skysight-inc/HackerNews huggingface dataset:
They didn't unintentionally break security features; they knowingly did so - the potential for information disclosure was widely documented. In their defense - the solution isn't trivial in general, and large parts of at least spectre apply in ways a CPU would be hard pressed to prevent (how is a CPU to know that even though memory isn't marked as protected from currently running code in actual fact that's because the JIT and the JIT-tted code are running in the same memory space?). But the intel CPUs are leaking a lot more data than reasonable.
>Compare the kids who grew up on their iPads against a kid in Eastern Europe who grew up hacking on a Linux or even Windows machine using a real keyboard. Wouldn’t the latter have all sorts of advantages in all sorts of jobs?

No, especially since the other kids grew up in a more dominant economy and have way more opportunities (which matters more than learning to mess on a cli).

Besides, the degree to which Eastern European kids learn to "hack on Linux" is perhaps overrated. Most kinds in school couldn't even learn to power on the PC on their own (but amazingly one would teach another all there is to start playing some game).
How come this wasn't discovered sooner?

It would seem to me that all the really smart people who designed super-scalar processors and all the nifty tricks that CPUs do today - would have thought that these attacks would be in the realm of possibility. If that's the case - who's to say these attacks haven't been used in the wild by sophisticated players for years now?

Seems like the perfect attack. Undetectable. No log traces.
What would that provide? You'd have a processor that exists that would have one (and only one) operating system that can run on it and everyone else (except for some of the 'linux on everything' types) would ignore.

This is the sparc and sun or MIPS and Irix all over again... except this time without any viable business model to keep moving forward and progressing on hardware or software.

So what if they make their processor that is free from all known processor level bugs. Would that mean dropping support for all the other processors? or would they still need to be aware of the processor bugs that exist in other architectures that they'd still be expected to create patches for? Would they have the resources to fix processor bugs in their own design when they are discovered?

My read on this is that it doesn't make any sense for an operating system organization that lacks any financials to try to pursue custom hardware.
How Postgres could index itself?
> This exploit is very hard to imagine before now.

It's really not. It's the sort of thing you wonder after first learning about out-of-order and speculative execution in a computer architecture class, but your professor assures you that implementors have been very careful to ensure any partial execution is properly flushed and rolled back. Then it turns out that, nope, no one's actually been keeping an eye on this after all.
Tesla Model 3 – The first serious review
Thanks for the reply.

I agree with what you say. I'm not tying to say people should all jump to k8s. Having options on the market is great.

But I was trying to refute the notion that Kubernetes has no advantages unless you're running a huge cluster. My main points where:

* It works great with 1 node.

* It comes with many features that Swarm does not have that are useful even at 1 node (PersistentVolumes, StatefulSets are biggest for me, though there are _many_ more I wouldn't want to go without anymore).

* Docker is not trivial to set up, either.

> How do I install GKE on my servers? ;)

Yes, of course. I was just saying there's a solid option to start exploring quickly.

> It only listens for commands on a local socket.

This is kind of a non-starter, isn't it? Of course it's easy to apt-get install docker, but then you want to control it remotely, right? Once you realize how nice it is to control Docker remotely, it's hard to imagine life before.
Yes, all very true, but all of that is utterly irrelevant for the home NAS in 95% of cases since performance is not that critical and it comes at an enormous cost of wasted space, also physical space is a huge deal since adding two redundancy drives for each raidz2 quickly adds up. As well as noise etc.

And if we want to talk optimized setups it really isn't recommended to add new vdevs to a already populated pool since the usage will be quite unbalanced and affect performance as well.
Bare Minimum Tech for Spaceworthy Vessel
Whilst I sympathise with your frustration, at least with Intel, I can't help feeling like you might be storing up bigger problems for yourself with this course of action.
Uuuh that shit again. Had to write code long ago that tries to set outputs to clone if one of them is a projector (on X11). Seemed simple at first since it seems to be agreed upon that projectors report a physical size of 0x0 via edid. Which makes kinda sense since you don't have a fixed image size. Until I discovered that some projectors don't because the vendor thought it would be better to report an arbitrary value. Then you got setups where there's a middle box that swallows edid or just reports other random data.
On Being a Happy and Ethical Member of an Unhappy and Unethical Profession 1999
Yeah, I couldn't make that work for me (on Linux or MacOS) .. although I'd love it if there were a way to quickly get 'just the directory' or 'just the filename' in bash with a shortcut, instead of having to resort to $(dirname blah) and so on .. I'm sure there is some way but :h doesn't look to be the shortcut as expected.
Christmas Charity Campaign: Cryptocommunity to Support Newborns Treatment
Exactly: GNU bash is on most GNU/Linux systems, but:

* mac OS uses an ancient version of bash

* Embedded systems use busybox sh

* Android uses its own version of sh

* None of the BSDs come with bash, since, y'know GNU licensing

EDIT: Formatting
ZFS is worse because ZFS in general only has one failure recovery method: restore from tape.

