skysight-inc/HackerNews huggingface dataset:
Yep. We use MediaWiki for internal documentation, particularly for the support team, and we use FeinCMS (a Django CMS/blogging package) for our “tips” blog.

Unfortunately neither of these work for obscure internal data models that we have, or the time to integrate one isn’t worth it for an A/B test we might throw away next week (although if we decide to ship the A/B test we would take that time to integrate a CMS or add an editing interface on top of our DB).
I also have the XPS 9350 and love it. Noticed a little coil whine at first but it went away after the first BIOS upgrade.

I noticed that the 9370 went from 3200x1800 to 3840x2160.
Not sure if that's something worth doing at 13.3"
When I get pulled over I will apply the Turing test to see if the officer is in a good mood, smart, or robocop.
eh? You're not running Android on iOS on the thing. It's still emulation (or "virtualized" environment), and it's still largely going to be crap.
>> 2.4GHz radio interference leading to wifi dropout on many devices

2013+ Macbook Pros had that problem simply using external monitors in some cases
> It is an incredible failure of modern version control systems that distributed branching means that they're impossible for novices to use.

No it isn't. This is entirely a sales problem.

You may not have noticed, but engineers typically can't use distributed branching either. The volume of tutorial and "i'm in trouble, plz hlp" material out there for Git (and really every other VCS) is substantial. Everyone has a story about how a certain workflow got them into trouble on a project.

The thing is, collectively we see a huge value in it, so we make the learning investment to use it. It's only after we learn it (and the pitfalls to avoid) that it's easy.

Novices don't use it because they haven't had the value proposition made to them yet. If you can reframe the argument for why, you'll get them using it.
Nice. I didn't like the part where it said "allowing single family homes near transit". Moves like this are about allowing more things, not taking away any options. Anyone with a house near transit is allowed to continue living there. It's just that, when confronted with new economic options, many of their neighbors will sell their houses, which will be torn down and redeveloped. But you can stay in your house as long as you want.
LISP machines!
Attempts thus far in history by the wealthy to "manage" the poor have worked reliably only insofar as the poor believed they were OK. Beyond that, violent revolution with massive bloodshed is common.
Coral Reefs Are Bleaching Too Frequently to Recover
I only work 40 hours a week
Ripple Slides After Coinbase Says Not Adding New Crypto Coins
There's a strange little collaboration between BT, GCHQ and Huawei going on at "Adastral Park" (Martlesham Heath). It's all top secret, but the person who told me about it hinted that it wasn't about removing the surveillance backdoors but making sure that GCHQ had access to them.
"This should be available through your device manufacturer."

I'm not holding my breath.
I agree, I don't really think it was a bug at all- I was just commenting that I had only needed to update it that once for that one reason, and other than that, it has worked well. Though given the context, I can see how you might interpret my comment that way :)
What a colossal asshole. Transhumanists are people who are desperately wishing for longevity-related medical advances to come down in price and be universally available, and are often spending significant amounts of their own money to that end. Because, on the whole, they don't want anyone to die.

Well, life extension will only be for rich people if people like the OP successfully lobby against public support for it and prevent any progress from being made.
I'm not sure I'm following you, but I'm saying they're releasing a fix, as if that really deals with the problem. How many people are actually going to install the fix? How many people out there even know about these issues?

Going forward there need to be easy ways to update all of this stuff. These flaws won't stop coming out. It would be great if they got installed with OS updates, but I can understand if there's a security problem there.
SEEKING FREELANCER | REMOTE OK

We are looking for a web developer with advanced (or not) skills to work on a variety of projects, mostly web apps.

We are two people: me, Sterling, a designer and Timmy, my partner, a developer. We do some kickass work—financial data visualization, WEBGL particle experiments, in-browser OBJ modeling, eCOMMERCE!—for some amazing, collaborative clients like Adidas and others.

We also value a life well-lived with people we care about. In that regard, we're looking for an affable, resourceful, and dynamic human being to work alongside some of the day. The rest of the day we like to spend on our own personal and professional pursuits, some of which intersect, while others don't.

