skysight-inc/HackerNews huggingface dataset:
I see on this thread a lot of people getting blind-folded by the "open-source" term attached to the headline of this article.

First of all RISC-V can mean more than one thing: it can refer to the architecture, which is in fact open and free to use, or it can refer to the implementation of the same architecture, which will not be necessarily free or open source. For example, check the so claimed SiFive company which was promising free and open source implementations of RISC-V: http://www.eetimes.com/document.asp?doc_id=1331690

"“A year ago there was quite a debate if people would license a core if there was a free version, [but now] we’ve seen significant demand for customers who don’t want an open-source version but one better documented with a company behind it,” said Jack Kang, vice president of product and business development at SiFive."

By the end of the day, they just decided to follow ARM's path by providing license fees to their CPUs.

Secondly, when people say that RISC-V is "free" and "open-source" and that will allow companies to create cheaper and more open hardware, that is just an illusion. There are many more things on a SoC other than a CPU (like memories, communication buses, GPUs, power management processors, and so on). Cutting costs on a CPU will not make the cost of an SoC go down to zero, the CPU is just a small part of the puzzle.
With RISC-V, you either need to implement the CPU yourself (which will be extremely expensive and time consuming) or you will have to find someone who provides with CPU cores already implemented. And of course that you need to have support and guarantees that the cores you bought will work on silicon. There will be always a huge cost associated when shipping CPUs, you can't escape from that.

You can already imagine that open-source hardware doesn't play by the same rules as open-source software, it's a completely different game with completely different rules.

And people speak of ARM's royalties like if they were a very bad thing. Truth to be told, the royalties you pay ARM can be a very good deal taking into account that you get access to silicon proven CPU cores, support from the best engineers in the industry and you automatically get covered by the many CPU patents that ARM owns.
And you can even choose on how you want to pay for ARM's CPU licenses: you can either choose to license an already implemented CPU design by ARM or you can buy an architectural license and implement your CPU completely from scratch (this is what Apple and Qualcomm are current doing). You don't need to be completely tied to ARM.
Even in the royalty fees you can choose whether you want to pay a big upfront license fee but then paying low royalties per device or you can choose to pay a low upfront license but compensating on the royalties per device.

There is a lot of misinformation going around the possibilities of RISC-V, mostly of this misinformation coming from people involved in the development of the spec. Don't be fooled by the buzzwords "open-source hardware" and "free hardware".
" You're lining up against Usain Bolt and your advantage is that you're wearing organic cotton. That's just not gonna work."

I'm stealing this as a saying.
Pythooon
> would mean total control of the host, i.e. privileges above any software you can run on a computer.

You don't need arbitrary code execution, the ME already has privileges above any software you can run on the computer. The ME operates in ring -2 mode [0], whereas the OS kernel has at most ring 0 privileges.

With the built-in ME functionality you can: reboot the host, change BIOS settings, re-install the OS, update BIOS (boot FreeDOS & run the vendor utility).

Couple this with a vendor vulnerability such as not signing and verifying a BIOS before flashing, and you can easily use the ME to flash a BIOS with malicious components to the computer.

So, yes, it's not as bad as using the ME to read arbitrary memory regions while the host is on, but the default ME functionality for remote management is still enough for a malicious actor to cause a lot of harm.

[0] https://en.wikipedia.org/wiki/System_Management_Mode
Yeah, you could use the Wayback Machine to check headlines from the past. Though it's not really a practical way to go about things. One thing you could try is to ask yourself if you would be reading an article like this from 6-12 months ago if you came across it today.

For example, would you want to sit down now and read an analysis from September 2016 about who is most likely going to win the U.S. presidential election? No? Then similar pieces (trying to predict elections in 2018, 2020, etc.) are probably not terribly important to you. Would you read a piece from September 2016 about infrastructure issues in the U.S.? Yes? Then that's probably the type of article with more value.

