skysight-inc/HackerNews huggingface dataset:
DMA-based attacks are blocked by the IOMMU, which is present in all modern machines (and has been for a few years). Linux has preferential enablement of DMA such that the IOMMU is initialised first, so even plugging in a device in early boot will not be able to exploit DMA.
Malloc from Scratch[video]
>dangling pointers

C has no standard language provided range checks, and pointer security, but the amount of compiler macroses that do the same/coverage tools/runtime security tools/checks provided by compilers is huge.

At least part of "inherent issues" of C that Rust advocates often cite was long solved by these tools long time ago.

They are not a bullet proof solutions to lack of security features in C, but neither are the built in checks of novel languages. The amount of NX breakouts, syscall hijackings, clever tricks around range checks in so called secure languages being demonstrated every year confirms that.
I'd love to understand the thought process of the exec or product manager who sat in that meeting and said, "You know what we should do? We should just turn off the service and make all of our customers' devices not work anymore! And then see if they'll buy another similar device from us after hearing the news."

Who on earth thought that was a good idea?
5 strategies to survive in a burgeoning market
Awesome, I'll check it out - thanks!
The Name of the Wind - For all the reasons mentioned above, is one of my absolute favorite fiction books. Its not just the characters, its Rothfuss' use of language. I've never kept track of so many quotable phrases in a book.

Enders Shadow Series by Orson Scott Card - I loved the majority of the Ender's Game series was disappointed when it was over. Throughout those books, Bean was always my favorite character and it was a great day when I discovered the Ender's Shadow series which chronicles Bean's life over several books. The thing I loved most about Bean were his powers of analysis and he taught me to think more about scenario outcomes and think about multiple ways of achieving my goals.

Dune - A pattern is emerging here. I love the books where the hero CHOOSES to ascend and works to get there. Paul Atredies starts out a boy against harsh conditions and rises to the challenge.

The Stand by Stephen King - I read this book when I was 14 or 15 on summer break in a week. I fell in from the start and read for entire days until it was done and when it was over I was in awe at the size (1000+ pages) and scope of what King accomplished.

The Alpha Strategy by John Pugsley - Its an interesting book and look at economics and wealth preservation in layman's terms. Its funny because this book was written in the 80s and when I read it, it was immediately applicable. I grew up in a pretty liberal household and this book made me start to pay attention to what liberals and conservatives were saying and form my own opinions.

Atlas Shrugged - I read this right after the book above and the two in combination really caused a mindeset shift for me. It wasn't so much that everyone is out to get me or against me, but more I am responsible for my outcomes and I need to invest in myself.

E-Myth Revisited By Michael Gerber - Piqued my interest in systems and where I started to learn the value of systems and making success repeatable.

Working the System By Sam Carpenter - More of the "how-to" book E-Myth Revisited should have been.

Daemon Series - This one has been mentioned and while it didn't have the impact on my that the other books did, I did enjoy the world the author created.

Thieves Emporium by Max Hernandez - This was a quick read and appealed to my love of technical fiction. Similar to Daemon, its use of technology in the story is interesting and not that far off from the real world at this point. [WARNING: GRAPHIC SCENES]

I was unambitious and coasted through life until after college, and it wasn't until I was in my late 20s that I started really reading books like these. Over the past few years, I've become almost a completely different person. I read a tremendous amount and can say its had a huge impact on my "mental models" and how I approach life.

Books I'm interested in reading next include:
- Meditations
- Works on mental models
- Elon Musk biography (the amount he's able to accomplish quickly is staggering)

I don't read as much fiction as I used to, instead choosing to focus on technical books, but fiction has definitely had an impact on my development as well.
This doesn’t add much on top of the Wired article. Lots of comments on that:

https://news.ycombinator.com/item?id=15609402

Here’s the paper:

https://arxiv.org/abs/1710.09829
iPhone X Review
Are you sure? There's a lot of stuff going on here, and I'm on Firefox. No adblocker or any addons that meddle with page requests or content. https://i.imgur.com/e141uBx.png
link 1: "Gambler has no right to contest non-payment because casino is on tribal land"

link 3: "there was "clearly a display malfunction" and that the machine's maximum payout was programmed for $6,500"

link 3: "the user-agreement, available on the touch screen, said the maximum payout was $10,000"

Why incomprehensible? Because you know (the latter 2) aren't really malfunctions?
Would you mind elaborating or giving a source for that?
> I think this is where we're not agreeing. My point is that focusing on the upside is more important than focusing on the downside. Making more allows you to save more.

