skysight-inc/HackerNews huggingface dataset:
LineageOS is based on official Android sources. The moment the official Android kernel is patched, LineageOS will use the patch.
Wasn't there a PoC for a second issue of js reading memory from its own process? Could potentially be an issue (eg reading data from another website)
Ive been getting rewards and media attention for the last 8 years or so. Which leads to work for hire. But im trying to figure out if zi can monetize with a digital product, in order to spend more time building prototypes which by themselves become marketing. The question is... th thing im marketing... could it be something else than work for hire?
Would you mind posting civilly and substantively or not at all, please?

https://news.ycombinator.com/newsguidelines.html
If IBM is that desperate for revenue, things must be getting really bad. I mean, granted, we already knew their revenue has declined for 22 straight quarters[1], but Ginny keeps hyping "Watson", "AI" and "Cloud" as their "growth" strategies that are going to return them to preeminence.

Funny, I don't remember her mentioning anything about trying to extort money from travel websites...

[1]: https://www.cnbc.com/2017/10/17/ibm-earnings-q3-2017.html
> "Most societies" is a meaningless term. Measuring "most" is impossible and any metric is more or less going to come out of a value judgment to begin with. Some human societies have a lot of equality and some have a lot inequality.

I would bet there are true (though perhaps simple or obvious) claims which can be made in sociology and/or anthropology about "most societies." Such, as, perhaps, burying the dead.

Are you a sociologist or anthropologist? Or, do you have some other claim to expertise in this domain? If so, forgive my critique.
History Is Rhyming: Fitness Functions and Comparing Blockchain Tokens to the Web
Since this affects legacy systems that may not be able to be upgraded it seems like this issue will be around for a very long time.

It also only affects "legacy systems" which routinely run nontrusted code. If it's something like e.g. a server in a bank, chances are everything running on it has already been accounted for. This isn't like e.g. Heartbleed where you could just connect to any open server and read its memory --- you have to somehow get your code to run on it first.
That is true, but this situation is very different. Vitamin D is very much unlike other vitamins and is arguably a steroid more than a vitamin. The body does not make its own and is not very good at taking it up. Large amounts of Vitamin D have been studied for a while and do not show the risks that other vitamins do including multivitamins. Vitamin D supplementation has been shown to have a broad range of positive effects including reducing cancer and incidents of flu and common cold.
Jobly.io – An affordable solution to setup a careers page for your website
The app uses Infura, just like MetaMask, but future version will allow you to specify your own RPC. Geth/Parity light clients are not quite usable on mobile yet, but they are improving rapidly, so hopefully in the future.
Because it's not true. I think there's very cogent arguments to be made to say that, should you have certain severe conditions (cardiovascular, cancer), some of the best treatments in the world are indeed to be found in the US.

I think it's equally plausible to say that over the last 30 years, family/general/primary care practice has deteriorated, significantly, where priorities have shifted to billing from patient care, witness less times spent on visits, more of a rush to prescribe at times often unneeded medications, a swarm of at times invasive imaging to prevent not just deterioration, but litigation. I think it's hard to argue that the above is automatically a "higher standard of care" than received by the "average European".
The reason Apple doesn't do this is they want to make the AppStore a safe-place and a worry free experience. If anyone can run whatever they wanted for whatever length of time they want, then it opens the door for malicious apps to exist. It's a trade off between safety/experience and flexibility. For folks like my Dad, who I took away his PC and replaced with an iPad, it's been great. I just don't worry about malware, viruses, or trojans he might install on his iPad because the odds are he can't get into too much trouble.
the patch was by Thomas Gleixner[0], who is not an Intel Engineer.

AMD has since pushed a patch to "not enable PTI on AMD processors" [1]

[0] https://patchwork.kernel.org/patch/10138833/

[1] https://patchwork.kernel.org/patch/10142563/
Oddly enough, not always. I have a just-for-me app working on my phone that I last built on December 3rd.
Put a much stronger engine in your car, and you'll also need to upgrade the brakes, suspension, frame, transmission, driveline, tires, etc.

Nothing like dropping the clutch on your new 800 hp motor and having the rear axles snap. Or have the flywheel disintegrate and saw through the bell housing and your feet.
I assume, per the shared responsibility model, this implies guest OS (your instance) requires you to patch. Underlying host, hypervisor, would be patched.
Why Envy Dominates Greed (2010)
Try this link: https://play.google.com/store/apps/details?id=com.cipherbrow...
I know you're joking, but Chrome extensions are Firefox extensions now too: https://addons.mozilla.org/en-US/firefox/addon/chrome-store-...
One thing worse than overly political discussion would meta discussion of an overly political nature.
In what world is half of what their previously stated goal "better than expected"?
It seems that Richard Stallman is not so paranoid after all:

> I am careful in how I use the Internet.