Another would be to wait a few weeks before reading much about breaking news. Some years ago I read the paper daily, and it's interesting how many articles about the major stories are 80-90% the same from day to day with slight updates with the latest information. Better to wait and get the whole story than to get a slow trickle of news with endless rehashes of what you've already been told.

Periodicals that are less interested in breaking news and more interested in long-term stories are good in this regard.
You're right, but key words here are "At this date". What you said could have been said exactly in the same way about Linux against commercial Unices about 15 years ago. It's a long game here, and we're only in the early phase. And it may not take that long, but we'll see.

Regarding technology, just as Linux initially the key is not having a technological advantage, but being cheaper and good enough. The improvements can come later, when the ecosystem gets bigger and more resources pours in.
alt-cache http://archive.is/https://lumina-desktop.org/
That sheet doesn't mean anything, they are comparing a microcontroller clocked at a frequency of 300 MHz with microcontrollers clocked at 30 MHz.

Of course that they have better performance... Misleading marketing material.
Agreed. I found it confusing at first but once I understood that these things are laid out in web.ex it was quite easy to follow the chain to the original functions. I was also confused by where the helper functions came from, but when I realized that some of them are generated automatically from route definitions at complile time, things became clearer.
Things are not that straight forward, I wrote a better comment here: https://news.ycombinator.com/item?id=14284409
NVIDIA's Denver is a feat; I think that if it says anything, it's that ARM's instruction encoding is deficient. AArch64 instruction encoding is less dense than AMD64, and completely lacks compressed instructions (like Thumb). To NVIDIA, it made more sense for them to write a realtime binary translator for an internal ISA which is clearly enabling their microarchitecture more than ARM is.

AMD and Intel spend more money on research than you can even imagine, and it's not surprising that they manage to make x86 machines that lead in single-thread performance, but since Intel tried Itanium, you can tell their designers feel x86 is deficient. I mean, just imagine how much of their chips is just decode.

Also, not to get too childish, but ironically NVIDIA is one of the vendors who is shipping RISC-V in a lot of products. Soon enough, that Denver-style core is going to be sitting on a die right next to a RISC-V. ;- )
Perhaps one day a machine will smell if you are irreparable. Perhaps even smell if any spare parts remain.
for more! https://twitter.com/internetofshit
Leave the kids alone...
MTK51 8051 Microcontroller Trainer Kit
Reinhold Messner speaks about Ueli Steck's death
I feel like the browser could use the Content-Type header to check whether the response is JSON or actual executable javascript - throwing an error if the former
A good example is something like doing a "cp -a". To preserve hardlinks you'll need a mapping, trying to free that at exit can and will take time. This was an actual bug in the coreutils.
prostoalex's point is that hedge fund management varies greatly in its pay, while kingergarten teaching does not. If you want to "play the lottery", do the former. If not, do the latter. It's a free society.
They were implementing HTTP Digest[0]. This leaves no room to choose something other than MD5. And I'm not sure what other HTTP authentication scheme they could had chose for firmware (ie. cannot take dependency on anything in infrastructure, like PKI or Kerb)

[0] https://en.wikipedia.org/wiki/Digest_access_authentication
Apple pays lots of taxes in the US. It doesn't pay US taxes on money earned elsewhere. Can you articulate a sound policy for why any global company should be required to pay taxes in the US on revenues earned elsewhere? Why shouldn't the U.K., Germany, France, Japan, Korea, and China do the same?
Vipi Lesiki?! Nice to see you here.

>My dad understood practically every word that was said on the phone

It is quite uncanny how South African languages sound like Swa. I always find it amusing.
The US is lucky to have strong and effective regulators like CARB and the EPA.

Europe's lack of effective emissions regulation (and enforcement) allowed VW and others to get away with selling polluting toxic vehicles for years.

