skysight-inc/HackerNews huggingface dataset:
Thanks. So apparently, my system:

Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-104-generic x86_64)

is unpatched! Is it because of LTS version? Most servers run this including mine.
> Did Intel ever specifically 100% promise a certain performance in their advertising?

Yes.

They showcased benchmarks and paid people to benchmark/review their product along similar lines.

https://ark.intel.com/products/96900/Intel-Xeon-Processor-E7...

etc.
Don't mistake this as OpenBSD's concern for all BSD's. This is just OpenBSD rant because they isolated themselves by not respecting embargoes in the past. Some ARM CPU's are also vulnerable by the way.
This is an extremely easy thing to say for many people around the world.

But for a large number of people - Americans, folks in countries with monopolies or state manipulation of internet traffic - it is not.

Not everyone has a different ISP to choose from. VPNs are a risky proposition and can significantly reduce bandwidth and increase latency.
Show HN: Terminal, a sandboxed command-line interface for iOS
I like

dmesg -H | grep 'page tables isolation'

better, because dmesg -wH doesn't return and I suppose the 'page tables isolation' appears during boot.
Interesting. I felt the tech industry was mostly just 'flavor' to an experience that I see and hear all around me (and have experienced to some extent).

The impression I get is that this experience or this kind of existence is particularly common to office workers in general, and 'soft skill' office workers in particular.

I've mentioned this before, but in any company I've worked at, the least happy people seem to be those who are in management, sales, social media, etc., and the most happy ones are support staff (secretaries, reception, etc.) and the ones with a more clearly defined type of job (don't know what the right word for it is): programmers, accountants, legal, etc.

And while I have some theories as to why this is the case, mostly I'm just baffled at how much of this I see, how many of my friends tell similar stories, and yet everyone keeps wasting their daylight, health, youth and productive hours doing this.

I do know I'm sort of 'lucky' to not need much money, and definitely lucky to be able to work as a freelancer in a field that I love. But it's not like the people I'm describing have no options. If you live in one of the richer parts of the world you almost always have plenty of options.
There are 13 references to building java projects on that page.

I really don't want to get into a flamewar on this, but Bazel does have a lot of traction and is used in many wildly popular tools like Tensorflow. It would be nice to have that here as well.
WebGL has been around for quite a while now, but I never see any websites using it. Surely they exist somewhere? What have I been missing? Anyone have a good source of links to things using WebGL?
Darwin. That is all.
> I suppose the lack of support is inherited from Transmit for Mac

I'd add that CIFS/SMB is one beast of a protocol... a basic ftp client for up/download can be done in a day, but CIFS/SMB? The spec alone clocks in at healthy 441 pages. Either reimplement a huge subset of this (and test with the countless versions of Windows + the even more countless deployed versions of Samba) at considerable expense, or ship Samba with the app... there are IIRC some Android apps doing exactly this, but I don't know if it's at all possible to do so on iOS.
I was hoping for some practical examples of the kind Benjamin Franklin describes in his wonderful autobiography. For example when he discovers he's not a very good writer and wants to improve he comes up with this strategy ("Spectator" refers to the magazine containing articles/"papers" he thought were well-written):

“I took some of the papers, and, making short hints of the sentiment in each sentence, laid them by a few days, and then, without looking at the book, try’d to compleat the papers again, by expressing each hinted sentiment at length, and as fully as it had been expressed before, in any suitable words that should come to hand. Then I compared my Spectator with the original, discovered some of my faults, and corrected them.”

https://www.gutenberg.org/files/20203/20203-h/20203-h.htm
It's still pretty scary to have computers where all of memory is readabe from every process, even if you own them.
Money quote:

>“You can’t stop consenting adults from being stupid,” Marler said. “But we should at least try.”
Vending machine for homeless just launched in U.K., to debut in U.S. cities
How does this fit into his Monopoly first strategy? News outlets are not monopolies and have no significant competitive advantage (unlike PayPal and FB which have network effects).