> I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation).

Ref: https://stallman.org/stallman-computing.html
I read it as it was an independent discovery by project zero and by academia researchers.
Previously submitted less than an hour ago, 500+ points:

https://news.ycombinator.com/item?id=16065845
https://www.linkedin.com/feed/update/urn:li:activity:6354450...

says:

> Want to know what's really going on with the Intel security flaw everyone is talking about? Checkout https://meltdownattack.com to get all the details. This is my boyfriend's and his research team's latest work. An huge security breach which affects nearly all your computers! Stealing all your secrets never was that easy!
the intel behaviour is probably the result of an optimization / architectural decision. like when the micro ops fetch a value from memory they are probably fetching the real value then setting a flag that the instruction is invalid. like it might be cheaper to deal with the problem later in the pipeline than earlier.

but it might also be reasonable in a different architecture to fetch 0 straight away to the micro op when the memory access is invalid and set a flag to raise the exception as well. in this situation you don't have the problem because you are just shuffling around invalid data.
The vulnerabilities affect multiple layers in a virtualized environment. Amazon patching the virtualization host is what would prevent things like guests reading host memory (essentially a guest escape - one VM gaining access to other VMs running on the same system). Patching the guest VM is what's needed to mitigate other attack vectors (like unprivileged code reading kernel memory).

I don't think updated packages are available for any of the major distributions as of now. So far I've only seen fixed packages for Amazon Linux and Google's Container-Optimized OS.
idk, cause the one-click install is easier to distribute than telling people to install a generic plugin they might only use for this 1 mod anyways.
It's mostly React Native for the UI, but there's a lot of native code for crypto/secure enclave operations.
Avoid speculative indirect calls in kernel
> that's really dangerous, because the will of the people can get really hairy.

Yes, but that's a direct consequence of having an ill-informed, poorly educated , credulous, angry, compliant majority. Societies where the elite are looking to retain their power base will typically channel fewer resources to public education, and more to the institutions that reinforce their own position.

Difficult to undo once it's been started, and (IMO) it's been happening for a very long time in AU, UK, US -- and presumably almost everywhere else that self-identifies as a capitalist democracy.

So, yes, the will of the people can get hairy, but of the two options -- force the agenda of the elite upon everyone else, or work towards a better society -- the preferable option very much depends which of those groups you're in right now.

Also noting that if you're in the uninformed group, you may not recognise that, or think anything needs changing.
Given that you're only talking about centimeters of metal at best, which in a thunderstorm could be covered in water anyway, and still need to interface to other tissues to achieve conductivity to the earth, then would the animal's chances of getting zapped go up significantly?
the google site has the actual white papers detailing the attacks.
Massive chip flaw not limited to Intel
rightfully so:

https://twitter.com/brainsmoke/status/948561799875502080
http://psycnet.apa.org/record/2017-22175-001
§1(3) - " Illegal contents are contents within the meaning of paragraph 1, which constitute the offense of §§ 86, 86a, 89a, 91, 100a, 111, 126, 129 to 129b, 130, 131, 140, 166, 184b in connection with 184d 185 to 187, 201a, 241 or 269 of the Criminal Code and are not justified."
Vitamin D is synthesized in the skin when it is exposed to sunlight. That means that it technically isn't a vitamin (a necessary dietary component).
From a recently posted patch set:

Subject: Avoid speculative indirect calls in kernel

Any speculative indirect calls in the kernel can be tricked
to execute any kernel code, which may allow side channel
attacks that can leak arbitrary kernel data.

So we want to avoid speculative indirect calls in the kernel.

There's a special code sequence called a retpoline that can
do indirect calls without speculation. We use a new compiler
option -mindirect-branch=thunk-extern (gcc patch will be released
separately) to recompile the kernel with this new sequence.

We also patch all the assembler code in the kernel to use
the new sequence.
Please make your comments civil and substantive, especially on controversial topics. Hacker News is not the place for religious flamebait.

https://news.ycombinator.com/newsguidelines.html
But there is no one single such triangle.

Many people have in mind this version of the "quality triangle" which we were discussing (not a Project Management triangle which I agree is more on point).

You get that a lot if search for "quality triangle": https://www.google.fr/search?tbm=isch&q=quality+triangle

Why is it commonly assumed that quality and cost and time are opposed to each other?

The Capers Jones books have one idea throughout, that is backed by data: for Software, quality is positively correlated with reduced time-to-market, low defects, and reduced costs.