In fact, despite all that's happened in the US, in Europe they're still getting away with it today.
While the person you're responding to might genuinely be confused about JSON usually being valid JavaScript, arbitrary JSON isn't guaranteed to be: http://timelessrepo.com/json-isnt-a-javascript-subset
Smell, or perhaps taste, is one of the first senses that evolved. Maybe it will be one of the first we get right in machines.
A friend of mine played hosts to some Chinese students in London, as there was one happening he took them along to a demonstration that was happening that day. They were utterly baffled, he said, they asked why anyone would want to protest against the government?
After enjoying coding on 680x0 in my youth and later being frustrated by x86, I acclaim that new ISA. There is a design decision I'm curious about but I could not find related information. How did they come with the names "x0, x1, x2..." for general purpose registers, instead of the more conventional "r0, r1, r2..."?
I hope it gains more traction. In the mean time, I've switched, to Fastmail, and I couldn't be happier. It really is much faster than Gmail, I was very surprised because I didn't think email could be so fast. I guess Gmail had become the new normal.
Let me know how it goes!
I like very much your post. I look forward for your submissions on those topics!
> Do the top 25 hedge fund managers deserve more than all kindergarten teachers combine?

These are hard questions to answer. Lot of people can become a kindergarten teacher but not a lot of people can become a successful hedge fund manager. So in the end the free market decides who deserves more.
> You don't need to be completely tied to ARM.

The point is that if you want to use the ARM ISA you have to pay ARM. Not so with RISC-V. Anyone is free to fab a RISC-V chip without paying royalties.
It basically comes for free if you implement the tree operations efficiently :)
Something like ProbLog https://dtai.cs.kuleuven.be/problog/ ?

On the bottom links under 'Tools' there are some related systems as well.
Some security paper showed ARM disassembly of the issue, although I'm not sure if that was this specific issue or just another "strncmp-induced" issue.

(Btw. there are many smaller Java VMs for stuff like Java Card and JEFF)
Americans don't eat a lot of lamb or mutton at all do they? I once had a shepherd's pie in the US that was made with beef! Presumably because they weren't able to source any lamb at all.
I think if the nytimes were to actually have responded to agjacobsons claim, it would have been with an internal investigation, and then any action would have been taken only after the results of that investigation.
I've had this with someone who I emailed (completely separate from Facebook) being recommended to me. The only logical conclusion I could come to is that Facebook was mining their emails for contacts.
> Selling a magical pill without providing pharmacology is no different than selling snakeoil.
Agreed. I was just not sure if it was a good idea to share my solution as the answers would be mostly anlayzing the solution. I wanted to know more about the problem - and see if such a problem really exists.

But briefly, here is how it works.
1. You give the schema of your DB to the tool.
2. The tool analyzes and build backend flows.
3. The user can now select which fields indicate the username, card or payment amount etc., and the flows will be adjusted for the same.
4. User can add access control to tables and fields.
5. Preview and publish, and the tool is ready to be used.

Since a single tool like this cannot build tools for specific usecase, there is an option to define own actions and layouts.
RISC-V is thrown around like if it's an already working CPU but it is not. It is just a document describing an ISA, you can't compare it to Linux, it's a completely different thing.

There are a lot of costs in implementing an ISA and that includes: design, functional verification, physical implementation and software testing. All those steps together will require hundreds and hundreds of engineers, many expensive tools and thousands of man-hours. And once you are done, you will need to find be careful not to violate any patents while shipping your CPU to the end customer.

By paying a license fee to ARM, you get all these steps done for you plus with support.

Linux is something that you can download from kernel.org, compile overnight and get it booting right away. RISC-V is something that you need to build yourself.
I think the programmer should have supplied the length of the "computed_hash" not the "response" which as I understood supplied by the user.
Like this : strncmp(computed_hash, response, computed_hash_length)
Same experience here, I've lost important mails that cost me money and because of that I've periodically been checking my spam folder - which is a real pain since the spam-folder isn't synced to my external mail client.

So I have to constantly login to their site only to check the spam-folder (talk about convenience). I've setup rules to try to do my best to NEVER send anything to the spam folder but even with catch-all rules gmail still think they know better than me.

