skysight-inc/HackerNews huggingface dataset:
> However, this side-channel mechanism could enable someone to potentially extract some information that otherwise would not be accessible to software from processors that are performing as designed and not based on a flaw or bug.

I'm having trouble parsing this bit of lawyer speak.

In the prior sentence they say nothing is new. Then in this sentence, they are saying that there is something new. I'd say "potentially extract information that would not be accessible" as definitely not "performing as designed" unless it were "based on a flaw or bug." That is, if you take security seriously. I mean, how could it not be? Are you saying that this attack is by design?

Is... is this an NSA canary? Did you guys just admit that this is not a flaw by design? Blink once if the men in black are listening, twice if they know we know they are listening.
This response is better than the corporate speak Intel put out regarding these vulnerabilities. Still light on details, but at least not the same kind of corporate drivel.

AMD does not even mention Intel or ARM. While Intel did. Why is that? AMD mentions it's an issue with speculative execution used in modern processor architectures. Clean and simple, and to the point.

Here's Intel's response compare: https://newsroom.intel.com/news/intel-responds-to-security-r...
> but perhaps this will be the defining event that causes everyone else to think more deeply about letting untrusted code run, regardless of how sandboxed it is.

Your average user: Javascript is on the website not on my computer so it's fine.
Cleaver Beavers :) Nice read!
No, it doesn't.

It would just really suck to be one of those 1000 that have gene and can't afford the drug.
They weren't investors. They were given a small ownership stake as an incentive to agree to license their content initially.
What if spotify creates their own music label? It's the same situation that Netflix had with licensing content. Spotify has loads of data that the music labels don't. I would hope they will use that data to their advantage. If they don't they're wasting a huge opportunity.
And importantly, it's a way to get into synths without breaking the bank on "fixed layout" hardware, even if it's supposed to be awesome hardware. If you're on a $10/week allowance, projects like these are fantastic.
Do you have production applications running that do exclude their vendor folder? Does this work reliably? How do you handle dependencies that do not use semver?

What would be one of the cases where you'd say you need to commit vendor?
Last posted 133 days ago:
https://news.ycombinator.com/item?id=15079857

The title should be same as the blog post title: "Why I still use Vim".
Thanks for the starter kit- I'm always looking for new framework launch and go... Wondering if you could include babble with it?
The kernel memory map generally includes the 'direct map' of all physical memory - so, everything that is resident is potentially at risk.
I've seen many H1B coders from India living in USA on fake "Salary" certificates
I think it means that 30% of 330/yr , Apple would lose revenue unless each developer did that per year.
I want to disable WebAssembly right now, but I can't. (affected by the Intel bugs)

But the 3 flags don't work in Chrome to deactivate WebAssembly!!!

chrome://flags/#enable-webassembly

Setting them to "Deactivated" nothing changes, WebAssembly is still active, WTF Google?!?
Merlin TTS is quite good. https://github.com/CSTR-Edinburgh/merlin http://www.speech.zone/courses/one-off/merlin-interspeech201...
Yes, comes with Babel included for transpiling ES6 to ES5.
There’s not a single program that i trust. Not even the programs I’ve written myself; even taken all reasonable precautions, it’s far too easy to introduce a vulnerability.

There are programs that I choose to run with escalated privileges, like the operating system, out of necessity.

If I can’t run untrusted code; I simply can’t compute. It’s the main thing hardware is designed to do.
7.5/10

It was very interesting, and I shipped another game. I was in a fairly new position and fought a bit with impostor syndrome at first, but got to learn a lot and contributed quite a bit back to the engine. Just as I was feeling pretty competent and settled into the role I was moved to a position with more responsibilities, so now I have to adjust all over again. I guess it is good not to be entirely comfortable and keep pushing yourself, it just means a little more stress to deal with. I think it'll be fine though; I am used to working on things that feel challenging and push me to learn and develop more.
Hm, is medium experimenting with subscriptions? Getting a message saying that this is my first of 3 free articles (which they didnt even write themselv), 5$ after that per month
Doubt that. The Firefox news said they will round to 20 us.

That's much more accurate than necessary to benchmark any software code.
That seems an odd complaint? Any music made this year is 2018 music, but what people might not know is that you can faithfully reproduce the sounds of analog synths that largely defined vast swathes of the music landscape of the 70s and 80s.

