skysight-inc/HackerNews huggingface dataset:
Right? No. Duty? Yes. They need not descibe details but can say: "big secret problem, working on it. Mitigations will be ready before public disclosure. Stock at risk should we not be ready in time."
NPR doesn't own its bias, so I'm not sure I'd use the phrase "consistent and clear" to describe the NPR viewpoint.

Here's NPR poorly representing the controversy over the Google memo this summer:

https://www.npr.org/2017/08/08/542180434/google-fires-engine...
Works on MacOS 10.13.2.

Looking back, the Mac patches were to address KPTI (Meltdown) which is separate to Spectre.
10.12.6 + 2017-002 does not appear to patch this. I couldn't find any code related to double map, and sysenter did not change like in 10.13.2: https://twitter.com/lunixbochs/status/948763821933506560
That was a great video! Unfortunately, clicking on each cell's entries really slows down computations.

At National Supercomputing Center For Energy and the Environment we retrofitted all the PowerPoints to use timed animations. Now all computations execute in constant time. There is no need to click! As a special bonus, the code is no longer susceptible to side-channel timing attacks.
I just noticed that. That is pretty clever.
It's a good point that it could be my own biases, or it could be that Trump really is terrible while Obama was just wonderful.

But I don't think those are it. When Jimmy Carter says the media is applying a different standard to Trump, it lends credibility to the idea that they just might be.
And my mother always said "Money doesn't grow on trees."
It's uncontroversial that Tesla is in the "figuring it out in ramp-up a factory stage".

What I fail to see (that this article really drives home) is that they aren't actually building anything resembling a defensive moat...because they're going to run out of time. You could absolutely make the case that if they got to (mass) market significantly faster than existing car companies they could devour market share and suck the air out of the room and really springboard into their existing valuation...it just feels like they're burning the candle at both ends and that scenario seems a lot less likely (to me).

By the time they figure it out...the companies producing significantly higher volumes of cars (for a hundred years) may simply surpass their ability to ship a great EV in large numbers.

The Bolt / Leaf / i3 are basically the first-gen "hobby" projects to dip their toes in the water and get some EV mindshare. Do we really think a company like BMW can't make a desirable EV halo car + econo EV literally whenever they want as battery capacity tech progresses and mass market demand picks up? Drop an electric motor into an existing M4 and an X1 (I realize its more complicated than that) and you're basically there.

I'm guessing here, but I think the BMWs and GMs and Toyotas of the world all must be extremely happy to be last mover here for a tech that feels like, at this point (thanks to Tesla!), will become an inevitable commodity technology. Meanwhile they let the Tesla brand do the hard work of getting the pubic amped up about EV with none of the risk and swoop in when it makes sense to them to move their existing brand onto a new and better electric platform.
> But you do raise valid points. I work in an organisation that loves Microsoft and store-bought solutions like Skype for Business.

Is the situation any better elsewhere? On windows at work we constantly have issues with desktop sharing over skype freezing and have to fall back to WebEx and deal with it's sound not working properly, we'll often end up with a hybrid of voice calls on skype and screen sharing with webex and all the wasted time dealing with that. I had an hour long meeting on WebEx yesterday where I could barely hear anyone.

These aren't things I've tried to do on linux so I can't comment on how well supported they are, but let's not pretend they work seamlessly in the microsoft world either.
Has anyone tried the Spectre PoC in the paper on ThreadRipper? I can confirm it works on my i7-7700K.
"The branch predictor is really just a glorified cache prefetcher so you'd not only have to harden the branch predictor..."

I was just thinking of the part they were talking about where it was too predictable, not the rest of the issues. Instead of a single hard-coded algorithm we could switch to something that has a random key element, like XOR'ing a rotating key instead of a hard-coded one, similar to some of the super-basic hashing some predictors already do. Prefetching I just don't know what to do with. I mentally started down the path of considering what it would take for the CPU to pretend the page was never cached in the first place on a misprediction, but yeow, that got complicated fast, between cache coherency issues between processors and all of the other crap going on there, plus the fact that there's just no time when we're talking about CPU and L1 interactions.