I've listened somewhere that he also opened a restaurant some time ago and it failed, which is why he's so negative on restaurants.
This just reminded me: when will Ubuntu (and Debian?) fix apt’s broken kernel update process? I have never seen a kernel update - security or otherwise - installed via a normal “apt update; apt upgrade” on any of our machines, it’s always “the following updates have been held back” and then it’s time to manually use dpkg to install the relevant updates.
>they are standard products available at most supermarkets

I guess that's the problem? Not novelty enough? I suppose this is what happens when you start to worry too much about who/what touches what we ingest. We are almost full circle.
Karate: Web-Services Testing Made Simple
A brand new macbook pro will not have bash4.
Thanks. I feel stupid, I looked that line up, down, and sideways for a match :/
In most distros you don't even need the URL but just the name and get the program in seconds, including signed code that is vetted for by maintainers. Usually you also have many runtime options in the config file, if not in the program itself, but that are details.

When your authorized source of code doesn't agree with a program then there is a problem, either with your source or with the program. There are too many parameters to describe all scenarios. For example, if distros refuse to provide a certain program, then you most likely are better off without it, if Apple doesn't let you install a program on your iphone, then you picked the wrong gatekeeper. Apple is a
tyrant and puts its interests above yours. If you enter their garden you are on your own and I care very little for the problems there.

I'm not saying that code delivery is optimal like it is in the most popular distributions. But the Web is not the solution.

Speed is not the only metric.
I thought things always getting better is a relatively recent phenomenon. Things didn't get better for hundreds of years for the native Americans when Columbus came to America. Or after the fall of the roman empire was Europe as good the next few hundred years? Maybe there has been a general trend up but if the trend can drop drastically for the few years you're living in does the general trend up make a difference?
> Silicon Valley is developing an obsession with untreated, unfiltered water, according to The New York Times.

I know this is anecdotal but everyone I know in "Silicon Valley" drinks tap water (straight from the tap or filtered) or sparkling water. Flavored sparkling water is definitely a fad in the Bay, I've never seen or seen someone consume unfiltered water. Seems very sensationalized.
Pulse – Instagram for Music – Sign Up for Beta
I think this is not specific to the shell you are using, so it happens in bash, fish, ksh, zsh, and so on.
One of the biggest problems here is that there is no “chain of custody” from Github source to uploaded NPM module; otherwise one of the developers using the malicious package could have audited the source code before including it in their own code. ‘npm publish’ would ideally insist on reproducible builds, enforce this by minifying or compiling packages itself, and finally encourage the community to always audit the code associated with a module. Of course, people are lazy, NPM has no incentive to incur that server and engineering overhead, and someone could sneak in code anyways with a minor version update... There’s no clear solution here, and I think the only thing keeping up this house of cards is that there are much easier ways for black hats to make money.
Maybe you meant to reply to the parent of my comment?
Not only that: there is a growing trend of requiring workers in low-wage jobs to show up and they'll only find out at the time they show up whether they're needed or just need to go home. Certainly a pretty convenient setup for employers.
Does anyone know how to play with relevance and spell corrections in FTS ?

In elasticsearch, relevance is Tf-IDF or BM25. I don't see anything similar in FTS.

Not sure how I can results around ranking as well as spell correction/suggestions simultaneously.
I had giardiasis once, because I drank water straight from a stream. Clearest water I've ever seen outside Yellowstone's hot pools, and it tasted great! A few hours later, my entire digestive tract was doing its level best to turn inside out. It's a hell of a thing - at first you feel like you're dying, and then after a while you realize you aren't but start wishing you would.

I really can't recommend it! At least boil the stuff first. Or would that evaporate the magic, too?
This is just the continuing misconception among "trendy" consumers that anything "natural" is better for you in every capacity. It bears mentioning that if cynaide were marketable in any capacity, it'd be fully legal to bill it "all-natural".
I think the issue is that some people, such as muckraker098, think that ACM president should be top CS nerd.
Astronaut John W. Young passed away
I took a trip up to Oregon for the eclipse over the summer. One of my campmates filled their water containers from the Shasta spring on the way up. Untreated. Unfiltered. Straight from the mouth of the spring.