(If you've been active in digital music for a while it's easy to forget how little the general public knows about stuff like this, and a title that goes "did you know you can do X with Y?" is better than a dry factual title)
0. They could use something like "kardianos/govendor" to check the location of the used packages (vendor, internal, external ...).
1. Using environment variables is not a hack in general. Persisting the environment in version control requires some kind of make-like wrapper though.
2. $GOPATH is not limited to one directory.
Can you tell me which apps would suffer because of timer coarsening?
Such users simply expect the computer they bought to work as advertised. Is it really their fault when it can’t run a browser correctly?
The clear thing would have been to use the full date.
Sure, but were I to find myself stranded in the wilderness, my odds of successfully creating rope are many times higher than before I spent those few minutes. I think that's pretty amazing, especially from the perspective this article is trying to convey.
ES6 DYNAMIC IMPORT AND WEBPACK MEMORY LEAKS
But it does affect the processors used on the Beaglebone and older Raspberry Pi devices.
Ask HN: How do you manage all your interests, hopes, dreams?
I am interested in so many things, and feel a sickening dread that I won't have the time to explore them all. I'm actively resentful of my job for taking me away from the things I want to learn and get good at. When I get home, I'm overwhelmed with possibility, so I always question whether I'm spending time on the right thing. I often don't end up doing anything due to this analysis paralysis.

If you're like me, what do you do? Do you try to whittle down your interests and commit only to a few, accepting that one cannot do everything they want to in life? Do you try to cram them all in somehow? Do you focus on one at a time and trust that, eventually, you will be able to get to them all? Do you quit your job and take a sabbatical year to do a deep dive on all these things, provided you have the means (I don't, necessarily, but could eventually).

This has been causing me quite a lot of stress lately. Thanks HN, for any wisdom you might have.
Devices containing multiple security levels/distinct users, and where performance matters the most, are generally socketed-CPU servers. For other devices, if they're security critical and can't be addressed through software, you can upgrade them at the board or device level early. This has already happened in embedded devices due to the C2000 timer problem.

Assuming there is a software mitigation which has a performance impact, sophisticated users would be capable of adding more capacity (if it's a horizontal scale type workload), upgrading early (if they had extra capacity for futureproofing), or spending money, potentially subsidized by Intel, to upgrade immediately. If there's no mitigation, upgrade early, or rearchitect application (moving away from shared security domains on single boxes, etc.)
The MELTDOWN one is the easy one (as is evident by the fact that this is the one that only seems to affect Intel CPUs).

When a load is found to be illegal, an exception flag is set so that if the instruction is retired (ie. the speculated execution is found to be the actual path taken), a page fault exception can be raised. To prevent MELTDOWN, at the same time that the flag is raised you can set the result of the load to zero.

SPECTRE is the really hard one to deal with. Part of the solution might be providing a way for software to flush the branch predictor state.
Thank you, will check them out.

[update]
AppSite is nice and easy!

http://appsite.skygear.io/shades_and_hues

They don't support Play Store directly, but it's still easy to set up :)
Check this out: http://ir.sparktx.com/static-files/3f12ea2d-7f52-4ccd-93d4-c...

It is their corporate presentation; lots of data on the drug starting around slide 10. these are data from the clinical studies required for FDA approval. Investor presentations (for public companies) tend to have good summaries of the key data on a drug; for more info, you can read scientific publications on the drug in academic journals
The poverty trap explanation here makes a lot of sense to me, although maybe it needs a bit of expansion.

In a subsistence farming environment it seems true that people did not have much time or resources to devote to making inventions. However, from what I've read of hunter-gatherer tribes still around today, the people living in them actually seem to have quite a bit of free time, yet obviously technological innovation has been quite rare.

So is it the case that innovation happens in a fairly specific set of circumstances, where resources and time are scarce enough to make innovation necessary, but still plentiful enough to allow for innovation?

Or maybe its just that the type of civilization agriculture creates leads to sufficient population densities for knowledge to start accumulating.
Ski Free.
They say they can reliably read memory around 120kB/s with one vulnerability and 1kB/s with the other. It just works, all the time. Some of the PoC takes a few minutes to initialize.

I'd say difficulty level is easy.
While not ideal, the drug/delivery procedure will be reverse engineered in a matter of months, and these 1000 people could get on a plane and get almost the same procedure in India/China for $8,500 instead.
From [0]:

>Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD and ARM on 2017-06-01 [1].

[0] https://googleprojectzero.blogspot.com.es/2018/01/reading-pr...
Plus security. It's always been a skill in relatively high demand, but in the last ten years or so companies have been willing to pay whatever it takes to avoid getting hacked. My company brought in all sorts of consultants just after, coincidentally I'm sure, the Target CEO lost his job because of a hack.
Hunter2?
Dealerbaba – Restaurants Services Providers – Restaurant Services
Sorting Real Numbers in O(n\sqrt{\logn}) Time and Linear Space
Connected things, not devices
This will not be corrected.

In an article about a position in which 1 in 50 employees is a man, the article includes the line "Across Google, women make up only 31% of employees."