Timing attacks really blow. Despite the "boil the ocean" nature of what I'm about to say, I find myself wondering if we aren't better served by developing Rust and other stronger things to the point that even if the system is still vulnerable to timing attacks it's so strong everywhere else that it's a manageable problem. Maybe tack on some heuristics to try to deal with obvious hack attempts and at least raise the bar a bit. More process isolation (as in other links mtanski gives you can at least confine this to a proces). (What if Erlang processes could truly be OS processes as far as the CPU was concerned?) I'm not saying that is anything even remotely resembling easy... I'm saying that it might still be easier than trying to prevent timing attacks like this. That's a statement about the difficulty of fixing timing attacks in general, not the easy of "hey, everybody, what if you just wrote code better?", a "solution" I often make fun of myself.
I dunno. Potentially. But these are incredibly complicated bugs, which involve timing at the hardware level. There's nothing close to this in the Vault7/8 leaks.
Thanks for the detailed reply. :-)

> As for the aggregation (grouping) algorithm, I'll just say that it's straight out of the textbook http://infolab.stanford.edu/~ullman/mmds/ch3.pdf

So, in other words, you're using the MinHash algorithm as well as Locality-sensitive hashing (LSH)? How much volume are you able to process in how much time?

By the way, I first learned about this topic through Stanford’s “Mining of Massive Datasets” (MMDS) course that used to be free on Coursera. So it's thrilling to see someone put it to use in the real world and talk about it, too! :-)
Thanks for that. I agree, diversity in news sources is a good way to get differing perspectives. (Also, perspectives not being pushed from the same opposing ideologies, as you suggest.)
You lost me at "unjust death... is not any different than murder..." Those are clearly different things to me. Maybe I'm misunderstanding you?
Linus missed the bus. The Spectre attack doesn't require speculation across protection domains.
The short answer: because "be(ing) a dick" is highly subjective.
The confusion is perhaps understood, as this is a complex issue. Basically, you need to remember that on the hypervisor there are two kernels; the hypervisor's OS, and the Guest's OS. The exploit works, we assume, by abusing shared memory between the kernel and userland process to allow the userland process to read memory that it shouldn't be able to see. The mitigation moves kernel memory out of the MMU entirely when making the switch.

If the hypervisor has the patch, but the Guest OS does not, it means that when the hypervisor context-switches into the Guest OS, it'll move its own kernel memory out of range of the exploit. So far so good. But the Guest OS is un-patched; when its kernel context switches into a userland process, its own kernel memory space remains available for the exploit. Thus, a patched hypervisor can protect itself, but not its guests.
We have one version of the client-side code and one version of the backend API code. The server-side code mounts the client-side code like a pure function for rendering on a user's first arrival. You can technically separate the SSR from the API if you want (might even be default in some places). "You have 2 versions of the same code" is a simple misconception from people who still think in terms of jQuery at best, at worst it's intentionally ignorant and misleading.
I'd bet a certain percentage of THOSE were actually lynx/links/elinks users rather than no script users.
https://access.redhat.com/security/vulnerabilities/speculati...

Additional exploits for other architectures are also known to exist. These include IBM System Z, POWER8 (Big Endian and Little Endian), and POWER9 (Little Endian).
https://spectreattack.com/spectre.pdf

https://meltdownattack.com/meltdown.pdf
How is it different from other sells Krzanich has done earlier? It seems that he has been selling/disposing off his shares on a regular basis after each option execution:

http://www.nasdaq.com/symbol/intc/insider-trades?sortname=in...

http://www.nasdaq.com/symbol/intc/insider-trades?sortname=in...

http://www.nasdaq.com/symbol/intc/insider-trades?sortname=in...

http://www.nasdaq.com/symbol/intc/insider-trades?sortname=in...