Most other mainstream filesystems have tools to restore and attempt at repair the filesystem meaning that you can often restore the data.

ZFS also utilizes the memory more which means that it is more likely to be affected by memory issues.

Is it likely? No. But since us mortals seldom have tape backups and usually can't afford to backup everything on their NAS I'd say that ECC is recommended for ZFS, more so than most other filesystems. Just as a consequence of how it is used and the lack of recovery tools, not because of the filesystem itself.
This is all the more important that there are few medical options for depression: SSRIs are the commonly used ones.
I don't believe that the term is not misused. What is happening perhaps is that you disagree with the term. And that's fine, that's your prerogative. I don't think that I am confused.
Hang out in #bash on IRC Freenode and you will be a Bash jedi http://mywiki.wooledge.org/BashFAQ best resource IMO for quick Bash syntax lookups as I always need to refer to the BashFaq to remember parameter expansion sub-string retrieval.

parameter result
----------- ------------------------------
$name polish.ostrich.racing.champion
${name#*.} ostrich.racing.champion
${name##*.} champion
${name%%.*} polish
${name%.*} polish.ostrich.racing
I know. I also know the reason (GPLv3, and companies avoiding it like the plague). I also know how to install the latest bash with brew and set it as my default shell (takes all of 30 seconds).

OS X is not about the version of bash it includes -- that's a historically hidden behind the UI tool for us geeks, not what's intended for the everyday Mac user to use (and the UI had been the priority there ever since the original Mac).

Lastly, I've used bona fide certified UNIX machines from vendors like IBM, HP and SUN that had much worse core userland -- awfully limited BSD versions of GNU tools, much older stuff, etc. So there's that too.
Bill Gates: Why I Decided to Edit an Issue of TIME
LalaFeed – All top tech news feeds in one app (iOS)
I’m confused too. Being “pure” somehow keeps your leg from getting wet?
> sell [device] immediately after

I've heard people say that if their laptop or phone were searched out of their sight by border officials, they'd sell it afterward.

But is it ethical? I think this meat might be contaminated; I'm not going to risk eating it, so I'll sell it.
Main author of x64dbg here. This is very probably the case and I contacted Github support to figure out what is going on. Before today we had around 3k (legit) stars.
Looks like it may be time for Epic Games to consider switching to AMD Ryzen/EPYC.
The people who’s posts were deleted do not deserve to be part of the Rust community.
I appreciate where you’re coming from, but you can’t bring GKE into a conversation about the challenges of Kubernetes ops. GKE does everything for you.
Why the negative reaction to this?
The Camel book¹ is pretty fantastic.

I hope the "Learning Perl 6" book by brian d. foy will be as good.
--
¹ https://en.wikipedia.org/wiki/Programming_Perl
I think that the quest for interpretability is often a red herring. What people need is an ability to tell a model what to do when it is straightforward to do so.

For instance, at the convenience store near me there is a sign that says "To buy alcohol you must (A) be 21 years of age and (B) not visibly intoxicated"

The first of those is easily addressed as a rule, the latter is a statistical kind of thing -- different raters are going to disagree whether certain people are "visibly intoxicated" and (in real life) it is contextual. It is one thing to send somebody to drive home drunk, it is another if you are not.

An interpretable model might tell you that it learned it is OK to serve people that are 20.95 years of age, but that is for chumps. You should just punch in it is 21 from the beginning.

Similarly, a model that is biased against black people might not have a reference to "X is black" but rather might learn to discriminate based on geography or other characteristics. On the other hand, in health care, there are some cases you do want to take race into account. Blacks react differently to drugs for heart failure, while Naltrexone seems to be highly effective for alcoholism in Asians, moderately effective in Whites, and barely effective in Blacks.
Yes. thank you.
Yes the pain working with that is real. One of the funnier instances of edid messup was when we discovered there is at least one dell screen model out there that has DEL as their vendor string. They misspelled their company name.

The usual problems were missing mode lines that were actually supported (and needed) and incorrect dimensions.
> What does that mean? What can you do with that?

That you can use c-like expressions in various places (the command bar, goto dialog, calculator, conditional breakpoints)

> Does it understand programming languages? Can you inspect the contents of variables like in VS?

No and not yet, it just uses the symbols of an executable to display a source code listing. I only know of a few asm developers that use it for development but the main use case is reverse engineering and malware analysis.
This is a problem of a car centric society. I’ve been in places where public transport is the norm and travel was a lot easier and more efficient, regardless the time of the day. Yes, obviously during “rush hour”, the public transport would be a lot more full, but often frequency is increased to compensate.