Their support for real (external) mail clients is also quite bad, I don't see why so many people in tech use gmail.
Does this trend of replacing TCP/IP with HTTP start being more common, or it just looks to me that way? I get a feeling that HTTP is stretched too much outside of what it's designed for, and it results in messy design.
Thanks for that!

I understand the basic issues, but as replacing the entire OS on my server would be needed to get the required underlying support, plus the pain of dealing with otherwise-unnecessary HTTPS, I'd really need some significant gain to bring that work forward, ie it would hurt me at least a little to try to do it!

Some of my pages do have tens of images, some have hundreds (eg whiteboxes of thumbnails); at the moment I have pushed a little of that heavy load out to other CDNs but maybe I could bring some of it back with HTTP/2?
> In fact, despite all that's happened in the US, in Europe they're still getting away with it today.

Is that a result of weak regulators, or weak regulation? Or both? (Genuine question, I know diesel is much more popular in Europe than in the US)
How can you run an embedded applet in an external viewer? Also, how is that more secure than just running it in the browser?
You are talking like you could download RISC-V from the internet and send it to the foundry for mass production without additional costs or effort.

RISC-V is just a document, is not an implementation. There are many costs involved into designing a CPU that end up costing much more money than paying a license fee.

Check this comment: https://news.ycombinator.com/item?id=14284450
Thank you for that. And besides all that PEV nastiness, Kenya really is a lovely country. If you're ever here, you might want to visit Mombasa - it has a very rich heritage and artifacts that are still intact from as early as 1593. Look up fort jesus.
I was looking for a way a week ago and couldn't find it, but maybe it's just hidden really well.
Growing up(Toronto area of Canada) we always just called cottage pie shepherds pie.
I think hosting the Handbrake, (and Transmission) binaries on the GitHub releases page of the repo would be harder to compromise than their own servers.
What about encrypting/signing? Does it address that too?
JVM Ruby? Nope. If I need a high performance backend, I'd use Swift Perfect or Vapor before I'd use a JVM Ruby (some folks might prefer Rust/Go/etc, but it's the same idea.) You can even use Helix to write Ruby extensions in Rust if that's your thing. If I don't need a high performance (whatever that means) backend I'll stick with standard MRI.

Honestly the "performance" of Rails is rarely because of the Ruby speed but because of bad code choices (such as n+1 queries or just plan writing inefficient methods (retrieving entire objects when pluck might do, for example.)

If "high performance" is needed for specific parts of the application (such as processing and parsing large files,) then I'd just write a Swift microservice. I'd keep the ease of use of Rails overall but "outsource" the inneficient parts, assuming it would benefit the user experience.

My point: Ruby itself isn't really the bottleneck in most Rails codebases and JRuby and it's variants, in my past experience is just too painful to contemplate -- and rarely as necessary as people seem to think.

Just my opinion of course; I have been known to be wrong. ;)
Stephen Fry investigated by Irish police for alleged blasphemy
Three minutes we won't get back.
William Baumol, author of 'cost disease' theory, has died
This is trivial to do, actually, by having a "legacy UI mode" option. Even have several of those.
Delphi... Now that's a name I haven't heard in a long time
Thanks!

The lag was for initial page load, and is just a historical footnote, probably. Here's what I dug up from past chats: In May 2015, for a 250k bullet document, it used to take more than 5 minutes. Apparently by July, it was down to 30s-60s. I'm sure it's much better now!
HI vs. AI (Human Intelligence vs. Artificial Intelligence) Project
Except for search really. I love FastMail but they need to work on the search speed.
Atleast it's faster than Outlook.com though, that search speed is beyond unacceptable.
Just a simple question: If Facebook is harmful why not cut it out of life and cancel the account? Done this some years ago being a lot more happier as a result...

No need to read untrue postings from people claiming that they are the "winners of life" while everybody knows that they did not achieve anything for real...
They use ARC architecture and some embedded JVM. Of course this doesn't guarantee that the AMT web server runs on this JVM.

Few years ago somebody published analysis of the ME firmware for servers (desktop version was compressed with unknown algorithm). I'm sure you can google this for details.