The only difference in this case is the trade size. Huge grant was vested and sold:

http://www.nasdaq.com/symbol/intc/insider-trades?sortname=sh...

This might be related to his employment terms.
How is "race" defined?
I have used Amazon for many years happily, but I'm struggling to understand what you consider to be vastly superior? Google has some very solid product offerings.

Google Container Engine for instance is amazing. Granted Amazon has recently launched a couple of products that offer similar features, but as of mid last year running containers on Google felt like it was ahead of Amazon.
Death is a constant, it's everywhere, it's unstoppable, and yet people still take medicine, get vaccinated, and go to the doctor.

I'm not sure I understand your argument.
https://news.ycombinator.com/item?id=16065550
As a small gesture, you can walk over to your neighbor's place, knock on the door, and offer to split the internet bill in exchange for the Wifi password. Sure, the service will still suck, but it already did, and this way you will pay half as much for it.
> A P/E of 42

You're confusing Price and P/E.
Long division is hard to do in your head, but to determine if a number is a factor, there's a technique in between long division and memorizing a graph walk that is probably easier to do mentally that either one (since you don't have to memorize a graph for each divisor). With "modulo division" you can calculate a running remainder in your head while consuming one digit at a time of the dividend, from left to right. It gets pretty easy with just a little practice. https://en.m.wikipedia.org/wiki/Short_division#Modulo_divisi...

The division by subtraction is fairly well known, of course, but it reminds me of the surprising square root by subtraction that I only learned about recently. It's probably too much to do mentally, but easy with pencil & paper.

To compute the digits of the square root of n, set a = 5n, b = 5. Repeat: if a≥b, set a=a-b, add 10 to b. Then if a<b, add two zeroes to a, and add a zero to b just before the final digit (which will always be ‘5’).

I had to code it up myself just to believe it would work. http://www.afjarvis.staff.shef.ac.uk/maths/jarvisspec02.pdf
You might want to have the first pair default to 1 instead of 0, so that the values show up right away instead of looking weirdly blank.

It would also be nice to pick the exchange you're comparing on/with.
Windows lost that crown years ago. Nowadays many people are using Macs. And most are using Android or iOS for a lot of the same things we used to use Windows for.

Anyway, the last sentence is irrelevant. I honestly don't mind whether you're using Windows or Mac or whatever. Why must it be phrased as a competition? I can use the system most suitable to me and my goals, and you can use the system most suitable for you and yours.

Can you imagine someone saying "There's so many different kinds of bread because people have opinions and disagreement, plus traditional recipes and market freedom means everyone can start their own bakery and do their own thing. Meanwhile, rice is still king of the staples."

My choice to eat bread and run Linux is independent of your choice to eat rice and run Windows.
Really makes the case against going to the "cloud" (using hosted VM solutions) versus just using colocated servers running VMWare that you fully own and administer.
Pros:

* When it works, it works. We're processing ~100 msg/s in prod right now, for pennies

Cons:

* Only US-Central region support (no cross region)

* Your function runs as Admin (root) in it's project

* Your function must be deployed to the same project as other assets (e.g. can't listen to GCS or PubSub events cross project)

* No way to pass configs/params to a function (it's all gotta be in the code, including secrets)

* Very limited retry semantics (brute force, retry forever)

* No integration with Cloud Endpoints or APIgee, so every HTTP event driven function gets new unique URL

* Building on above, all HTTP endpoints will be public, no auth

* Slow deployments - e.g. took me 45min today to deploy 8 functions
Ask HN: Why Google acquired Bitium in 2017?
In late 2017, tech giant Google acquired the access and identity management platform Bitium. I have some idea on how things can help google cloud users, but completely sure.