There are many, many tech jobs where almost all the qualified people are men (think high end security, really low level packet optimisation stuff, pretty much any extreme fringe skill). That means to address the 31% figure company wide, tech giants need to fiddle with the numbers in jobs where it is not mission critical, e.g. you can't get to 50% in security, but you can make sure that 100% of the cleaners are women. Of course, this discriminates against under-skilled men and massively exacerbates the gender pay disparity internally, but that is impossible to fix company wide whilst being defendable on a department by department basis (e.g. employees of position X irrespective of gender are paid equally), whereas the company wide ratio is fixable.

Here are some examples of measures that could fix the 31% company wide figure quoted, without touching pay disparity:

1. Hirings in non-essential roles are to approach 100% female - think cleaners, admin staff, low level accountants.

2. Hiring in roles that support the essential roles are to approach 75% female - I'm thinking here of CFO support staff, account managers, project managers, anyone who supports people writing code. Why 75%? Because there will be some really good men that you can't afford to lose.

3. If a role is non-essential but predominantly male to the point an all female hiring policy is tough, just hypothetically here think garbage collection, outsource to another company. This removes these men form the headcount.

4. If a role is outsourced but could be 100% female hires, pre-school teachers is a great example, insource it.

5. Find ways to move more men from employee to contractor. This is a double win because while it massively inflates the unfixable wage disparity in real terms, i.e. what men are women are actually paid, it really changes the wage disparity on paper, while also fixing the 31% figure.

6. Create new divisions in separate entities whose numbers are not counted against Google employee numbers. Contractors on steroids.

I predict we will see big tech companies utilise some or all of these measures.

Last point on this, there are lots of ways to fix the wage disparity ON PAPER while making things in reality worse, and I fear these are coming as well. Most involve finding ways to better disguise male compensation - by changing it from salary to something else. More options, payments for extraneous things as a non-salary allowance (rent compensation, massive relocation fees, education allowances), pay higher bonus to salary percentages. That will be then end game here, sadly.
When does the gene kick in? Most government funded healthcare would probably see this as worthwhile if it affects people young enough, it's cheaper for the country to pay for the treatment and have a productive citizen than it is to have them on welfare for their entire life. If no one is going blind until late in life then the equation changes though.
"Infrastructure is not political" is part of the canon here on HN as well. Bitcoin, as one of many examples, is often touted as being "neutral", or "unbiased" (in comparison to the Federal Reserve's monetary policy).

The same sort of argument is gaining steam around discriminatory decisions by AI or "Big Data" systems: "It's an algorithm! It cannot be biased. Technology is neutral!"
Ah, ok, so Intel Management engine patches are also distributed in the Linux Kernel then?
CPU and kernel engineers don't have the necessary security mindset
What is really indicated by these hardware-level defects is that a security mindset is not a pervasive way of thinking among otherwise very serious engineers. The sheer number of low-level engineers - whether hardware or software level - who overlooked these flaws for so long is simply huge.

When CPUs and the internet were being designed the level of adoption we are seeing was not anticipated. Similar to how nature engineered humans with lots of potential exploits. Now that we are aware of both the possibility and risk of every single person being exploited simultaneously, we must act accordingly and defend ourselves.

In other words, a huge amount of effort must be put into securing basic infrastrucure (including CPUs), somehow.

So long as humanity continues to be at war, we must continue to act as if that is the case. Kudos to Google for figuring this out. But do you really want the "don't be evil" company that profits almost exclusively based on ads to be your only true line of defense? Do you want it to be your government, versus other governments?

What we have just experienced is a precursor to something deeply terrifying. We must, somehow, act to prevent it.
It's difficult for me to imagine they won't get sued over this, and in a big way. Imagine if you're Amazon or Microsoft looking at a 30% reduction in salable CPU resources.

Plus a huge class action suit from consumers based on false advertising or some related claim.
> The ones least affected (i.e. not at all) are isolated single user/single purpose machines running trusted code

What about people who use personal machines to browse the web and run untrusted JavaScript?
Because for every two people who panic and sell there is one who is waiting for the price to drop and buy. The same kinda happened with Equifax - went down from $140 to $90 then started climbing back up. Now is at $120 which is also where it was last year in January. So basically nothing changed for them in a year. They didn't get crushed and bankrupted like many were saying they would.

I remember at least people in /r/investing gloating how they made a good amount of money waiting for Equifax to drop and then bought it and sold it as it went back up. The same people are waiting for everyone to panic sell their INTC so they can buy it.
قلعه چنانسی قلعه ای بر روی آب در فرانسه
> Why, in your opinion, is GM’s Chevy Bolt still being outsold by the Tesla Model S?

Because the Bolt’s a boring, though electric, compact car being sold at the price significantly above a similarly boring mass-market midsize plug-in hybrid (the Prius Prime) with sufficient all-electric range for reasonable commuting, and also somewhat above that of a competing boring compact all-electric (the Nissan Leaf) while Model S is a luxury mid-size electric vehicle with far less direct competition.

