skysight-inc/HackerNews huggingface dataset:
In this case it was a typo in a comment in third-party code included as part of the repo.

In general, it depends on the terms of the bug bounty.

Perhaps the most famous is Knuth's bounty for any mistakes, not just typos but also the wrong use of font and other presentation errors.

For an example from another project, tarsnap's bug bounty is at https://www.tarsnap.com/bugbounty.html . It uses different categories, each with a different payout level. The least level is:

> Cosmetic errors in the Tarsnap source code or website, e.g., typos in website text or source code comments. Style errors in Tarsnap code qualify here, but usually not style errors in upstream code (e.g., libarchive).

In this case it sounds like the submitter for the typo didn't follow the requirements of the bug bounty offer, so it doesn't matter if a typo counts.
Addictive Gaming Will Be Recognized as Disease: WHO
Harvesting credit card numbers and passwords from websites
Is that Ram only or also L1 etc. caches?
> everything you've said is insensitive, over-generalizing, frowned-upon, and kind of just untrue.

To be somewhat fair, the grandparent posting makes it clear that its comments apply to 50%.
Spectre is a non-issue on a home NAS.
No, not implicitly. You'd need to explicitly assign a transferable right to GitMask so GitMask can transfer it to the repository owner. Accepting the ToS isn't enough for that. Depending on who you ask you need an actual signature on paper to be 100% in the clear.

What's worse: GitMask would need to guarantee that any given PR meets these requirements and expose this status to the repository owner. This would make GitMask liable but they could escalate to the original author -- but that in turn would jeopardise the anonymity guarantees to a degree.

Imagine the following scenario:

1. Person A creates application X and publishes it under a non-permissive commercial license.

2. Person A uses GitMask to create a PR to an open source project Y of competitor B and includes source code from application X in the PR.

3. Maintainers of project Y merge the PR without being able to verify the identity of the author and publish the updated version.

4. Person A sues competitor B over the use of the source code from application X in project Y.

5. Competitor B blames GitMask for introducing the infringing code.

Now depending on what GitMask has done, this could result in different outcomes.

A. The status quo: GitMask provided no guarantees about the legal status of the code and retains no information about the author, so competitor B acted in negligence and is fully liable.

B. GitMask does provide guarantees but requires no guarantees from the author, so GitMask is at least partly liable. If GitMask retained any information about the author they can try to sue over violation of the ToS but good luck with that.

C. GitMask provides guarantees and requires formal guarantees from the author. GitMask is likely liable but they can hold the author accountable. In this scenario GitMask could demonstrate fraudulent behaviour, bad times for person A.

IANAL, TINLA.
Focussed Molecule Libraries for Drug Discovery with Recurrent Neural Networks
> You don’t know whether or not they’ve investigated this issue or not.

True, because the company we're discussing isn't exactly the champion of communication when it comes to things like that. A simple reply from an Apple developer that it is being looked into, that it got linked to an internal KB, would've been suffice.
Author order is such an arcane nonsense, and needs to be dismantled. The "roles" indicated by position are peculiar to the discipline and a mystery outside it. The customary position of senior academics e.g. as the "anchor" can confer significant prestige on that academic, while their contribution might be minimal (and even zero, in exploitative situations).

It really is bewildering.

Online academic communities and publishers such as ResearchGate and EndNote could come up with potential solutions here. ResearchGate already asks us to effectively vote about other users' authorship and expertise. Adding a voting system (or similar) whereby users declare the roles played by each author might help dismantle author position hegemony.

Voting might be imperfect, and perhaps there are other options. The current system, though, is ridiculous and contributes towards the exploitation of junior academics, and poor inter-discipline communication. Clearer computational representation of roles could also improve search.
There are probably many geniouses that came and went through the ages, the problem is that of “financial stability / partnerships”. If I’m too busy making Widgets for a company in order to feed my family, I dont have any energy left to do Creative stuff. Isaac Newton was wealthy so could devote time to pursue the sciences, the rest of us are preparing TPG reports for the bean counters. The person who can cure cancer is too busy taking his kids to KungFu/Soccer practice, hogged by a demanding socialite wife who doesn’t allow him to steal time from domestic chores.
Shouldn't that protect against Spectre?
That's not entirely without precedent. Look at macOS, still comparatively little malware compared to Windows even though macOS has had quite a bit more vulnerabilities in the OS itself compared to Windows.
Culprit? Journalists.
Yeah, that's done as a result of this linked bug report. Its mentioned in the bug report somewhere at the bottom.
With the help of proxies, https://www.reddit.com/r/scihub/comments/7ioo0m/working_scih...
In the AC/DC wars Edison fought with Tesla, he'd electrocute animals to show how dangerous AC was.