Despite my better judgment, I tried some and it was by far and away the best tasting water I've ever experienced in my life. I stopped at the same spring on the way home, filled up a 5-gallon water jug, and cherished every last drop.

I was aware of the risks and I think it's an alarming trend as well, but gosh darn that water tasted amazing.
Yea, why don't you start?
Also, note that refusal to comply with ANY direction by CBP results in permanent unappealable revocation of trusted traveler status.
Zeebee: Microservice Orchestration Engine by Camunda
Submit Pull requests and commits to GitHub anonymously
> Who goes and buys a TV for example at 11am on a weekday?

People who don't have dayjobs or people who are stepping out of their office to shop on break? Tourists? The stores are rarely empty.
IANAL but previously when I have heard that question the common response is "this can later be considered intentional destruction of evidence and/or obstructing justice and can also be used as grounds for further detention because you must have something to hide"

EDIT: Also a commenter below reminded me that not obeying any order given to you by CBP/law enforcement is a direct violation of previously agreed to rules of the trusted traveler programs (Global Entry/TSA Pre, maybe even CLEAR?) which would cause you to be removed from any/all of those programs.
Ubuntu has not released kernel updates for this issue yet.
Repo: https://github.com/AnalogJ/gitmask
I ask this as a general question, as someone with a passing interesting in history, but no formal training: how do we know that free time caused women to enter the workforce, rather than women entering the workforce gave them enough money to trade money for time in household work, thus craeting a housework automation economy?

In history, things seem so... fuzzy[0]... that identifying the cause from effect seems so arbitrary.

[0] More formally, we never really know the full history, we generally rely on unreliable/biased narrators, and we don't know what information we don't know.
Neither Kotlin nor any other industry language addresses my original point, namely:

> What we need is “a formal semantics for a language, with practical proof principles for designing correct programs”.

However, I'm not disappointed in industry languages, because I don't actually expect anything from them.
I guess if they made an explicit statement that they will comply with embargoes going forward, they'll be able to correct the record. But I don't see that that has happened. Lots of egos have to get out of the way, maybe?
Does the choice of a few dozen nutjobs qualify as a "trend"?
I don't know about you, but I rarely want to go to any old bank as opposed to a specific one.
I meant for the details to settle. But if you mean for non-vulnerable CPUs to come out, yeah...
What if I want to play recreational soccer or attend church services in fellowship with a few hundred fellow believers? This proposal completely discounts a whole range of non-work mass activities.
I suspect not, but I could see it used to discover future vulnerabilities. Read access to all of memory is pretty powerful.
Distilled water/pure H2O is NOT healthy. It lacks electrolytes.
I think it’s meant to be figurative more than literal.
Freemake Video Converter 4.1.10 Serial Keygen and Crack Full Version Free
https://github.com/WhitestormJS/whs.js
My understanding is that they require execution on the machine and even systems like node are vulnerable(https://react-etc.net/page/javascript-spectre-meltdown-faq) The big issues is that this is really hard to detect because it blends with what would be normal code patterns. I have read that AV will have trouble with this in heuristics but may pick up on specific strains of code that utilize it. Plus this is a whole new class of vulnerability that people have not thought about yet, it will be interesting, can I make your server do X to expose this(think Heartbleed)
Also the Quark X1000 SoCs --- they have an almost unmodified (there are a few Pentium/586-level instructions added) 486 core running at 400MHz. Compare the diagram on page 19 of this:

https://www.intel.com/content/dam/support/us/en/documents/pr...

...with this:

https://en.wikipedia.org/wiki/File:80486DX2_arch.svg

A lot of the text in the PDF above was copy-pasted from the 486 doc too.
> Keep in mind that's only for regular employees. Freelancers are not considered employees so §69b doesn't apply (despite the part about "service relationships")

Yes, this is important to keep in mind. The "service relationships" part (Dienstverhältnisse) is referencing state employees.
Considering that GPU architecture and low-level programming is still treated largely as trade secrets and the domain of proprietary blobs, it's hard to argue how virtualization should be trustworthy.