I'll say upfront we're not interested in mega growth, as measured by clients, billables, etc. You'll be working alongside just the two of us and a handful of clients. Our values are really centered around quality of life and some semblance of balance. We like that to match up with the people we work with too.

If this little post speaks to you, reach out via email, Instagram, or whatever suits you best.

Here's some links:

Sterling - http://www.sterlinglentz.com/
Timmy - https://timmyomahony.com/
My photo blog, cuz it needs a plug - http://discocrabsontheroad.tumblr.com/
My Instagram - https://www.instagram.com/discocrabs/
Email - grab it from my website if need be.

The specific skills we're looking for are:
Django, Ember.js, a little PHP, MYSQL, and anything else you'd like to add. We're interested a little more in personality than a particular technology stack.

Cheers!
Thanks for this—I was struggling to figure out how the cache timing attack worked until your comment.
I'm using 12GB in Windows 7, and I'm not even doing any development work (VM's). Firefox, Chrome, Outlook, a couple spreadsheets and text editors, Evernote, Winamp, a couple Putty sessions, IBM terminal...
Type-simplicity: If you can't have type-safety, have the next best thing
Note that variant 2 of spectre has not been demonstrated on AMD and AMD claims to be unaffected ( http://www.amd.com/en/corporate/speculative-execution )

However, the description of spectre from spectreattack.com is this:

"Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets."

That, however, is not demonstrated by any of these PoC, not that I can find.
No, they’re not.

We’ve used this approach before we were able to intergrate required CMS, and it was fine. Our Product Owner would go into the YAML files in Github, click "Edit", make the changes, then hit the big green ”Create Pull Request" button. GitHub actually makes it fairly easy to do this flow and comes with sane default commit messages.
Are All Calories Equal? (2016)
It was a hacker news post actually: the presenter's delivery is a bit dry... but his project is impressive:

https://media.ccc.de/v/34c3-9058-everything_you_want_to_know...

The SEM shots of the internal RAM/ROM starts around 24:00, I thought it was pretty cool.

The whole purpose of what they are doing is to try and reverse engineer the microcode to write their own.
Was there anything like this back then? (Speculative execution, L1 cache, branch prediction all in the same ISA?)
Would something like John the Ripper, first with wordlists and then with incremental mode, be acceptable? http://www.openwall.com/john/

http://www.openwall.com/john/doc/
I actually do like A/B tests in Git, especially if you have great commit messages and tags around this, because there really should be a historical record of all experiments that have been run.

Throwing them away is a tremendous waste of knowledge. We found this to be true with our marketing and that was the reason for the push to setting up a Wiki. Even if we don't retain code around an experiment, we have a documentation format for recording what we made, what our expectations were and our results.
It also depends on the platform you are on, the CPU vendor/model, the vulnerability you fix, and the patch you used.

As mentioned in the article, there are 3 different (identified) vulns, each with its own set of patches, and sometimes multiples different ways to patch. Each of those patch will have its own impact, and work is currently in progress to find new ways to patch that will have a lower impact on performance.

Also, this means we will need to be used to patch, as new vulns of this category will definitely be found, and new changes to kernels/cpu/compilers will be designed and will need to be applied.
I’ve been happy with using PRs and CI to avoid this problem.
Right - but as always with a vulnerability, especially one that's borderline-undetectable through any kind of log analysis, the question becomes "were Google really the first to think of this?" and the tinfoil kingdom builds itself from there.
Yes, I know 3.
Or, simply confronting violence against gays includes Islam-related violence against gays. I'm simply not excluding other violence against gays from my outrage.

Rather than saying "Islam is bad", it might be better to say "I don't like X about Islam because Y." If you are more specific and give a reason, it's easier for people to hear you. But yes, taking the person out of it does make it easier for people to hear you as well.

I'm more calling into question the feasibility of accurately surveying billions of Muslims worldwide, especially in authoritarian countries where people might not feel free to be honest, or in war torn countries where access is dangerous or impossible. In any event, do you have a citation for this global survey?