http://www.nydailynews.com/news/national/thomas-edison-histo...
"Luckily, the politicians in Germany and Europe wake up. They want to build up European chip and hardware facilities to have the full chain in Europe. Also they plan to demand certification and customer visible labels. Finally!"

So far similar efforts by EU were rather underwhelming - but this one is probably the most important. I believe EU is the only global actor that can achieve the goal of creating reliable hardware and software. The still decentralized nature of EU means that no partner can afford any unilateral action (like backdoors) - and a conspiracy on the level of whole EU is impossible.

And of course it needs to be Open Source.
It is usable for the vast majority of users. If it is causing an issue please file a detailed bug report, with diagnostic ID, also try the Edge releases, and give some information about what you are actually running, for example how to replicate it. Most of the bug reports in that thread are totally unhelpful. Quite likely it is not even the same cause for different people, as some people said it was fixed on Edge while others did not. Even a single well thought out detailed bug report would make it much easier to investigate the issue.
It's usually a mistake to judge people from another time using modern sensibilities.

It's like thinking people from the 1800's were all grim because they look grim in photographs. But that was just an artifact of them having to hold still for the long exposure times.

I bet those people would think people of our time are horribly ill-mannered and rude.
It looks like someone was having some fun when they chose the photo of him smiling holding a (machine gun?).
ah man while i like Harry Potter, i never liked the British cover arts.

I did grew up with the german ones anyway but when i switched from reading german to english, i bought the adult version because of the cover art.
Maybe your landlord isn't into crypto but some other landlord may be.

Also being a little cynical, some landlords may be up for getting rent in an anonymous crypto like zcash and forgetting to pay the income tax on it.
This is a Kubernetes issue, the same issue on Minikube and Docker for Mac. The Kube API server uses a lot of CPU when idle. We are trying to diagnose what is happening.
I think you give these guys way too much credit. It's more likely some clueless PM simply asked a clueless junior developer to add a backdoor and due to lack of good processes nobody ever reviewed that commit (assuming those guys even use version control).
Servers don't have/need web browsers (in general). Some on premise compute clusters don't even necesarrily have internet access except SSH from a few trusted users and exploits to run code locally would go through them or SSH (at which point you don't need meltdown to access the data).

I believe there are valid usecases for not applying these patchws.
SEEKING WORK - Remote preferred - Edinburgh, UK

I am a full-stack web developer specialising in AngularJS and Python, with over 6 years web development experience in total. As an example, I have previously used AngularJS with Flask to work on an enterprise-scale application for a very large public body in the UK, implementing complex functionality over a period of 2 years.

I am very much into self-development and in my spare time I work on my own mobile development projects. I also understand the need for professionalism and great communication.

I am very adaptable and my wide range of experience also includes: Javascript, Ruby, Typescript, Swift, Java, HTML, CSS, SASS, PHP, Shell languages, MySQL, PostgreSQL, AngularJS, Django, Flask, Pyramid, Ruby on Rails, iOS, AWS, Heroku, Salesforce.