When the OS designers get a good spec about the GPU instruction sets, memory architecture, MMU, and IO-MMU, and the OS designers can be the ones in charge of programming these to be consistent with existing OS protections, then we might start to approach an equivalence with CPUs. Then and only then, we can start worrying about subtle, modern risks like errata where the GPU hardware deviates from the idealized spec or where side-channel attacks take the wind out of our sails.

Right now, we have something much closer to the GPU being another computer with an opaque and proprietary OS and a higher-level "managed code" runtime that accepts jobs defined in a mystery ISA by a proprietary compiler suite embedded inside the "graphics driver" in our own computer. We have to have blind faith that there is any data protection as well as that there aren't any code-injection flaws that would allow malicious data and "shader" code to hijack the GPU and its bus interface to compromise the host computer.
That's an interesting point RE OpenBSD, especially if FreeBSD and NetBSD were included (which I do not know), I suspect this was just down to plain irresponsible incompetence though.

...I've no idea what your ARM comment has to do with it though. Meltdown is Intel specific.

A relevant question however might be who coordinated the work between june 2017 and now for Meltdown mitigations? Project zero at google discovered it, but did they hand over the responsibility to Intel or decide who else to inform themselves?
The link [1] that you posted does not load for me either. I get Cloudflare's Error 504 Gateway time-out.

[1]: https://www.eternum.io/ipfs/QmQU1bCPsg7VY5puKqH6wZfAv1ZWBteK...
American programmers with little exposure to the world beyond their personal milieu agree that there is. The rest of the world stringently disagrees.
> Things happen. It's impossible to predict every contingency.

Normally I'd agree but not in this case. Notice that besides latest ARM it seems no other architecture is susceptible to Meltdown - s390x, SPARC, POWER, AMD etc.

Speculatively loading and executing code across protection boundary is something someone should have thought twice about. Doesn't mean other vendors knew or had PoC examples, but they could have had an instinctive hunch.

I've given this example before, say I have some sensitive data on a server. I could install a bunch of services and API endpoints on it, to access it faster, inspect it, extract it various formats etc. Or I could decide to lock it down and just install only the minimum number of needed things, locked everything down. Doesn't mean I knew all those additional APIs or services had vulnerabilities, but it's just a good practice.

If the server gets hacked and someone looks back, I think they would be justified asking "What the hell were you thinking installing all that crap you didn't need on it".
Err, isn’t distilled water bad to the point of being toxic? I think you mean purified.
Yes, but arbitrary code execution exploits are some of the most commonly found. If your system interacts with the outside world, or is a multi user system, I would consider it prudent to protect against both Meltdown and other Spectre class exploits whenever possible.
$3750 Hardcore PC Build
MC68030. /s
I think he's saying that unpatched, a co-resident VM can compromise the host even if you are locally patched.

If the host is patched this doesn't matter (for VM escapes); however, for those on public clouds that will apply the host patching globally, you will be eating the performance degradation whether or not your workload cares about it. I don't think AWS et al will be offering a "run unpatched instance" option. Or maybe they will, this looks pretty devastating for some workloads; on the other hand, cloud providers could actually end up making a lot of money from this issue...
Is there a word for hilarious but also depressing?
“apt full-upgrade” will upgrade everything. It may also remove packages to fix higher priority dependencies, though I’ve never seen this happen in real life.
I suppose it's different for everyone, but for me the discussion quality started to fade around 2013.
Lucidchart uses WebGL for the canvas in our editor. The menus around the canvas are Angular, but the actual editor is all WebGL. Full disclosure: I work at Lucid.
Measuring decentralization is a significant issue in the crypto space. Here’s an interesting article from Earn.com (formerly 21.co) https://news.earn.com/quantifying-decentralization-e39db233c...