Do you have any speculation and forecast on where Google wants to take it?
He founded a hedge fund, became a billionaire, and now pursues other interests.
I agree with both of you (@MollyR, @joeblow9999). I thought the most compelling theme from the whole presentation was the concept of "Public Pedagogy" and the almost Kafkaesque way that the big media companies erase women superheroes from movie merchandising. Lets accept the premise that the motivation is to protect their investment in the manufactured identities created in genres targeted towards girls. All these characters are created so that we can identify with with them... its that affinity that makes us want to buy merchandise. Making a good movie dammit is probably not the priority (but it helps).
Is it best for society, though? The earth is already massively overpopulated. Perhaps it's best if some populations decline. And is it the best for himself if, for instance, the kids grow up to hate OP because of, say, global warming forcing them to fight to survive? Or if he has to live to see them struggle with that?
Bet you another dollar it was more than one lawyer.
I agree on what you are saying. It is just me who is exploring these technologies now. So I would rather rephrase my question like, why did Docker ecosystem picked Go instead of Elixir/Erlang?
If it doesn't make sense to render on server (last child tag for Google maps? YouTube? Calendar datetimepicker?) Then wrap it in a simple <no-ssr> tag that has existed for a long time in all major frameworks supporting SSR. Interesting problem, but when it ever rarely actually shows up, it has an obvious, practical, and proven solution.
Recent Advances in Recurrent Neural Networks
Why Continued Development of AI Will Rely on Public Opinion and Perception
I'd encourage you to take a(nother) look at Google Cloud. I've been using it for the past few months and have been very impressed.

There are a few things missing compared to AWS, but all the main stuff is there (and to my mind a lot more logical and integrated). Some key features blow AWS out of the water.

They've come a long way in the past few years.
Megabus: A Study in Guessability
> I want people who actually are racist to talk, so I know who I don't want to be friends with.

It's more important and wide than "I don't want to be their friends"...

How can you attack ideas if they aren't brought out into the open? How can you convince the racist? Or the people that have those thoughts but don't mention them?

They corner stone of freedom is discussing ideas.

I want the most vile pieces of shit to have their chance to speak... so that I can talk to them. I can talk to those who will listen. I will combat their ideas.

Cowards hide from ideas and words. It takes strength to fight them head on and out in the open.
No crushed nuts on mine, thanks.
> If they're all keeping their racist opinions to themselves, I might waste a bunch of time being their friends

I have several friends who I know hold some less-than-sociable opinions, and they do tend to keep them to themselves.

I don't quite know how to frame what I'm about to say, but I feel it's equally dickish to think that becoming someone's friend is a "waste of time" just because you don't agree with their opinion.
> These numbers have also been consistently going down over time.

That trend might reverse if vulnerabilities like these continue to surface.
Building a Concourse Meta-Pipeline
Those two gobshites are more a consequence of political culture, especially within FF, than voting system.
Before this an A&E would tell an Ambo that the beds are full, and to go to a different hospital.

This leaves some spare in the system for when things are very busy - you put people in corridors.

But now all the corridors are full. We've had A&Es declare major incidents.

We've even seen, and I don't think we've seen it before, triage on resus. That alone is a big flag that things are fucked.

> And before this, what? Ambos queuing up, patients treated in ambos, patients waiting a long time for ambos, etc, et

Right, you think we'll go from fully working NHS to fully broken NHS in the blink of an eye. These things you mention were fixed once, and they've been getting steadily worse (as the Conservatives de-funded social care, and privatised drug & alcohol services, and cut MH services, and defunded the rest of the NHS) - the crisis started a few years ago, and is building year on year.
> If the vulnerability was embargoed until 1/1/18, does Intel have the right to reference it in a quarterly financial document before then?

The embargoes are little more than gentleman agreements and I'm not aware of _anyone_ successfully suing for their violation. Google, for instance, technically violated the agreement by disclosing before 1/9/2018. Their lawyers would have advised on any legal risk doing so had.

In comparison, Intel management is required to disclose risk factors (such as a massive f'n vulnerability) that might materially affect the stock price or risk being gone after for insider trading if they sell within the window of them acquiring the knowledge and the public disclosure.

