skysight-inc/HackerNews huggingface dataset:
They actually did address it tangentially in the article. The highest the AMD CPU used wattage wise was under 275W. They showed Intel using over 50W more at peak and claimed they’d heard of it pulling over 500W (total, and in a scenario that almost no DC would likely do). So yes, AMD has a significant advantage OpEx and CapEx wise.
I'm not sure I understand the concern with breaking WiFi. Okay, so you're vulnerable to snooping and injection by people in the same coffee shop or your neighborhood. But you're already vulnerable to that from anybody on the Internet between you and the site. HTTPS solves both of these.

Am I missing something?
Avalanches act very much like liquids while they are still moving, swimming upstream is indeed the common advice and it has definitely worked. That is why one of the newest devices to survive one (if you are caught) is basically a life preserver:
https://www.scott-sports.com/global/en/page/avalanche-pack

These serve the dual purpose of protecting your head and decreasing your density so you float to the top of the snow pack.

Yes, obviously there are big enough avalanches with huge slabs that will kill you in the ride, especially if you end up going through trees, but most skier involved avalanches are on more open terrain (thus why they slide) and are loose snow while moving.
You can (try) to restrict your browsing to HTTPS sites only.

But it's very difficult to ensure that all the communications your device is making (background services, vendor apps...) go through that channel.
Yes. He would have tried to persuade them, perhaps cut out the researchers to persuade CERT.
So if i use my wired in node as an ssh tunnel out to the "internets" to tunnel all traffic from my wifi connected nodes then this mitigates the issue till updates come through?
> I had a roommate who worked in the Amazon warehouse. He said it was very chill and easy work. Mind that he was someone who was a day-laborer, worked in filthy factories, and so on, so it's possible contrast principals are at play here.

Having worked at a Fedex hub for a number of years, I can tell you numerous things I've heard about Amazon's warehouses sounded familiar. It's awful work and it destroys your body, and it sounds like they don't even pay as much as Fedex did.

> As for the quality of the products, there are many 3rd party sellers on Amazon who are selling garbage. This is unfortunate, but that's a tough battle for Amazon or the competing sellers to lock down.

There are many ways that Amazon could lock itself down that would hinder the speed at which they are attempting to operate. It's obvious looking at their current methods that they don't see it as enough of a problem to change their core business, and that's the issue. They're ok with selling shite on the side likely because many don't bother to return and because traffic is traffic when it comes to getting people on the site.

> I'm not sure why you'd defend the suppliers who refuse to sell due to iron fisted policies, yet complain about the quality of the products sold. Amazon had / has to do something to clean up the mess. Hopefully it will be beneficial to the buying experience on Amazon.

I'm referring to small businesses and individual operators, not Shenzhen factory castoff resellers. There's a difference between a seller who has a hard time meeting Amazon's policy which largely boils down to "Ship it, right f*ing now" and a seller who is just incompetent or whatever the case may be who can't get packages out in a timely fashion. And more to the point, it's about Amazon's total lack of any flexibility regarding ship times; they expect small business to react with the same sort of frantic pace as they do, with a massive warehouse and drop-shipment infrastructure, and its dumb.
EE380-Colloquim on Computer Systems [video]
I don't recall reading about it anywhere, but I did once look at the implementation (it's wonderful having a reflective system where a single click gets you source of anything onscreen), and it's very straightforward but also kind of gross.

One neat trick I'd forgotten is that if it doesn't find anything interesting with the inputs in the order written, it permutes them and tries again!
No, that was explained in the demonstration video.
Security in layers, and because locally-hosted content may not always be sent over HTTPS (because people love to cut corners).
Maybe, but comp-sci does not study all possible programs with equal probability. A notation should be optimized for the kind of problems that are more often studied, and make expressing those easier.