> the fact that the issue was with strncmp

But we don't know for sure if it was strncmp. It's a logic bug, which can be implemented in any language. But again, maybe this server runs outside JVM and is written in C.
Yes, that's interesting. Similarly, Yellowstone-area grizzlies were supposed to lose protected status when the population reached 600. It's at 2,000, they're mauling people and livestock, and they're still protected. Bear-related federal jobs remain secure.

"There is no war but our war."-wag the dog
Been free of Facebook for more than 3 years. There's never been a single moment where I felt I was missing out. Even the staying in touch - for those that matter we found other ways to stay connected.

The final straw for me was actually a girl from my elementary school who wanted to friend me. The chat went like this...

Me: I have to ask you something. So we haven't seen each other for decades, the last time being when we were 7 year olds. Back then we probably exchanged less than 100 words. I don't mean to be rude but I'm genuinely curious to know why you want to connect with me?

Her: Oh I'm sorry. Didn't mean to offend

And that was it. She didn't have a reason other than "just because". That was when it really clicked for me what an utter waste of time Facebook actually is.

Never looked back
American shepherd’s pie tends to comprise ground beef, corn, and mashed potatoes, sometimes with the addition of other veggies (peas, carrots) and cheese. Using lamb would generally be considered unusual.

Lamb & mutton aren’t very popular in the US. In my experience, people who are used to beef expect lamb to be more or less like beef—and since beef definitely should not taste like lamb, they end up thinking lamb has an “off” taste and dismiss it without letting it stand on its own merits.

Thankfully here around San Francisco there are some butchers where you can source good lamb, and the ethnic cuisines include enough lamb that local Westerners are perhaps a bit more accustomed to it.
Wouldn't it make more sense to sign the binary then?
Richard Rothstein’s the Color of Law, Reviewed
Novel Phage Therapy Saves Patient with Multidrug-Resistant Bacterial Infection
I always thought ARM chips were RISC. shows what I know
It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.
What do you mean with 'imperative style programming'?
In that comment you say "RISC-V is thrown around like if it's an already working CPU but it is not" which is false since there are multiple existing, functioning RISC-V implementations in silicon (https://www.sifive.com/products/freedom/), FPGAs and software (https://bellard.org/riscvemu/).

Most people on HN should understand the difference between an ISA specification and its implementation in silicon.
Having a limited liability corporation isn't a natural right, so part of the deal when Apple sets up a subsidiary in a country like New Zealand is that they'll follow the local laws. When they so transparently avoid their tax obligations, the New Zealanders have every right to be annoyed.

If Apple New Zealand shirks their tax responsibility by taking advantage of a backdoor negotiation with Ireland, I would fully expect the local authorities to take action. If Apple's not happy with that outcome, Tim Cook can accept financial and criminal liability for anything that goes awry with Apple products in New Zealand and avoid the use of the local subsidiary.
> Businesses hate instability.

Which ones? How many billions of GDP are created by arms manufacturers directly and indirectly, add to this the vast part of the economy supplying and/or supporting the military one way or the other, from washing clothes to direct semi-military support ("contractors").

So you tell me they want stability? I guess you are right - but they want it for their own growth rate and profit margins.
> does anyone expect RISC-V to really go head-to-head with Xeon, Opteron, ThunderX, Centriq?

Yes, and no. RISC-V is disruptive [1] to both ARM and x86. But before it can run (compete with Intel CPUs), it needs to crawl (compete with low-end ARM CPUs/microcontrollers). It could take a decade or more before RISC-V competes at the high-end. Basically think of it as following ARM's path but on a much more accelerated path (for many different reasons: much larger chip market these days, being open source and royalty-free, etc).

[1] - https://www.youtube.com/watch?v=mbPiAzzGap0
> The US is lucky to have the EPA

For how much longer?
Pretty cool.

I'd use this.
The params of http.get are not documented. Is it possible to specify a random timeout for every http request to simulate long poolling?