> The practices that help to ensure quality that are outside the triangle’s intent as a guideline

There is a chapter about that in EoSQ, where each and every practice are measured and classified by efficiency, like TDD and code reviews. It's very interesting.

> The result is that he tends towards promoting older practices that help quality but don’t have much impact on whether you’re building the right thing in the first place.

Yes. I find he puts way too much faith in "off the shelf" software as the last bullet we may have.

tl;dr Capers Jones disprove the "quality triangle" big time, which is a product of intuitive reasoning without any basis, which doesn't apply to software. Just look at Intel at this very moment.
It's a timing attack against the cache. The speculative execution might need to do a read, which means something would need to be evicted from the cache. This makes a subsequent read against that evicted adres slower.

This way you can detect things based on speculative execution. I don't know how they go from that to reading memory though.
> The problem with hate speech laws are, it means you can't insult everyone equally.

As far as I can tell, that's not true of the German law in question, though if you think it is true of that law (not some abstract hypothetical “hate speech” law straw man), please explain how, citing the relevant provisions of the law and explaining how they produce the unequal results that concern you.
Google faces new discrimination charge: paying female teachers less than men
In Douglas, CO I get five hundreths of yours for 60 dollars.
What you are writing here is a dangerous thing because it relativizes the holocaust.

Military Dictatorships don't suddenly appear out of nothing. My grandparents' generation chose to actively look away because they thought it won't get "that bad". They might have told themselfes they didn't know better - you know, afterwards - but you can't remove 6 million people out of a country of maybe 60 million and no one notices shit.

Well, it did get bad, and then some. We know that now, we can now look back and see how it began. It began with social insecurity and propaganda (populism). We can't fight social insecurity but we can fight propaganda and that is why we have § 130 Volksverhetzung.
speculation was apparently hitting very close to home allowing attackers with resources (think nation states) to start developing their own tooling. at least this early announcement allows people with sensitive data to quickly move to dedicated instances.

edit: well it didn't take a nation state after all: https://twitter.com/brainsmoke/status/948561799875502080 - given that, you can be sure that everybody who counts is frantically launching these on your clouds gathering whatever they can.
Intel also liquidated all ram fabs in the eighties, very costly process. Almost less than a year after last fab closed ram prices skyrocketed letting Japanese manufacturers grow strong.
Exactly. Remember the recent Parity wallet fiasco?

https://www.theregister.co.uk/2017/11/10/parity_280m_ethereu...
> MTA can no longer build cost-effectively. This was highlighted by the NYT just last week.

New York State government is totally broken. Although there is some outright corruption (a la bags of cash) that's not the real problem. The real problem is systematized, and legal, quasi-corruption. The rules of the game have been rigged for so long and insiders play it so well, that the general public just doesn't have any chance at all anymore.

Those insiders might be politicians, contractors, politicians, or special interest groups, but they know who they are and they are happy with how things work now. They are the reason that the state constitutional convention went down in flames. They didn't want even the smallest chance of upsetting the apple cart.
I wonder what this sentence in the Google product status page (https://support.google.com/faqs/answer/7622138) means, particularly what the inter-guest attack refers to:

"Compute Engine customers must update their virtual machine operating systems and applications so that their virtual machines are protected from intra-guest attacks and inter-guest attacks that exploit application-level vulnerabilities"
Ah, it must be serious, there's now a branded website [1] for it ;)

I believe the Intel only issue is called "Meltdown" and the second is called "Spectre"; the attack website [1] has details of both.

[1] https://meltdownattack.com/
So what you are saying is Tesla's public announcements and investor statements should not be taken as realistic?

That almost sounds illegal.
On the topic of eyebrows, many mammals (maybe most?) also have some kind of special hair above their eyes. Those of cats are very noticeable, dogs also have muscles to move them (though it might have been influenced by humans), seals, otters, hares, all kinds of very diverse animals have something that is analogue to eyebrows, which makes it very unlikely that it would just be a random feature on humans.

But it also means it might not have appeared for a specific reason in humans. It might very well have just been there and useless (but not detrimental) at one point, then used for something.
Thanks, that's really useful information. I wasn't aware that USB 2.0 switched to hardware based polling.
It's too early to say which is ultimately the most real-world serious.

From the Spectre note (which does affect AMD):

In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it.

How quickly are we going to see attacks targeting BTC/ETH wallets, apps etc. on clients and cloud hosted exchanges?
Yes. Though an allogeneic (from another person) bone marrow transplant is a high risk procedure. Some will say up to a 30% treatment related mortality.