If this pushes complexity towards the expression of randomly generated programs, that's a good thing (except for the few guys that study randomly generated programs, that is).
To underline your point, even my Nexus 5 (_from Google_), which is a little less than 3 years old, will never receive security updates. And one of the main reasons I chose the Nexus was to be sure to get updates on time. Except for the security vulnerabilities, everything of the device is totally fine. It's such a waste of resources… (In this case I at least have an alternative in the form of Lineage OS, which will only cost me time and nerves for the migration.)
Top 4 Challenges in Mobile App Testing – Biegel
I guess I'll go and generate new (4096-bit) S,E,A GPG subkeys now, just in case...
We crash satellites and spacecraft all the time. Most burns up during re-entry, the rest...well that's why they aim for oceans usually.
Credible partners? Yeah right: http://securityaffairs.co/wordpress/56411/hacking/windows-gd...

No one is credible here. The very nature of a closed agreement of secrecy between arbitrary parties is the opposite of credibility.
The actual TL;DR is that the Core i9 beat the Threadripper ist almost every test.

The bang-for-the-buck argument is only briefly mentioned towards the end, and is followed up by:

One last thing to consider is that the price of just the CPU isn't everything. When it's watered down by the total cost of the system, it may indeed be worth it for some. For example, the Falcon Northwest Talon systems that we used were both dream configurations with $2,400 in GPUs, maybe $1,800 in RAM and $1,200 in SSDs. That doesn't count the motherboard, hard drive, cooling, case, power supply or custom hand-paint jobs. When you're building a box in this range, the price difference in the CPU isn't that much.
What if [...] is FUD. What if Theo de Raadt works for the FSB? We need to work with the facts.

If you don't agree with an embargo and decide to break it, that's on you. But the consequence is that you shouldn't be surprised if next time you're informed later, or not at all. What OpenBSD proponents and developers are doing right now, is damage control. It may work this time, it may work next time, but it won't keep working every time so pick your fights right. It isn't the first debacle OpenBSD has with full disclosure either (hint: OpenSSH).

There are also millions upon millions of devices which won't get patched. Given the vulnerability is apparently the most vulnerable on Linux and hence Android, do you think all the smartphones running Android 4.3, 4.4, 5.0, and 6.0 will be patched [1]?

[1] https://en.wikipedia.org/wiki/Android_(operating_system)#Pla...
diabetes, high cholesterol, cardiovascular health, stroke risk...we give up much more than that for the same food products why would you be surprised?
This issue is two-fold right. You can install plugins that force SSL client side (on the main site and any AJAX calls thereafter) but like you said you have no idea what calls that site is making server side. They could be sending everything you send them over plaintext after the initial TLS secured request. Rough times.
You should only be worried about this if you generated keys on a vulnerable device, such as a smart card (e.g. Yubikey) or a TPM embedded in your computer. You can detect if your card is affected with a variety of tools, both online and offline: https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_t...

Fair word of warning: the offline (as in, on-your-machine) tools use a cornucopia of crypto libraries, meaning that it's nontrivial to build. If you're on macOS and don't know what an LDFLAGS is, you probably want the online checker.

Yubikey has their own tool: https://www.yubico.com/keycheck/

How does the attack work? The paper isn't released yet, but here's an educated guess. The authors have already indicated that this is not another variant of [BCCC13], a paper by Bernstein et al that relied on bugs in the CSPRNG of smart cards to find weak, factorizable keys. It does appear to build on earlier research by the same authors [SNSK16]. The detection tool is released, but that only shows us what the "fingerprints" (symptoms of a weak key) are, not how to factor them.

My best guess is that this is a Coppersmith/Howgrave-Graham [HG] style attack. The crucial difference between this and previous attacks is that the problem results from poor prime selection algorithms, not limited entropy. Briefly: patterns in the low-order bits of N appear in the high-order bits of p (since N=p*q), Coppersmith allows factoring if you guess sufficient high-order bits of p correctly.

So far the results I'm seeing appear to be cryptographically catastrophic but not so much operationally catastrophic. (please don't interpret this as me speaking ill of the paper: the paper is awesome) The range of real keys I've seen is currently between $40k and $4T (yes, trillion). That's pretty bad if you're running a company CA off of a $40k key, but probably not so bad you can't afford to wait for a replacement in most cases. If the fingerprints are to be believed, some keys can be factored in a matter of hours -- but I have no idea yet what the distribution of those keys is (i.e. is it 1 in 10 or 1 in 10k?).