I don't think focusing on income and ignoring costs is a good approach to saving money, or life. Both are important. We can agree that focusing only on cost and ignoring income is totally foolish.

> I don't think retiring by cutting costs is a great goal, especially for someone with decades left to live.

The alternative is working longer to save up a bigger nest egg that can support a higher level of spending. That trade-off between working longer and lowering costs is fully a personal choice. To be clear, I'm not taking a stance on which of those choices other people "should" make.

> The decision-making process that I intuit from your posts seems like more of a static model of the world.

I think you're reading in something that isn't there.
Most people don't think that pre-mines are reasonable at all. That's a good way to know which coins are scams. Why do they deserve 0.6% of a total market that could be worth billions of dollars, exactly? Because they changed a hash algorithm and released a marketing website?
Evil Maid refers to the broad spectrum of attacks a hypothetical maid could do with physical access and ranges from a drug addict simply looking to resell the laptop at a pawn shop, to a CIA agent, and not being defeatist involves differentiating between their objectives and capabilities in order to make a sensible decision.

Encrypted drive + shutdown is a defense against a specific Evil Maid attack, cold boot attacks. It is not a very expensive attack to run; for the cost of a can of compressed air, and a USB drive, anybody sophisticated can run this attack. https://en.wikipedia.org/wiki/Cold_boot_attack

Sorry to sound defeatist, but if you had been relying on IOMMU to save you, the trivial "plug anything into a USB port and you have CPU JTAG access" attack has always been possible. (Never mind that IOMMU implementations aren't guaranteed to be bug free.)

In the face of that, what do you do?

With this knowledge, all I really can do is stay up to date and patch-patch-patch. Have a travel Chromebook for leaving in hotel rooms, but ultimately I just have to know that it's not enough, especially against a CIA-grade Evil Maid, or an Evil Maid that's able to factor 4096-bit prime numbers. (That last one's not theoretical, either. It was revealed a few weeks ago that TPMs in Chromebooks and other hardware was generating weak keys, leading to cloud-factorable 4096-bit RSA keys.)

A less-sophisticated Evil Maid can still physically steal my laptop for pawning, and even if they can't get my data, I've still had my laptop stolen. Not-being-defeatist, I backup my data, although that has a totally different set of security concerns over the Internet.
Core team member here. This is indeed something you can already do today, but more importantly which is our next area of focus for development and improvements: https://remotestoragejs.readthedocs.io/en/latest/data-module...

We'd be happy about any and all feedback and ideas about this specific topic. Our community forums are a good place for that: https://community.remotestorage.io
What does a sustainable open source project look like?
This http://slatestarcodex.com/2017/11/09/ars-longa-vita-brevis/ might be relevant to your interests.
I managed to unplug the mic in my Thinkpad and my Dell XPS laptop with about 5min of work for each. It's still possible to do at the moment if you don't mind relying on plugging in headphones w/ a mic to use one.

Of course a switch would be nice, similar to the older Thinkpads which had a hardware switch for the network devices on the front, originally for use on airplanes.
This article's point is lost on me. Its description of a capsule network is indistinguishable from the definition of a regular feedforward neural network.
Yup, don't forget the fact that you'll end up doing pooling, free lists and the exact same performance tricks you'd need to do if you managed memory explicitly.

You're adding a ton of incidental complexity for a benefit that you can't take advantage of(programmer productivity) because you don't have the necessary resources to make it happen(large swaths of memory and > 50ms response times).
I don't know, because there is very little detail about what this attack is and how it works. It looks like they managed to thwart whatever protections exist in the USB DCI (Direct Connect Interface)[1] which is a debugging system for Intel chips.