I think you make the world better by calling out the problem exactly as you mentioned.

But I would advocate focusing on the problem. I can't think of any human behavior that is universally contained and ubiquitous within a single race or religion. Even if you take the most sensational elements of Islam like stoning someone to death, very few Muslim countries practice that, so it's not ubiquitous. Or, if you call out something so common world-wide as anti-gay laws or behavior, it seems like you're consciously ignoring the billions of non-Muslims who live in governments or follow religions with active discrimination based on sexual orientation.

Religions are so broad and open to interpretation that it's probably statistically impossible not to find anything you agree with (or disagree with) in a major religion. Instead, it sounds like there are specific human behaviors that don't sit well with you and that's totally understandable.
The New Urbanist Credo: ‘Make No Big Plans’
This whole thread is hilarious. Well done.
Apple joins Alliance for Open Media, signaling support for AV1 video
The Ultimate Beginner’s Guide to Cryptocurrency Investing
For mobile websites it would trigger the same browser events, right? Don't think they're referring to native apps.
7 WordPress and Web Design Trends to Watch in 2018
This seems to be subject to debate...
> CPU tried to clean up access of protected memory, but failed to properly account for a fun trick of caching.

> [...]

> Why not kill the process instantly on a prohibited read, then?

Because it was the CPU that tried, not the process/software that tried. It only tried in a branch that wasn't ever to be taken. Say for instance you have a pointer to some memory and a flag telling whether it is an absolute pointer or a relative pointer. Your executable checks the flag and sees that it is an abosolute pointer, so it reads the memory at the address. But the 'else' statement that was never supposed to run speculatively runs and treats the pointer as a relative offset that just randomly happens to go into system memory.

You can't kill the process because of this, because the program never actually tried to go into system memory, the CPU just speculatively tried, and speculated wrong.
When you're netting $20k a year into your 401k, mortgage, principal, and long term savings, $10k is a lot of money.
The Simple Math That Can Save Cities from Bankruptcy
I did the first time I commented, and I don’t understand the difference between trusting dozens of vendors of closed, proprietary subsystems, compared to just one.

In my mind, it’s ‘better’ to have to trust less people?
> the NSA expects seasoned professionals from the private sector to join its ranks with a 33k salary?

they don't. like any other military/police agency in the world they want them young and dumb.
Rhythm Tech RT1210 Black SOLO Tambourine
Imagine living in such a political climate that you have to create a throwaway just to say "dude weed lmao" as a way of life wrecks lives.
You're right. Maybe Wednesday-only work weeks is the optimal solution.
But only in the US. For some reason there is a 16GB European version.
Send me an email! moura at oko dot ai

We use React+Redux on the front-end and nodejs+Python on the back end. I think you will be a great fit.
Can't you just compile your own code without the mitigations inside the vm?
But hey, it controls the cooling fans! The DUAL cooling fans! All by itself! Apple must truly have a chip design team rivaling Intel.
Re: touch. I just bought an XPS15 with 16GB for 1900AUD. It has touch, which I don't use. The viewing angle is wonderful, basically 360 degrees with no degredation and in this respect is no different to my 2013 Macbook Pro. AFAIK from reading other people's setups (see external resources at https://wiki.gentoo.org/wiki/Dell_XPS_15_9560 ) you can disable touch to save power.

Re: cost. Macbook Pro in similar power range is like 3500AUD. So I'm not complaining.

Re: grunt. I also compile stuff sometimes (Gentoo user!) but generally don't need so much RAM. If you really need fast high power compilation consider a decent CI setup with on-demand cloud instances instead... means you don't need to pay over the top for occasionally used local grunt. Also works for others on the same project and enforces clean operations patterns (continuous deployment / effective build documentation).
No, not as written. conceptually, this already happens in a different way. but doing this wouldn't mitigate the issues caused by Meltdown and Spectre.

