was a regular scheduled long-range flight between Australia and Sri Lanka

[0] - https://en.wikipedia.org/wiki/The_Double_Sunrise

Absolutely. But now more than ever it's about the brand, and not the individual. But I think this primarily applies to mainstream music where the artist is likely to have a few hits over a couple years, only to fade out (unless they can build the brand). Go outside mainstream music, and chances are that you'll see something completely different.

Came to think of this one after reading another submission. If you haven't read it before, enjoy!

Musicians need to play live now more than ever to make an income; the sale of physical records are going downwards and have been doing so for the past 20 years. [1]

Unless you happen to be amongst the absolute minority of people having a hit single on your hand or a popular back catalogue, you can't expect to make a lot of money from online streams. Several sources [2][3] report that Spotify pays around 0.003 USD per stream on average. Supposedly your musics share of everything streamed in a given month will also impact the actual payout.

[1] - https://gloriousnoise.com/2022/data-2021-total-music-sales-a... [2] - https://subjekt.no/2020/08/09/som-musiker-er-det-nesten-umul... (Norwegian) [3] - https://www.orpheusaudioacademy.com/spotify-pay/

Already been done:

https://en.m.wikipedia.org/wiki/Smile_(Doctor_Who)

No packages or repositiories deserves trust, at least not in the current state of affairs. There is no magic fix that will enable you to trust packages just by adding a new framework or anything similar, and what the linked article is addressing is only half the problem.

We also need a way to make packages auditable. Package signing by the publisher and the repository needs to be mandatory. Having an actual link between the package and the commit it was built on and a way to reproduce the build[1] also needs to be possible. This would allow for proper code reviews, not just of your own code but also audits of whatever extra components you are using.

Organizations need to define sensible thresholds for when you can use a package and when you implement the code yourself, to avoid adding a library only to use one function. They also need to define trust; what is needed to trust a package or a maintainer.

And we need a system and proper best practice to guide us on what to trust; do we really want to add a package with 100 direct or transitive dependencies, where some hasn't been updated for the past two years, some are maintained by solo developers and some are just implementing already existing functionality?

All of these are hard to implement and justify, when the current situation seem to work for a lot of people.

[1] - https://wiki.debian.org/ReproducibleBuilds

> all the NATO trainings occurred during the war, after Russian aggression against Ukraine began.

Wrong. NATO had at least one Partnership for Peace exercise in Ukraine in October 2002, a few hours drive from L'Viv.[1]

And just to be specific; this doesn't justify any aggression on Russia's behalf, sovereign nations are free to decide who to ally with.

[1] - https://www.nato.int/ims/2002/p021007e.htm

Can it be regarded as mutiny when the pilot isn't part of the crew?

I would have assumed that the captain is the master of the ship, and the pilot is there to provide guidance.

I would have guessed that if the pilot provides guidance that places the ship at risk the master is then responsible if he follows the advice without recognizing the danger.