You don't get to refuse to disclose a major risk factor, announce a sale, and sell, then announce the problem once you have unloaded all your shares. That is basically the definition of insider trading.
It's precisely about lack of access, hence the conclusion of the quote: ".. had adequate healthcare been available." There is a cultural avoidance of seeking help because the help will bankrupt you. Because it's too expensive.

Making it cheaper = better access = better health outcomes. How do we know? Every other industrialized nation does it better than we do for cheaper.
Aside from the military? Federal projects are very safety conscious. That was the whole point.
Extensive discussion on front page: https://news.ycombinator.com/item?id=16065845
JSON API testing in bash
running containers on google compute or ec2 has always been the same.

gke is great, however. if you need to run kubernetes in production, today, i would not even slightly hesitate to yell to the corners of the earth to run gke. it makes me excited for eks!

i would also say that the new c5 instance type w/ ena is extremely nice. if they are unaffected by this, they're probably the fastest cpu-based instances you can get anywhere (admittedly i haven't checked... really anything else, but they're fast).
Recently I needed to write some tests for a REST API that I had been exploring with httpie.

Rather than reach for $languageTestSuiteOfChoice I combined a few existing CLI projects and discovered a very simple and fun way to test web apis.
Great post, really enjoyed it.
That link's number 2 seems to apply (and explicitly talks about restrictions)?

The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

For the hate speech law

[√] prescribed by law

[√] in the interests of national security

[√] in the interests of public safety

You can disagree whether the lower two points apply - I'll argue that these are the reasons behind the law in the first place - but the first one is quite clear I think.

Freedom of Expression within boundaries. Restricted Freedom of Expression?
I certainly would have sold some off but most likely would have held on to at least a few. I agree with your philosophy about not having regrets about past decisions.
GP was clearly referring to letting developers run apps on their own devices, not to letting them put malware into the app store where your dad can find it.
Close friend [daughter's godfather] had to sell his $BTC to pay for medical bills. He was basically homeless; forgot he owned them.
Is there a version of this article that isn't split into 9 pages and doesn't require registering an account?
I wonder if that many people actually care. It is a timing attack only AFAIK.
About 10 years ago I was mentored by a guy who was an utter wizard at queuing theory, and who bugfixed a whole bunch of nasty issues in cellular telecoms hardware through his understanding of how queuing theory impacted code execution.

TL:DR - queue behaviour gets nonlinear as you approach the theoretical max load. If you are running your processors at a high load, even a small change in code throughput makes a huge difference to real world behaviour.
As a web developer, I am not entirely sure why a web app necessarily needs high precision timers.
Hey awesome information, thanks. I was a while ago I had read about that theory in some book about old English.

Looks like the custom existed before Caxton but the printing press exacerbated it and pretty much put an end to the vacillation.
There's no graph-memorising in the linked method. Modulo division looks pretty good though.
Much more thorough story posted 2 hours ago:

https://news.ycombinator.com/item?id=16067109
> It's Musk trying to put an assembly line into service too fast.

He doesn't have much choice. The company is over leveraged 7 to 1. With Feds slowly increasing the interest rates, Tesla's interest obligations will start to balloon as well. So they need to start selling more and more cars. That requires a big assembly line.
Again, the CDC makes recommendations for that scenario as well; these are guidelines written by people who spend their entire lives studying and treating these diseases.

Imagine if someone who read a few articles about programming started to debate with you about the relative merits of direct SQL use vs. ORM--he might say "ORM c'est de la merde." I'm sure you would explain there are tradeoffs, it depends what you are trying to accomplish, etc. Experts in a field establish guidelines for a reason.

https://wwwnc.cdc.gov/travel/yellowbook/2018/advising-travel...
That's not just a NY problem though. Amsterdam and London suffer the same insane costs.

1 Labour
2 Century old monuments- Tokyo literally bulldozed a lot of that old crap in the 60s.
3 NYC subway itself is a monument