The Bolt is selling into a segment where utility/price is more important, and it's got strong competitors on that dimension. That's not a sign that GM can't make good EVs, but that GM is attacking the harder segment of the market; whether that's a good or bad business decision is debatable, but if EVs are ever more than a luxury niche item, the space the Bolt is competing in is going to matter a lot more than the space the Model S is competing in.
Your average user: what’s a Javascript?
> adding random noise just makes attacks take longer

No. It's true that with a low-res clock source in some cases an attacker can still get the precise measurement they're after by repeating an operation 1000x+ more times. In some cases though that is not possible, because at that timescale the signal they're after is degraded by noise that they cannot predict or control: operating system interrupts, memory traffic from other threads, etc.

Anyway, even if a lower-res clock source helps only 10% of the time, on defense you should always prefer to make an attack complicated, slow, partially-reliable rather than trivial, fast, highly-reliable.

Developers who need a high-res clock source for profiling, etc, should of course still be able to enable one selectively.

> You need to address the specific vulnerabilities, not shoot the clock_gettime messenger.

You can and should do both, to gain some defense-in-depth against future attacks.
They have been doing that for some time. Not sure how effective this is.
Accelerating Deep Learning with Memcomputing [pdf]
Agreed. Post gave me way more insights than I could have hoped for.
3d Animation Services – 3d Animation Company India
All our production applications don't have their vendor committed. By running "dep ensure" it dep restores the exact same vendor directory from the lock file, we do this in CI where we build our binaries. For dependencies that don't support semver dep uses the master branch by default and pins a commit to support reproducible builds. The only case where this has caused problems for us was when one of our dependencies force pushed to master, so the commit that was pinned didn't exist anymore. This resulted in a failing build though, not an inconsistent one.

Other than working around that issue the only case where you actually need to commit vendor (at the moment) is when you want your project to compile reproducibly by only running "go get project". If you are fine with telling your user to run "dep ensure" (or make) first this is not needed. This is not usually an issue when working with colleagues, but can be nice for publicly released projects.
Shades and Hues – a game of color gradients
It should be pretty easy to do enough auditing to keep everyone honest - which they should be anyway as partners in this endeavor.
Why a Search Relevance Conference?
>through third-party cookies
Which so many browsers are blocking
> the people living in them actually seem to have quite a bit of free time, yet obviously technological innovation has been quite rare.

I have to wonder if it is the people that have quite a bit of free time there, or men only.

I can see men having not much to do once they hunted and brought their prey. But if women are left with the task of preparing food from such completely raw ingredients, and also have to do childcare, possibly some gathering in addition, they don't have much time in the day left.
The parens are a red herring. GP is commenting on the previous poster using 277 instead of 77 (i.e. typo).
Principles of Neuromorphic Photonics [pdf]
Culling all that JS can make things faster for everyone.

If you have a web app there’s no point, but if you’re displaying text and images and your site doesn’t work without JS, you’ve over-egged a solved problem.

(... While increasing perceived latency, especially for mobile users.)
Very well then; let us rather write them with proper superscripts (and I’ll use THIN SPACE as a thousands and prettiness separator too because I can):

2 ⁷⁷ ²³² ⁹¹⁷ − 1

not

2 ⁷⁷ ²³² ⁹¹⁷ ⁻ ¹

There, no more ambiguity.

(Now I’m waiting for someone to jump on me to correct anything subtle.)

[Ah, I see, the parentheses were indeed a red herring. Ah well; let the superscripts remain.]
It is still possible to exploit a timing attack with a low resolution timer; it simply takes more samples. Meanwhile, people have managed to perform timing attacks (such as against OpenSSL) across a network (see the link below where I link to the seminal paper, "Remote Timkng Attacks are Practical"), as while the latency is large and variable it can still be trivially characterized. So, unless you are willing to apply a truly unpredictable delay function (some kind of Turing-complete noise which sometimes might block for arbitrary amounts of time) or, alternatively, a delay long enough to reauire the user to sit on the web page for "too long" (maybe weeks is the right calibration? I often find sketchy tabs that have been open for days) to essentially everything--and, in particular, all JS-initiated network requests--then you are likely just engaging in security theater by removing useful functionality from an API because it makes you feel more secure.

https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
You are right that 1st party ads would have to step up the quality. That's just an added benefit.
A .bat is the worst case but does NSIS prevent a badly written script? I don’t think so, it’s still up to the developer to care. Adding an UI on top of a badly written script will do as much harm as a .bat. (I might be wrong I’m not familiar with NSIS on the dev side while I confess I used it a lot)
Hi guys,

Creator of the game here. It was my first Android app that I published. Created the orignal game in C# .NET with just GDI+ Draw calls.

Android version was created by drawing to a canvas (native; Android Studio).

Currently working on a Xbox One version using UWP and Canvas/Shapes.