If they have full debugger access to what's running in Intel ME then removing the code from the firmware probably doesn't make a difference (assuming they can run un-trusted code in that context). If they cannot write their own code and so an attack requires ROP gadgets then removing the code might make it harder (or impossible) to do, but I doubt it.

[1]: http://www2.lauterbach.com/pdf/directory.pdf#M8.newlink.DIR6...
I started with something built on the CGI.pm Perl module.
The longer I look at it, the more Bitcoin looks like a scheme to enrich criminals and enable rogue states to do business. Does it help the world economy that a large handful of people who go into bitcoin early now are controlling millions of dollars that they would have otherwise never, ever seen?

And what of Bitcoins benefits? Anonymous? Not for normal people on coinbase/etc.
Fast? Nope.
Convenient for shopping? Not unless you are on overstock.com or buying magic mushrooms on silk road.
Politically viable? China isn't having it.

Can someone tell me what Bitcoin is good for again?
Or "I won't have to think about this for three years, and everything will keep working during that time, and I don't have to worry about a cron job failing"

I don't mind offering 90 day certificates, but requiring it goes against the offered reason of LE to expand HTTPS.
Yeah, I think there are totally people out there who'd pay for it.

YC does :)

For the YC podcast we chose to host with Backtracks because they offer transcription and allow you to link back to exact times in the episode, sort of like YouTube.
Good job, IBM. You may actually be ahead of other tech companies for once, although Google seems to be breathing down your neck in this area. Others seem to be at least a generation or two behind.

One other thing to note is that until recently it was believed that 50-qubit quantum computer would achieve "quantum supremacy". However, IBM itself has shown that we can simulate 56-qubits on a classical supercomputer.

https://www.ibm.com/blogs/research/2017/10/quantum-computing...

Now let's see who gets to the 100-qubit quantum computer first and achieves quantum supremacy.

Going by recent developments, quantum computers seem to be following a "Moore's Law" of sorts, where their number of qubits pretty much double every two years. We need a few more generations to be sure of this, but it does look like this is the rate at which they are going to evolve.

D-Wave, which isn't a universal quantum computer, has in fact been evolving at 2-4x every 2 years (closer to 2x for last few generations).

This is exciting because unlike classical computers, quantum computers increase their performance by much more than 2x if their number of qubits double every 2 years.
> e.g. programmers do magic things like read the error messages on the screen. Non-programmers not only don't do that, they can't comprehend why it's necessary. (Without exaggerating too much)

More than once it has crossed my mind that it would be worthwhile to build custom error message dialogs that can't be closed for at least 30 seconds (maybe with a secret override) for some areas of our products. The number of times I've been on a support screenshare with customers where they try to connect to some external service, and it fails, and they instantly dismiss the prompt that would tell them exactly why it failed, if they would just read it, is maddening. At least that kind of a built-in delay would give me time to fire up the snipping tool and grab a screenshot from my end...
DOJ: Strong encryption that we don't have access to is “unreasonable”
That is not true. What you're describing is called zero to a few shot learning in the literature and there are specific benchmarks to test this. The author(s) specifically chose to NOT test on these benchmarks and there is no explicit mentions in the paper that they wanted to target a few shot learning.
The problem isn't that he's paying them, it's that he took the land before paying. That's like someone taking your car without your permission and sending you a check in the mail later for a fraction of it's actual worth.
I don’t believe Rust is ready for OS kernels yet. People have written OS kernels but they really stretch the language to do it. For instance, the default heap allocation API panics on failure, which isn’t something I want my kernel to do. There’s work on a new API which doesn’t do this in nightly rust, but they could completely change all that tomorrow.

Additionally, alignment constraints are also really important at that level, but rust doesn’t have a mature way to align structures or arrays.