As usual, the issue here is different with signing keys and encryption keys. If you're not using forward-secure ciphersuites and merely signing with a smartcard key (as you typically would be with smartcard-powered SSH or TLS) and instead are really encrypting with the key itself (GPG), you've lost confidentiality on all messages once that key is compromised. A compromised signing key merely allows for forged signatures, and by then you've hopefully revoked trust in that key.

Right now I have to go deal with immigration administrivia, but I'll get back to this.

[BCCC13]: https://smartfacts.cr.yp.to/smartfacts-20130916.pdf

[SNSK16]: https://www.usenix.org/system/files/conference/usenixsecurit...

[HG]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.144...
What is Microsemi's relation to Microsoft?

Similar logo (well, at least colors are similar to Windows logo), similar font, similar name.
Yes. This is the general mental model I use when explaining that the design goal of a good general-purpose language is to shift the complexity to the areas almost no one will care about. Also your corollary from a sibling comment can be restated as saying that you can get extra simplicity for a particular task by designing DSL that will shift complexity to outside of its domain.
Show HN: YC news and live chat for W18 applicants
It's not the "natural sciences" that's telling me this is neurotic. Its the other sciences. It this persistent doom-saying state.

Life's too short to be stuck inside the dark cocoon.
> Is there anything I am missing?

Like, lots, I think.

I don't own property in Switzerland, but you write as if property transactions are in cash up-front. Instead, you put some money down (why the GP mentioned leverage), and the amount you don't make back by investing in stocks is this opportunity cost. The amount saved in rent is also subject to compound interest; unless you are worried that this person is a serial home purchaser those savings will be invested in the market.

I'm sure you can come up with more details and that the market probably wins, but you asked what you were missing.
The paper providers a bunch of public detection tools, both offline (just in case you don't trust them) and online:

tools: https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_t...

online: https://keytester.cryptosense.com/
Suggested Search on Historic Videos
There's a treasure-trove of data and metadata in your DNS requests, destination IP addresses, and traffic analysis. You're not just vulnerable to snooping either, but also traffic injection. You're exposing a much larger attack surface by losing the layer of security provided by WPA2.
"It’s feasible and easy to write assoc-in atop of Dynamic..."

Then why don't you do it and post up the code? If it's as easy as writing the same function in a dynamically typed language it shouldn't take more than a minute or two.

"The idea of assoc-in working for every type of Map also doesn’t make sense. Map only exists statically."

Maybe you're misunderstanding me? I mean it should work for every `Data.Map k a`, where `k => Ord`, just like all the other Data.Map functions.

"Your argument hinges on the idea that it’s impractical to write using Dynamic in Haskell. I do not think this is true."

Then try it?
How is perfect spam filtering the only alternative to obviously terrible and trivial to improve spam filtering?!
The Capitol Hill Babysitting Co-op is sometimes cited as an example of this. https://en.wikipedia.org/wiki/Capitol_Hill_Babysitting_Co-op
"Our main finding is that the only episode in which we find evidence of a link between deflation and depression is the Great Depression (1929—34). We find virtually no evidence of such a link in any other period."

-- Federal Reserve Bank of Minneapolis (Research Department)

https://www.minneapolisfed.org/research/sr/sr331.pdf
For those new to NixOS, the default package installation method is through a concept called channels. It can be a bit confusing reconciling the nature of channels and the real strength of NixOS which is functional reproducibility. I wrote a blog post explaining what channels really are and an alternative which is to use Git commit hashes instead https://matrix.ai/2017/03/13/intro-to-nix-channels-and-repro...
I don't believe the GP is advocating it.

I believe he's implying that you'll get hyperinflation unless you do something draconian to take all the money out of the system.

This may well solve the hyperinflation at the expense of not having any (legal) economy left.
If you have one of those $15-$25 headsets and don't know the answer, here's a youtube video that should provide a close approximation to the answer for you.

https://www.youtube.com/watch?v=wQ5jHZ_CS2g
Grab this to inspire yourself on building next unicorn
That would be an argument against stock market and interest rate as well.