Résumé/CV: https://rsmith.io/cv

Email: robin@rsmith.io
You don't need High Sierra for this. Just install the Edge channel of Docker for Mac.
I wonder if it's similar to the popular perception of Jobs and Woz. Steve Jobs is often regarded (for the right reasons) as an arrogant, unforgiving CEO who excelled by exploiting the works of a benign genius. The truth is, however exceptional Woz was, there are far more brilliant hackers than people who transform industries.
I have a Dropbox running inside a container on my Mac. Even though there is minimal activity on the account it drains the battery like crazy. Native Dropbox client isn’t great in that regard, but it feels like there is an order of magnitude difference.
IBM Q experience (play with a real Quantum computer)
Wow that's a nice way of handling lists.
I was recently testing video quality of video chats on a relatively shitty connection, and somehow Skype came out way ahead of Whatsapp and Hangouts.
Rent a Flat in Gurgaon: Development in the Rental Market in India
Yeah, but did you ever win a Putnam?
Fire and Fury
Location: Edinburgh, UK

Remote: Yes

Willing to relocate: No

I am a full-stack web developer specialising in AngularJS and Python, with over 6 years web development experience in total. As an example, I have previously used AngularJS with Flask to work on an enterprise-scale application for a very large public body in the UK, implementing complex functionality over a period of 2 years.

I am very much into self-development and in my spare time I work on my own mobile development projects. I also understand the need for professionalism and great communication.

I am very adaptable and my wide range of experience also includes: Javascript, Ruby, Typescript, Swift, Java, HTML, CSS, SASS, PHP, Shell languages, MySQL, PostgreSQL, AngularJS, Django, Flask, Pyramid, Ruby on Rails, iOS, AWS, Heroku, Salesforce.

Résumé/CV: https://rsmith.io/cv

Email: robin@rsmith.io
Really they have no idea how many times the "lightning" struck anyway. It was just once that they'd been told of.
Knowing does not imply caring.
Oh yeah you can do that, but I'm not sure if you can extract something useful out of this. Basically you can know whether or not a branch was speculatively loaded by timing the time it takes to go over it (if it was loaded by mistake it'll slow down execution). But then where do you go from there? Execution timings are not supposed to be secret.

I can't really imagine how you can construct an attack based on that, but maybe I lack imagination.
> focusing on the worse off person.

I recommend you read John Rawls's seminal work A Theory of Justice.

For him, there are three principles a society should be based on (in lexical order):

Maximum, equal liberties for all > Equality of opportunity > Difference principle

Difference principle: Any inequality has to be to the biggest advantage for the least well-off person
New Open Source Mobile OS Puts Privacy Front and Center
Don't buy apple if you don't like closed systems.
Founder of GenodeLabs OS framework discusses impact of Meltdown/Spectre attacks
I don't understand the use-case here. You want to use Docker+Kubernetes but can't work out the bits to run it in VM's on your own?
I'm not a believer in the magic superiority of kids either, but neither do I believe that sales numbers are a reflection of specific productivity features. Who makes those buying decisions based on what?
Wholly Shit
Isn't that enough
I think the fundamental property of a block feature should be complete undetectability that the user has been blocked by the user in question. For example Usenet killfile: you never know if you're in somebody's killfile unless they tell you so. Twitter's block function obviously fails this test, which makes it completely useless: once you realize you're blocked, just create another account to continue harassing the user who blocked you.
This Mozilla post https://blog.mozilla.org/security/2018/01/03/mitigations-lan... mentions that "other timing sources and time-fuzzing techniques are being worked on".

The paper they linked to references this one: https://www.usenix.org/system/files/conference/usenixsecurit...

I think this is what all sandboxes have to do: set the TSC disable flag, restrict system timer precision (make it configurable per sandbox: web servers generally don't need more than 1ms precision), make system timer report fuzzy (randomized) time. Heck, why not also make the CPU run at randomized frequency to mess with busy loop timers.
that's one of the reason we decided to jump on swarm. And seeing how Swarm has matured and added features, we are very happy.

Azure also comes with a Swarm-mode deployment template which is pretty great (https://github.com/Azure/acs-engine/blob/master/docs/swarmmo...). However, setting up and running Swarm has been a pleasure.
Okay, so how can we deactivate ASM.js and WebAssembly? (in the light of Meltdown and Spectre)

The config in Chrome is broken, WebAssembly cannot be deactivated anymore with chrome://flags/#enable-webassembly , setting it to "deactivated" and it's still active.
How can you say the likelihood is near 100%?