(Sure, there’s places where even that isn’t enough and the public transport pipe is congested. We’ve all seen those videos of trains in some places in asia, for example)
Never is there any mention that by accessing the device of person A, the officer may be violating the rights of all people (say persons B, C, and D) who have shared information in confidence with person A.

This includes getting access to my family photos. I don’t want an officer, who self selected by applying for a job that he knows will give him access to family photos, to get access to my family photos, because what kind of person applies to that job?
This is how Meltdown works
It sounds like you have axe to grind against well-funded professors, not that you actually have a valid argument.
Thanks a lot. Shells have so many features it's easy to miss one.
You could use it, but you would probably have to reachitect the server to use green threads to avoid the overhead. Frequent syscall sends are done with games to keep the latency as low as possible. Any batching would increase delay
10 Kama Sutra sex positions you must try (2018)
If you're pure, you don't care about getting soaked. You do it, because you believe it's the right thing to do, even if people joke about you and you don't make big money.
SMILES implicitly stores the geometry data. It's technically true it doesn't encode a unique 3D structure (for a rigid molecule), but you could convert the implict bonds to standard-length ones, embed the molecule in 3D space, and minimize it (that's precisely what SMILES to 3D structure systems do).
...but if it is "so obvious" - why has it taken ~20 years to discover it (publically)?
I understand "the hard way" is a commonly used phrase but it does seem a bit infringing on Zed Shaw's entire series Learn Code the Hard Way. Easily confusing. Other than that, good work
They don't like embargoes but they don't go out of their way to break them. The only embargo I know of that OpenBSD broke was for OpenSSL, and that was an honest mistake, as explained here: https://www.tedunangst.com/flak/post/regarding-embargoes

There was another "incident" with the KRAK embargo, where OpenBSD got permission to silently patch it early and then the researcher who found it regretted giving them permission.

I think people put these two incidents together, combine it with the developers' attitudes towards embargoes and come out with: OpenBSD doesn't honour embargoes!
Bash has a huge number of little shortcuts that are difficult to learn. When one encounters a sequence of symbols like $(...), it is difficult to Google for its meaning. The reason shells nevertheless have these shortcuts is of course because they are shells: from the commandline it can be very convenient to use shortcuts.

But, in my opinion, that's where it should stop: one shouldn't use a shell language for scripting. In scripts, it is simpler to use more verbose and clear constructs, because most editors are very powerful and provide shortcuts themselves.
Not this one. Pipistrel brings their planes to EAA Oshkosh every year and their internal combustion planes are marketed as touring motor gliders. But the electric Alpha Electro is just touted as a training plane because its range is so short.
A lot of people are okay with testing things like drugs on animals. You can at least imagine a scenario where Edison was driven by concern for public welfare, thinking the higher voltage used by Tesla was going to cause disasters and trying to make people aware of the danger.
#CoffeeMiner – #Hacking #WiFi networks to mine cryptocurrencies
> psilocybin and SSRIs have similar mechanisms of action

This is incorrect. An SSRI is a selective serotonin reuptake inhibitor[1]. It works through decreasing the reuptake of serotonin from the synaptic cleft back into the presynaptic cell, effectively increasing utilization of existing serotonin. It has limited short-term psychoactive side-effects compared to psilocybin, which is mostly a powerful agonist of certain serotonin receptors and can have considerable psychoactive effects[2]. You can't really "trip" from an antidepressant, but you definitely can from psilocybin.

Also just so you know, while MDMA has promise in certain psychological issues, it is also neurotoxic when used regularly and can cause some severe long-term problems[3]. It's an interesting drug for sure, but just claiming it's "amazing" is being reductionist.

[1] https://en.wikipedia.org/wiki/Selective_serotonin_reuptake_i...

[2] https://en.wikipedia.org/wiki/Psilocybin#Pharmacology

[3] https://en.wikipedia.org/wiki/MDMA
If it is so well known why has it taken 20 years to be discovered?
The problem still is: one of the units responsible for increasing the processor performance was not working correctly. So the increased performance of the processor was obtained by not working correctly. That qualifies as cheating - if not by intent but then by nature of the design. It remains to be investigated how much of the security implications of their design choices was or could have been known to Intel. The fundamental attack concept was known for many years.
These classes of attacks are not new. Timing attack in crypto have been widely used for a long time. And even specifically in CPU's there was stuff like http://www.daemonology.net/papers/htt.pdf and http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190... over ten years ago(!).

To quote that last paper:

> We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels. We first illustrate the reality and severity of this problem by describing concrete attacks.

So not just were side-channel attacks on CPUs documented; specifically the dangers of speculative execution and caching on intel cpus (there: the Itanium) was documented.

It's inconceivable that this comes as a surprise to Intel. They're playing the public for fools.