JavaScript executing in browser javascript engines already live in their own isolated environments in ring 3, so effectively ring 4 if you'd like, but these are just conceptual rings so all unprivileged operations are in ring 3, JS engines (and other things) are just designed to be isolated from other code running in ring 3.

Microsoft has gone a step further and has something called "Windows Defender Application Guard" that effectively runs MS Edge in a separate isolated VM, which might be along the lines of your thinking.[1]

The problem is that any application in ring 3 down can exploit Meltdown and Spectre, so even code running in Application Guard can still potentially read privileged memory anywhere on the system, so even this is not effective at combatting the problem.

It's not practical to make unprivileged code currently running in ring 3 more trusted and doing so would require much worse changes. You might conceptually have a completely separate system on system architecture for the purpose of running completely untrusted code, but this is overkill, as the current architecture is supposed to be just this. But anything along these lines is still hypothetical and would require hardware changes that can't be patched in.

[1] Intent of MS of doing so is a bit convoluted, as they seem to be saying that they don't trust their own browser engine to be fully sandboxed, but they don't seem to provide why they feel this, nor why they feel a VM wouldn't potentially have it's own escapes, such as those demoed here https://arstechnica.com/information-technology/2017/03/hack-... so this is probably really just marketing exploiting the fears of business users in order to sell enterprise licenses.
I don't know if changes were made on your end or if my VPN host rotated to an unblocked IP address, but everything is working for me now, with or w/o the VPN connected.

If it was something you guys did, awesome, thanks!
I understand the IaaS is way more flexible, e.g. in cases when you need lots of GPUs but not for long the cloud is a clear winner.

However, IMO the price is just not OK.

Compare with traditional servers. For $0.7/hour you can use e.g. c4.4xlarge amazon instance. The hardware is much more expensive than $550, just the RAM is already around $400. You won’t be able to purchase an equally-performing server for 1 month of that IaaS rent, I think it’ll be like 3-6 months (which is IMO reasonable).
See this mailing list post https://lkml.org/lkml/2017/12/27/2
Look into open individualism as one possible resolution.
Aubrey de Grey, PhD: “The Science of Curing Aging”
How to Become a Plumber
There's no simple/easy way to disable the touchscreen in Linux distro's, too.
Excellent. I enjoy reading your write ups/insight so it'll be very interesting to see what you have to say.
I know it's not precisely what you're asking, but in the python world there's this new and pretty interesting library, Automat [1].

I believe it's used in Twisted, or at least that use case strongly influenced the lib design.

I also found this talk about Automat [2] very interesting (though, to be honest, I don't fully like the example described.)

Anyway, this is not js nor ui, but if you decide to go for building your own js lib, I'd definitely look into porting automat.

[1] https://github.com/glyph/automat

[2] https://youtu.be/MtHscXjWbVs
Same here. I always feel a bit disappointed when I see an Emacs package without a screenshot or a gif.
I am not an alcoholic or addict in any way, but I am a practicing Christian. I can't imagine downvoting you for what you're saying. I believe it's possible to get sober in many ways. I also believe the 'higher power' is the better path, but I wouldn't disagree with your premise.

I hope the sessions were able to help you regardless.
It is easily readable with Reader View in Safari.
It wouldn’t really be irrefutable, it just shifts the claims of bias to what was included as training data.
How did you manage to introduce a spelling error while pasting the title into
submission form?
One benefit to owning the hardware is that you can use it mine cryptocurrencies when you're not using it. I bought my GTX 1060 for $200 used in March 2017, and it's generated around $1300 worth of Ethereum...
Have you got a reference for that statement? Because my interpretation of what has been said so far is that AMD deliberately chose not to allow speculative dependent loads that crossed privilege boundaries by enforcing permission checks on all reads whereas Intel chose to permit all loads & rely on the fixup at the retirement stage of the pipeline to enforce privilege boundaries.

Happy to be proven wrong however.
> Not sure of the logic there.