I'd bet much smarter people work at Google than the NSA.
Thanks! Seems interesting
Looks great. I wonder how it compares with Evernote. It looks lighter, which is nice.
This is very interesting. I've been looking for middle ground between Dokku and Kubernetes, I'll give swarm a try. Does it handle ingress at all? vhosts, TLS certificates, etc?
Was it hard to move off Retina and reasonable touchpad? I am considering similar route, but these are the two things that keep me on Apple.
On my OnePlus X Android phone: https://imgur.com/a/C1hb7
Well to be fair, that's exactly how the rest of the world pictures Americans. Still seen as cowboys with guns.
Does Azure's composable FPGA design offer potential for assemblage of a higher level of abstraction, my poor analogy is the web assembly reduced to instructions/ primitives but you control the gate logic that's run, and isn't that logic then totally isolated from any other design side effects?

If you by some circumstances had a terrific clean and tidy system in a functional language, wouldn't that offer a higher level of possible "primitive" operations?
Easy Bitcoin Currency Converter version 2 released, and is now freeware
Having sold exactly zero (0) copies (previously $7.99 USD/license), we decided to make Easy Bitcoin Currency Converter free of charge as of this new version. A small text advertisement has been added, but it's currently only asking for donations and will likely remain like that for the foreseeable future.

A lot of small improvements have been made, and I genuinely believe that this is now a very useful and user-friendly application. I use it myself every day, even just to check the current Bitcoin price without having to load some site.

Since you're all thinking that this must be yet another coin-stealing malware, I'd like to show you that VirusTotal gives it a perfect score (0/66 engines detected it as malware). Of course, this isn't the "ultimate truth", but it should make you feel a little less scared of running it: https://www.virustotal.com/#/file-analysis/YTBlYmRlZmI0MDgwZTg5NTZmZWRkYzRlMmQzMGYwNmY6MTUxNTE4NzEyMA==

Web site/download page with screenshot: https://www.spritelake.com/Easy_Bitcoin_Currency_Converter/

I hope that you'll test and like it now that it's given away for free.

Note: It's currently Windows only, but Mac and Linux versions are not ruled out and may well appear if enough interest is shown.

If you don't want to (or can't) reply here, you can send an e-mail directly to info@spritelake.com if you have any questions. I'd love it if you would review the program on your site or just spread the word in general to all your crypto coin associates!

Thank you in advance.
The insider gossip is that the CEO ordered for access to be kept open.
Then this is not really the backup though... I mean it is not a backup if you don't understand it completely.
Touring motor gliders are often sold to couples that want to travel together. I've known people who own/fly: Dimona H36 and Taifun 17E. I have a family member who recently purchased a TL Sting S4 (a microlight) for similar purposes.
Its characterising memory accesses, so it will show up the result of using all the caches in the system.

You would typically see larger latencies when the caches are not being effective.

Multiple humps will indicate the presence of multi-level caches.
Why does hold music always sound so terrible
If you're paying for EE, then UCP can do a lot for you. We're using the HRM heavily, and it's very handy.
Matthew Dillon, DragonFly BSD author, on side-band cache attacks in April 2017
And you should be following the 3-2-1 rule for backups.

3 copies of the data, 2 locally on different media, 1 offsite.
Not quite: many people already have 2.0.2 (which is buggy) installed. Short of uninstalling htop the issue still remains.
x64dbg: An open-source x64/x32 debugger for Windows
What a pity that all the references are missing [?].
I have an old MacBook Pro I use as a gaming machine (and my wife uses as temporary machine after our late dog (for reasons unrelated to her demise) urinated on her new XPS13.

After upgrading to High Sierra, we both got so sick of the instability that we're installing it with Xubuntu this evening, bringing it in line with the rest of our 'home fleet' (ThinkPads w/ either FreeBSD or Xubuntu).
I can't edit anymore, so I'm going to reply: I did a bit more research on this issue and it's not actually a memory bug at all. In reality there appears to be an infinite loop in calls to task_for_pid: https://github.com/hishamhm/htop/issues/682#issuecomment-355.... I'm still not sure who's doing the wrong thing, htop or Apple, but it's clear that freezing up the system is always incorrect behavior.
Well, for nerd books, "Modern Operating Systems" by Andrew Andrew Tanenbaum. It was until years later that I realized just how much I had learned from that book, and the consolidated notes from the Usenet flame war between him and Linus Torvalds.