Of course some of this is intrinsic: speculative loading, caching, and accurate timers are an intrinsic problem: an JIT running in the same process as the JITted code will not be able to keep secrets from that JITted code while all three are in play. But intel specifically also allowed this across memory protection boundaries, which isn't necessary.
Mobile cancer.
Huge real world performance impact, they didn't say how much but it looks like close to 100%.

I smell a class action lawsuit coming.
I recently installed one of these in my home, what actions would you suggest I take?
Bimodal stimulation to reduce tinnitus in guinea pigs and humans
The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users of npm, second, most of them don't care what those extensions send over the network. And I guess CSP doesn't apply to browser extensions.

So if you want to steal passwords, make some extension like "Mp3 Youtube Downloader" or "Ad Blocker" and get access to millions of happy users' browsers.

CSP looks like an ugly hack rather than a good solution. Why would you need to specify allowed sources for scripts if you control your HTML code? I don't understand why the author praises it. What a stupid time-wasting technology.
This article seems to suggest that of all the BSDs, only OpenBSD / Theo takes this position - at least in in the case of the OpenSSL problems, the others got advance notice and participated in the embargo.

It might be argued that the risk of the exploit making it into the wild would have been higher if the BSDs were notified, on account of the sort of accidental premature disclosure that actually happened. This would appear to be self-serving if stated by the embargo insiders, but it may still be valid, especially if my guesses that a) this problem's biggest potential impact is in cloud computing, and b) there is relatively little use of BSDs in cloud computing, are accurate.
> But is it ethical?

Oh, the e-word! The word that has an entirely different meaning to every person you ask and more often than not, when it’s drug out in an Internet debate it turns into a pseudo-Gotwin’s Law alternative. I’ll spin is back to you to prove the point.

Is it ethical the work environment that the device you are using to reply to me with was built in?

Is it ethical that it was built with environmentally unfriendly materials and practices?

Is it ethical that the electricity to power your device (and this site and the internet in between) is not 100% renewable?

Is it ethical that you have advantages in life that many of the billions of people in the world have?

If you really want to have a discussion on ethics, I’m happy to entertain it, but this doesn’t seem to be the time or place for it.
> Your rant is on par with suggesting we go back to horses and buggies because high-speed car accidents can be deadly.

Don't be ridiculous. I'm not saying we shouldn't have cross-platform apps at all. I'm just saying we need a clear distinction between the WWW and any applications platform, just like we need a clear distinction between sidewalks and freeways. The web browser cannot do both jobs well.
To be fair gmail flags basically any code, if it's zipped i've found it only needs to vaguely resemble code. basically gmail is only safe for sending image formats and document formats that it knows of and don't contain macros, then it's just a crapshoot that you don't get matched a false positive. Gmail is far from developer friendly anymore.
[Podcast] GROWTH HACKED butter from 0 to 1M users in less than 2 years
All other chipmakers are 'immune' to Meltdown precisely because the attack is obvious. Cache timing is hard, but speculating execution before checking permissions is plain dumb.

If it was such a mythical attack why doesn't it work on anyone else's chips? Intel screwed up hard on this and I have no sympathy. Hopefully the incoming lawsuits will make up for the massive amount of money wasted for the performance losses
Contemporary clinical practice tends toward conservation of everyone's time. The days of weekly appointments with a Freudian analyst are largely past, if they ever were for anyone other than well off clients who could afford such things. Contemporary clinical practice for treating depression tends toward prescriptions for clinically tested anti-depressants. Many of the mild main stream anti-depressants have moderately positive effects quickly for many people (though not all of them and not for everyone).

Don't get me wrong, if you want to eat mushrooms it's fine by me. Just be clear that the abstract does not indicate clear clinical efficacy in treating depression and the possible evidence it suggests is in conjunction with psychological support. It does not suggest evidence of efficacy as self medication outside of a clinical setting.
https://www.reddit.com/r/node/comments/6whs2e/multiple_coc_v...
The most recent ARM chips (cortex A75) are vulnerable.
The site died, WordPress overloaded...
Google Docs is at the level of Word 2.0 for Windows for Workgroups. Aka an improved typewriter version with some support for images.

No, I have yet to use any web app that could provide a better UI/UX than native alternatives, specially in execution speed.
>compared to most macbook pros.

What you wrote is flamebait. It’s an apples and oranges comparison, as has been detailed ad nauseum here on hn.
It stands for convolutional neural network, which is a NN architecture that works well on image data. They use CNN's in object detection and other computer vision related tasks.
> If they do support older machines and can’t guarantee perfect upgrades from every version operating system they’ve ever shipped, regardless of the condition of the user’s machine and how well (or not) the machine has been maintained, they’re also wrong.

Yes, a $50 billion company that doesn't run massive amounts of automated regression tests on one of its flagship products is Wrong. Come on, Microsoft manages to support absurd levels of backwards compatibility (see the discussion upthread about upgrading from Windows 1.0 to Windows 10), what's Apple's excuse?