Rust isn’t ready for this space yet.
If you used Node, you would have IIRC around 40MB (edit: 24MB on my system) of memory overhead before your code even started running. If you are CPU-bound, multiply that by the number of cores you want to use.
Apple passes Samsung for lead in global smartphone market share
Yes there is.

It's not about compilation but currently I try to use a http server written in assembly (https://2ton.com.au/rwasa/)

If you can show some improvements with compilation switches (for example: -lto=8 with static linking), you'll get the attention of those who try to reduce the costs and increase the performances.
You're looking at the real HN, not at the Status Page HN..
Musical.ly Sells for $800M but Peaked by Being Too Silicon Valley
> from a branding standpoint, Uber wants you to think of yourself as interfacing with Uber, not individual drivers.

That doesn't really matter. Nor is it really true, since you inevitably interact with the driver. And it's understood that drivers are humans, and they are different.

McDonalds operates a franchise, you got the same thing, but still, different companies.

Yes, Uber had not structured itself as a franchise, but the use of [sub]contractors to provide a service with a controlled and sort of guaranteed (and well marketed and branded) quality - in itself - doesn't make the drivers employees.

I think the line between contracting and employment is up to the host society to draw.

Usually tax authorities have a few simple rules and if you are in compliance of at least half of them (or if you break at least X of them), then you are a contractor (or disguised employee). For example exclusivity is important here, the rule states that if a contractor gets more than 50% of its income from one entity, then that's one strike (and there are 5 other rules).

Of course it seems in UK law the drivers have standing, so it means there must be some statute about when a contractor is to be treated like employees. (For example, let's say you can't use temp workers, contractors like regular full time employees and not give them free cafeteria, if your regular employees have that perk.)
The presence of large amounts of boilerplate signals an opportunity for abstraction wins.
How can you prove a vulnerability isn't deliberate?

We've seen deliberate security vulnerabilities before (DUAL_EC).
What you are saying has nothing to do with what the article is talking about. The article is badly written which I imagine is the reason for the confusion.

The wired article was much clearer.
There's another thing slowly but inexorably gaining ground: you need to write concurrent code. From your CPU to your cloud, parallel is the new king, much more than before. Any language where two parallel running pieces of code can alter the same variable is not usable for parallel purposes as debugging becomes a special hell.

Hail to Erlang and even more, Elixir.
Yes, you can pre-alloc buffers in Go. And if you are reading and writing to disk, SSDs or HDs, the Go runtime isn't going to be your bottleneck. Yes, you can optimize memory access. That's an explicit design goal.
Python is pretty close to this. Assuming that foo is an instance of class Bar,

foo.method(x)

Is equivalent[1] to

Bar.method(foo, x)

[1] in the absence of monkey patching on foo
I've also noticed a huge spike in really hardcore anti-capitalism comments. I'm all for UBI and adding other strong social safety net features, but I'm seeing more anger/revolutionary sentiment. Maybe it's just a reflection of a shift in population sentiment, but it seems almost like we're getting brigaded by some group.
All these new language features are good taken on their own, but in the big picture many languages are getting relentlessly more complex.

Many are getting to the point the complexity encourages different programming styles within one language that while syntactically valid can be so different that other programmers can't easily understand them (such as C++), which is a problem for delivering business value.

Cohesiveness and simplicity is a feature, that delivers real and significant business value.
A president, as the head of the executive branch, is the chief executive officer, by definition, isn't he/she?
Notchless.space
Really easily? Wikileaks never published this material. Go find it on their website, or archive.org version of it. You’re asking me to prove a negative here.

This material was published by @natsecgeek, Zeynep Tufekci is intentionally trying to mislead people.

Besides, I’m pretty sure the db published by @natsecgeek contained both men and women. It is really fucking weird that they’re only singling out women.

If you're talking about the AKP email leaks otherwise being pretty boring, I totally agree.
If the rules "are there for a reason" then black cabs would be obviously superior and wouldn't be at a competitive disadvantage.