There's just so much "how does all this shit actually work" in there ....
I don't know what any of those mean :(
"The biggest looming problem"

See also:

* "Intel's press releases have also been HIGHLY DECEPTIVE." -- http://lists.dragonflybsd.org/pipermail/users/2018-January/3...

* Intel, press releases, and what it should have published first -- https://news.ycombinator.com/item?id=16080918

* How and when some of the other BSD people did and did not (mostly did not) get told about this -- https://news.ycombinator.com/item?id=16074531
>Bazel is popular for Google employees.

https://github.com/bazelbuild/bazel/wiki/Bazel-Users

Asana, Databricks, Dropbox, Pinterest, Stripe and Uber ATG are not Google.
Different perspectives and research backgrounds converging to the same limits of the given tool is very good for defining a boundary while containing the hype. More in general, it still seems generally inefficient (and very risky from a regulator point of view) to deploy full AI agents in dynamic, human, imperfect environments, eg. self-driving cars in the common traffic flow.
That's my point though, the length of intros varies too much from show to show to really make any meaningful correlation based solely on the series age.

Take Boardwalk Empire, another really long intro. Yet Lost, which is an older show, only had a title graphic that lasted a couple of seconds.
I am now less sure how anything is secured once it can be reached through the Internet.

May be I have the old way of a NAS that is NOT reachable through the internet at all.

I really want a Time Capsule for all my iOS devices,, and have it only accessible within my Network. But then i am also paranoid about Bit rot on HDD. As I have seen far too many of my Photos or Video with this problem. And I dont believe any consumer grade NAS are quite capable of handling them yet.

I have yet to find a usecase where I want ALL of my files, Photos, Movies or whatever accessible when ever I am. Most of the time I only need one file form work, and it is normally in dropbox or email.
On my i7 8700k https://imgur.com/a/D71v1
>"A good developer/SRE should basically be able to justify her expense and essentially write her own check, splitting the value capture with the host company. Things are way off and asymmetric in the current hiring practice."

I was curious what you meant by "splitting the value capture with the host company." Similarly I would be interested in where you see asymmetry in the hiring process.
My suspicion was confirmed the next day by Philip Guenther:

* https://marc.info/?l=openbsd-tech&m=151521435721902&w=2
kudos <fx: fist bump>
Interesting, how do you think bitrot affects a NAS with ECC/ZFS/RAID10 ?
ingress is the most beautiful part of Swarm - it is built in.

however, it does not do termination. You should trivially include a haproxy/nginx pod/service/vm to do the termination for you.

One of the cool new infrastructure features is Docker Cloud - which allows you to "bring your own nodes" for 15$/node/month and setup Swarm. https://docs.docker.com/docker-cloud/cloud-swarm/using-swarm...
Correction noted - thanks! The same observation "0.1 degree warming in 50 years" is made here https://sciencesources.eurekalert.org/pub_releases/2018-01/u... as well and is evidently authorial - Severinghaus?

"Our precision is about 0.2 ºC (0.4 ºF) now, and the warming of the past 50 years is only about 0.1 ºC," he said, adding that advanced equipment can provide more precise measurements, allowing scientists to use this technique to track the current warming trend in the world's oceans. "
> When you turn the computer off, it remembers what's on your harddrive.

Weird analogy. The computer doesn't remember – the individual storage units on a hard drive don't care whether the machine around them has power or not They are indifferent to what's going on in the system which contains them as opposed to, say, the storage units in DRAM. Are you trying to say that at the moment all qubits we've made behave like the storage units in DRAM? In other words, while the system that contains them is powered on they remain in the same state but when the power is removed they become disordered? Aren't qubits an abstraction? I mean, qubit : bit :: qubit storage unit X : harddrive bit – or – qubit : bit :: qubit storage unit Y : DRAM bit – see what I mean?
Kind a blunt cheap advertisement. Not on ycombinator please
There is no silver bullet and it is not x86, its ISA problem, it is the implementation that matters.

On the x86 must die notes, there are rumours that Intel is working on a new ISA that takes the best part of X86-64 but put compatibility in the back-seat. I just wish they call the new ISA "AE86".