If anyone knows of similar articles or studies please share them.
I know you're using hyperbole for effect, but I have to (lightly) poke fun at you for called something that happened 14 years ago as "world-breaking" ;).
> it’s a great example of a bad UI

I think it’s a good example of UX that encourages visitor to sign up - which is why it exists. A part of what makes it good is precisely what you mentioned: very easy to miss the button
That's true as far as it goes but I don't see the relevancy. For one thing, I think most of us buy groceries more than we need to interact with a bank clerk or a doctor. But beyond that, if we waved a wand and declared grocery stores were now open between 5:00 and 10:00 PM, we'd just be replacing one tyranny with another (and it would after all be dependent on most customers keeping 9-5 hours). If we just started randomly distributing working days and hours there's no particular guarantee my day off doesn't align with the supermarket's (and anyway the idea that a supermarket isn't time-dependent seems questionable since the whole thing revolves around somewhat time-sensitive deliveries).
> Docker is not trivial to set up, either.

Do you have a concrete example of what you ran into? What do you mean by "secure install"?

on osx its just a matter on installing docker4mac and other linux distributions has pre-made packages. I am a linux noob and I was able to setup a 20 machine cluster with swarm trivially on centos7.

I was acutally surprised that I was able to do that so trivially, given I have minimal linux admin experience if any.
It's not exclusive enough.
Anyone can buy spring/distilled water or install an RO system.

Only the true elite can afford to flout death with "Raw Water" and the possible health consequences. It's like tanning beds for the 20-teens.

Do them a favor, laugh, and embarass them before they get sick.
The real 'Learn bash the hard way' is to read the man page top to bottom every 6 months. Ye gods, I've read it so many times…

Also: lol at HN downvoting advice to read a tool's docs. Bash is terrible for a lot of reasons, but not because of its lack of informative documentation.
Drinking untreated water from a stream is idiotic, but that's completely different than drinking well water though, which hundreds of millions of Americans do every year without any negative effects. While most wells do have filters, those are just there to get rid of excess sediments. And you can also get rid of any bacteria with UV light without filtering the water, so I'm not seeing where exactly the danger comes in here.
QNX 6.5 apparently maps first 256MB of physical memory into kernel space at fixed location. Also I believe that QNX's kernel memory contains region that maps to pages of user space memory of other processes (as part of the message passing mechanism, but I'm not exactly sure that I understand correctly how it actually works).
deprilarious?
Well this type of attack has been theoretical for years. The Project Zero referenced some papers from the mid-2000s that talked about it. But the implementation, even today, isn't exactly trivial.

Modern processors are insanely complex systems. Branch prediction, out of order execution, hardware virtual memory management, hardware virtualization, etc. Not to mention that these are side-channel attacks. It's not a direct vulnerability, it requires executing some code and measuring timing very precisely; similar to and oscilloscope and a very expensive safe.

Of course Intel is going to be spinning this however they can for damage control. That's what PR departments do. I still doubt engineers at Intel really thought this attack was plausible, or else they wouldn't have been engineering chips this way for the past decade.
> You either run Cloud + Kubernetes and get rolling in 15 minutes, or you hire IT headcount.

You can always rent dedicated hardware – much cheaper than renting similar amounts of virtual servers, and the same administration and operations costs. It’s often even significantly cheaper than what GCE offers – but of course, setting up Kubernetes is more complicated.
One thing to note: "This directive governs border searches of electronic devices -- including... at the extended border." The "extended border" extends a hundred miles from what we normally consider the border; the authorization for customs agents to conduct warrantless searches in the Immigration and Naturalization Act allows them "within a reasonable distance from any external boundary of the United States," and the Attorney General defined that distance as a hundred miles. The Supreme Court disagrees (Almeida-Sanchez v. U.S., U.S. v. Martinez-Fuente), and has ruled that border searches can only be done, well, at the border. Under this directive, an importer/exporter headquartered in downtown San Diego would be subject to these searches... a bit scary if the Supreme Court ever overturns its earlier border search decisions.