So, obviously those rules don't matter as much to customers as convenience, price and availability do.
heterogeneous big.LITTLE implementations are in consumer android devices since late 2013s.
I wish I could find the link, and Googling is cluttered:

[0] There was an IMF (or World bank?) paper from the 70s, a .txt was online somewhere

It described "a possible future of digital currency" .. and described Bitcoin with a lot of accuracy.

[1] An analysis theorizing Bitcoin was first mined on networked computers running the same hardware config - something about how the randomness repeated and the rate of new hashes being found & the distribution of those hashes among the early addresses.

Again, sorry I don't have a link, I naively assumed I could just search for this stuff in the future without saving a copy.. it was a Wordpress style blog though.
Only wizards in some kind of coastal ego bubble

More like "Burn the programmer! Adobe has crashed for the third time today!", or "Burn the programmer! YouTube has 100k+ likes on my copyrighted video (that someone else uploaded), and all I got was this lousy t-shirt!"
There is no reason why a $1,000 Chromebook should exist
Nope, the main advantage of C/Rust/D/etc is explicit control of memory allocation and placement.

90% of your program performance is going to be dominated by cache usage(unless you're doing something really dumb). With C you can place things next to each other explicitly so that your prefetcher/etc is automatically pulling in the data you need to the L1 cache.

Any ref'd/GC'd language is going to make that really hard(not impossible, but you have to jump through a million hoops like sun.misc.unsafe in Java).

Look up Data Oriented Design if you're interested in this stuff, Mike Acton does a great job covering it.
What does C have to do with Unix? You can write a Unix-like OS in Rust and a Non-Unix like OS in C (or C++[1], like Windows).

It happens to be a trope that C would have died if not for Unix[2], but to the best of my memory of reading programming books of the eighties, C's un-safety was a _feature_, not a bug (I remember Java books were _so_ apologetic that Java didn't have points arithmetic).

In the days before optimizing compilers and slow computers, the ability to write unsafely manipulate arrays was actually useful when one needed speed (and if one wanted to be a "real hacker", one needed to optimize every byte and instruction.) Now it's true that not every program needed that speed, and quite a few would be willing to trade speed for safety, but no "self respecting real programmer" would allow himself to write in _anything_ that wouldn't let him be that "uber-hacker" (sounds familiar? I guess Resume oriented programming is an old problem).

[1]. Before I get the pedants that C++ isn't C, I'd like to remind them that the Windows NT codebase started in the late eighties and early nineties, when C++ _was_ almost like C with classes.

[2]. In reality, quite a few languages took off which were not the same language as their OS (for example, Java, Python, C#). If anything, I'd say it's more important that the compiler vendor be the same company as the OS vendor (see Borland's history), but even that seems like a more modern problem (again, see Borland's history)
Most of those emacs shortcuts work in Cocoa text fields, including TextEdit, your location bar, file dialogs, etc... Some, like ^W, are missing though, but, likewise to .inputrc, they can be added back via:

~/Library/KeyBindings/DefaultKeyBinding.dict

Some people went overboard[0] with it, but hey, whatever floats your boat. At least it makes for some kind of example/demo/documentation for the thing.

As an aside, personal opinion: the separation of Control and Command on macOS is the one thing I love as it makes for a very consistent interface whether I'm in a terminal or in an application.

[0]: https://github.com/ttscoff/KeyBindings
Set a variable... set a property in the component state? Or set a static variable on the class?
the content in question drives a large portion of Youtube's traffic from what I understand. are they sure its a good idea?
That's why you can choose a storage provider to do it for you. But as with email, you're not locked in to a single provider, and small ones will probably not scan your personal data using AI/ML algorithms, like e.g. Google does.

Edit: the library in question also supports using Dropbox and Google Drive, so your users don't even have to know about RS in order to sync your PWA's data to their own account with those.
> Tape over laptop cameras isn't just a "parents-of-friends" thing

Not sure why you took that statement as deriding the practice because some older people are doing it? I noted it merely as an indication of how far the behavioural change has spread as a result of news stories... Of course it's good security hygiene. Not an ideal solution though, as others have already mentioned, compared to a hardware switch or built-in cover.