Its really simple, if you don't understand this, you need to question your own logic. Basically the Marijuana issue should be a state decision, not dictated by the Fed Govt. What don't you understand here?
8GB of RAM? Seriously? That's a non starter for me as a developer that works on multiple projects daily. At any given moment I'm running 3 or 4 backends, an equal or greater number of front ends, test suites, a vagrant VM... I can barely get by with 16.
Ah, so you're saying this chip is guaranteed to not have its own TCP/IP stack, no access to the NIC, and no latent zero-days that a remote attacker can exploit?
I moved to Opera for similar reasons, plus one more: it supports a MRU order for Ctrl+Tab, which Chrome doesn't support and doesn't even allow extensions to support.

I literally can't understand why so many people (who use and develop Chrome) think that MRU is the right thing for Alt+Tab but not for Ctrl+Tab. Sad.
I was in a similar situation. I bought a used SGI Octane, but didn't have the root password and I didn't want to reformat the machine (and didn't have OS discs). It ended up being pretty easy to crack the password, though I can't remember the exact process (this was years ago). Once you have physical access, pretty much any security implementation can be defeated.
Woah, so Charlemagne was making it up??? Mind blown
It's simple to describe and all the pieces are big red flags even on their own: Speculative evaluation has side-effects (e.g. the cache is not rolled back), speculative evaluation omits security checks, timing attacks can be used to determine the cache memory. It can even be exploited using JavaScript, no hand crafted CPU instructions required.

Perhaps it took so long to find because it's only relativity recently that companies have been paying people to break the hardware?
> The edge for vintage analogue synths was the fact that they offer more hand on control but with the wealth of midi controls that come with a wide array of presets support many software synths its still not much of a good reason to pick a hardware synth.

There are at least two fundamentally flawed assumptions behind your post.

1. Electronic music isn't just about endless options and capabilities. Endless options give you endless search space to navigate.

2. The idea that generic computers are always better than dedicated hardware is rather archaic, because with modern technology you can integrate powerful computers into dedicated hardware very cheaply.

There is a huge difference between using a fully integrated, though-out hardware synthesizer versus using a MIDI controller mapped to some plugin in a DAW. There is a reason thousands of musicians still buy analog gear, VA synths and fully digital FX pedals.
I suspect a better solution instead of KPTI is to evict all user space pages from cache when an invalid page access happens if fault was caused by read/write kernel space pages. My kernel days was so long ago that I don't now if it is possible.

Massive performance hit but only on misbehaved software. Well behaved software will not have the performance hit of KPTI.

Kernel could even switch dynamically to KPTI if too many read/write attempts from user space.
My app slows 10%, on an OS that slows 5%, running in a virtualization host that slows 10%. The numbers add up.
We know (or can guess) approximately when the project zero team discovered the issue, but I think your parent comment meant that we don't know when _someone_ discovered it first. Maybe the project zero team were the very first to discover it, or maybe some state actor discovered it a decade ago and has been using it since then.
Magic Leap Display Developments Revealed in 2017 – Part 1
Yes, John Deere tractor running Windriver Linux; heavy use of dbus and Qt. Any compromised tractor app vendor could inject it.

Could probably reproduce from upstream Yocto distro and the free version of Qt.

Much larger attack surfaces to worry about like their craptastic security around USBs that farmers stick in to read maps.
Photography never died
my biggest peeve is graal/substrate creating and using its own build tooling - for example mx (written in python) to do the build and compilation.

Graal itself uses mx.

I would wish they would use something far more popular and common like Bazel or even Gradle. TBH, mx predates all of these .... but its time to use modern tooling.
Anyone know what WiFi cards they're using this time? The original ones used Broadcom, which sucked on Linux. The DE versions briefly switched to Intel cards, which were great, and have built-in support in the Linux kernel. Then they switched to some off-brand wifi cards called Killer for the later lines.
Drumming up national security for the UK? I guess if you're planning to go to war with the EU... Otherwise it's as useless as Trident.
The only one of these that seems to have traction is the favour for urbanism - as against suburbia.