You can cure Sickle cell disease as well with a transplant. Generally it isn't done because the risks are not worth curing a disease which has good treatment options (in HIV) or is generally a disease which can be symptomatically controlled in most patients.
Some people wanted just tax cuts, others a defender of Christianity (insert nonsense about how the U.S. is not a secular government that it was founded on Christianity), and still others wanted to stick it to Hillary Clinton and anyone who didn't hate her guts (this is called stigginit, i.e. suck it libtards you gave us Hillary we give you Trump).

But then there's the rather large number of people who just wanted something different who also lack a reasonable ability to evaluate a person's character. And all these desires and defects came at the same time as a personality who announced his flaws for all to see.. And narrow minded, blinders fully installed people voted for him anyway.

He's a bigot. He's paranoid. He's anti-intellectual, and incurious about anything other than himself. He's delusional. And he's got nukes. And this was knowable before the election.

Anyone who voted for him better hope there's no such thing as what comes around goes around in this universe. Because if there is, they're gonna get blamed disproportionate to their single and deplorable vote.
Rdio? Licensing murdered the business, really.
Actions Required to Mitigate Speculative Side-Channel Attack Techniques
Looks like the information was somewhat public available since middle of the last year on https://cyber.wtf/2017/07/28/negative-result-reading-kernel-... and http://www.cs.binghamton.edu/%7Edima/micro16.pdf. Also similar methods from 2013 paper http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf (timing side channel attacks).

Any reason for the panic now? Any know malware using it?
Not that I worry about this much, but if the fast prime generation methods we use are imperfect, then how bad is it when someone's PGP key or TLS certificate is based on nonprimes? Do black-hats ever strike gold and find out that someone's key is easily factorable? Or is there an additional property of common primality tests that their errors tend to be insignificant? (e.g., yes, this number isn't really prime, but its factors are very likely to be so large that they are also impractical to find, rather than, say, divisible by 7.)
I'll look for remaining orange/red areas and push an update later tonight. Good call on the font sizes! I used Open Sans because I wanted things to stay simple and easy to read, but it might be nice to look into something else in the future.
You also need them to be an HLA match as well as being on the bone marrow transplant register.
But that means the root user or someone with root effective privs or CAP_* to load programs into a kernel interpreter or kernel JIT. If you've given someone permission to do this from a user process you've probably opened up to more mundane issues. I suspect this is why AMD says the issue is near zero, if you've given away the keys to the kernel you're already in trouble.

AMD's ASID blocks the issues for VM guests (and root users on VM guests).
JIT engines (and compilers) often generate a familiar instruction patterns. Many JIT engines Target specific languages (like JS) and as result have "simpler" optimizers (less time to do this) and possibly more stable instruction patterns. So my money is on somebody fuzzing the required JS code.
No. This was all scheduled to be released on January 9th, but the release was sped up after people started connecting dots.

We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation.

https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
Microsoft (Security Risk Detection in AI & Research) | Senior Developer | Redmond, WA | ONSITE | Full-Time

Microsoft Security Risk Detection brings pioneering Microsoft technology for analyzing the risk from "million dollar" bugs to everyone, wrapped up in a scalable cloud service for security testing. Customers come to Microsoft Security Risk Detection to scale security assurance processes without sacrificing speed of execution. We help customers be the best they can be at analyzing the risk from insecure software so they can do more of what they love. Learn more about the service at https://www.microsoft.com/msrd.

We are looking for a talented software engineer with strong technical skills and smooth team collaboration skills to join a small team of developers working in a fast-paced environment. This position is for a highly motivated and passionate engineer who can work autonomously and provide consistent engineering execution. You will be responsible for the technical execution and overall quality for our fuzzing workflow on Linux. This entails improving the existing offering to adapt to customers’ needs as well as implementing new scenarios.

As part of the Microsoft AI + Research organization, Microsoft Security Risk Detection is creating value for customers from cutting edge Microsoft research. Our organization is working tirelessly as one to democratize access to artificial intelligence technologies that are changing the world.

Want to learn more? feel free to email me: dmolnar (at) microsoft.com . I lead the group. I am also happy to answer questions about what it's like at Microsoft generally or AI & Research specifically.

Link to full JD and official application:

https://careers.microsoft.com/jobdetails.aspx?ss=&pg=0&so=&r...
Mostly because I'm familiar with developing Chrome extensions, and appreciate the freedom and ease of distribution. I also used a bit of Javascript to rework some of the text areas, like the bar at the top. And injecting the favicon is done in JS as well.

I'll look into custom CSS extensions though! I'm not familiar with them. The repo is at https://github.com/carolinehermans/HNcute – it could definitely be organized better, I didn't expect to be sharing!