If a significant number of companies waited those 3 months to invest, there would be no deflation.

The deflation will be the same as the increase in a stock market index.
I'm not precisely a pizza fan, so no, but

Devil's advocate, literally ALL of my personal info is online and (sadly) very easily searchable, so at this point...

might as well get some free food out of it...
The site works without any problems using Ghostery (technically not an adblocker, but blocks ads that tracks you so 90% of ads are blocked)

And they have lots about roman concrete, including the Pantheon in Rome
Yep! That's what I'm doing right now.
Web Developer Salaries
Lots of sites aren't on https yet. Some never will be. Additionally there could be intranet communications no one bothered to secure, so maybe the company email's POP server was never configured to send text encrypted.
This is not an end-of-the-world type vulnerability.

1. Does not affect long-term credentials - certs, wifi passwords are still safe. Rather, confidentiality (secrecy) from client --> AP is affected, and in some cases packet forgery is possible (integrity).

2. Actually accomplishing this attack, for now, requires special and expensive hardware (med to high range SDR gear). Its also not that reliable outside of a lab environment.

3. Everything you care about _should_ be going over TLS, which mitigates all effects of this attack. If it isnt, fix it.

This is a great moment for you to fire up wireshark and audit the traffic going over your wireless link. If its not adequately protected and you care about it, fix it.
btw, are yubikeys considered smart cards?
Yeah, I'm looking at those now, too.

> Note that 4096-bit RSA key is not practically factorizable now, but may become so, if the attack is improved.

I have to assume that the attack will improve and -- even if they aren't factorizable now -- will become factorizable at some future time (i.e. "just in case").
If you could find a job in the bay, you can most likely pay for a $500 one way ticket to Wisconsin or Michigan in the summer. By the winter, you would have another job, a $500 a month apartment, and be well on your way to getting your life together.
Note for the purposes of the parent's comment "this generation was ridiculously over attached to social media".

It's not that humans have developed some bizarro attachment to human connections in general.

If anything, human connections have suffered a lot in our age (see all the relevant studies about the rise of loneliness and its impact).

What we do have developed is a bizarro attachment to social media -- spending 1-3 hours per day checking them.
Debugging Concurrency Is Hard, but We Can Do Something About It
They do, and it has been proven successful. I think it is unlikely that Tesla will be able to deliver high-quality cars while maintaining high efficiency if they continue like this.
Show HN: Opshell – SSH Helper for AWS Instances
> this suggests these governments would not have effective economic means to defend themselves

They'll just re-introduce a fiat currency like they did all the other times that this was a problem. Assuming they want to survive.

Historically, communities that favoured philosophical consistency over self preservation tended to become, well, historical.
You'd expect better from the horse's mouth, but most other companies are worse. I got a Fairphone 2 and my partner a Wileyfox Swift 2X. Both have very good software support thus far. Near monthly updates. Wileyfox phone is a bit new, but they got a good track record. Nokia (HMD) also seems to be back, this time with good software support (thus far). Compare that to Motorola.

Hopefully Android Orea 8 with Project Treble will stop this ridiculous trend for the rest of us. Together with the smartphone market being saturated (budget phones of 200 EUR are very decent these days), we may end up with long term support on older yet still decent devices.
Ahh right, that makes more sense. So all the people who proudly boast that they send HTML emails straight to /dev/null actually mean "emails that don't come with a text version".

Sounds less hardball when you put it put that :-)
I wasn't even thinking about the key. I was thinking about compromising a device using a targeted tcp hijack. And then using that device to compromise the rest of the network. Long shot tough.
For being able to run Rust on Bare Metal I thoroughly enjoyed Philipp Opperman's blog series. [0]

Although admittedly I only used his assembler tips so I was able to create a minimal kernel to test for VMware's new desktop requirements on Workstation 14/Fusion 10 where a CPU has to have "VMX Unrestricted Guest" support for their product to be able to run VMs.

Thanks to his blog I was able to create a small bootable cd image to test for Unrestricted Guest features on intel CPUs. [1]

Finally if you want to see Rust as an OS, it already exists! Have a look at Redox [2]

[0] https://os.phil-opp.com/multiboot-kernel/

[1] https://communities.vmware.com/message/2709089#2709089

[2] https://www.redox-os.org/
Survival without a chute seems to involve hitting some large object that slows you like a tree or a bendy roof.

Here's a pic of the roof that saved one guy http://cdn2.fella.com/2016/06/20151717/Magee-11.jpg

(https://en.wikipedia.org/wiki/Alan_Magee)
Full disclosure is reasonable, and the only truly effective methodology. Anything else just allows vendors to delay or ignore.
Java actually has a lot of implementations. [0]

Some examples you might know:

HotSpot, the base for Java SE and OpenJDK

OpenJ9, now run by Eclipse.

DoppioJVM, a JVM for JavaScript.

[0] https://en.wikipedia.org/wiki/List_of_Java_virtual_machines#...
Polhemspriset 2017
Sort of offtopic, but what is with those charts? Is there some rhyme or reason to the ordering that I was missing? Sometimes the AMD was above the Intel and sometimes vice versa. Sometimes the better result was above the worse and sometimes vice versa. I had to squint at the "longer/shorter bars indicate higher performance" captions on every chart to make heads or tails of it...
How to Get Smarter: “Read” and Write, Everyday. Or Listen
The exact sequence of events you are describing happened between 2013-2016 when Bitcoin fell from a hype induced >$1000 to (at its lowest) $200, and didn't rise above $1000 until this year.

It clearly did not kill Bitcoin, and Bitcoin won't die if the same thing happens again.
You would have to have special spark resistant kit though oil rigs are a major fire hazard
(video link is not NSFW)
The Nexus 5 was released 4 years ago. At the same time the iPhone 5C was released. The 5C also won't receive a patch for this.

There is a problem with handset abandonment, but this is true across all vendors, and it does not underline sequence7's claim that this is solely an Android problem.
http://github.com/ClosedXML/ClosedXML is a wrapper around OpenXML and attempts to fill that gap. It has partial support of Excel formula evaluation.

Disclaimer: I'm a current ClosedXML contributor.
For example you have a forum post with 1000 messages starting in 2007, and you are dying to know what happened in the discourse in 2011. So basically you need to jump in the middle by bisection.

1000 is tiny by DB standards but solutions like this one are often bolted without considerations.
I haven't been looking at systemd-nspawn for some time, but judging from its man page:

- ability to use config files (in nsjail in protobuf format)

- 3 operational modes: one of them allows to listen on a TCP port and run processes on-demand (inetd-style)

- support for cgroups (pid and mem limiting), here rlimits are not enough

- more expressive seccomp-bpf rules
How would you make sure that apps use TLS for comunication? In the browser it's easy to see, but in apps those details are hidden away from the user.
it's kind of crazy that here in 2017 there are still discussions and debates on what exactly is the best way to paginate a large table in a database.

I'm leaning with @jerf that the LIMIT/OFFSET approach can trap you on the 100M record scale, however in all honesty, most of us don't deal with databases at this size. As @alvil stated, his approach works fine for 1M records, which is way more then most personal and application databases will contain.

Maybe the solution is for the database vendor to actually implement and document a definitive solution for this. Maybe re-engineering the LIMIT/OFFSET approach under the hood to take advantage of this new way.

As for the article... I really have a personal problem when authors get lazy and take the easy way out by assuming everyone knows what they are talking about. Take this portion of the article

========================

Simplified algorithm:

We get PAGE_SIZE number of records from the table. Starting offset value is 0.

Use the max returned value for user_id in the batch as the offset for the next page.

Get the next batch from the records which have user_id value higher than current offset.

========================

The author took the time to write an entire article debating and demonstrating their solution to the whole pagination problem and they couldn't take 5 minutes to show the code behind these steps in their solution?

As I stated, it's just a personal thing.

UPDATE: Down the internet rabbit hole I go. Here is a very nice article similarly demonstrating and debating the LIMIT/OFFSET approach in MSSQL between their OFFSET/FETCH and CTE.

https://sqlperformance.com/2015/01/t-sql-queries/pagination-...
How I Found My First Remote Job