skysight-inc/HackerNews huggingface dataset:
As with cryptography, it's probably dangerous to "roll your own random" if the randomness matters. The author already mentions both the point about cryptography, and the dangers of plausibility arguments about randomness: an intuitively plausible way of picking a random point from a sphere doesn't give a uniform distribution.

Playing around with distributions as the author does is surely fine if you just want to get something that "feels right", but if the applications depend on precise randomness properties, then, for example, "let's just multiply these two PDFs" is dangerous (not least because the result is almost guaranteed not to be a PDF, and may not even be normaliseable to one).

Although it surely won't be applied for random f (no pun intended), the transformation from P(f(u) ≤ x) to P(u ≤ f^(-1)(x)) relies very much on f being (strictly, in order to have an inverse) increasing—so it's even dangerous to use f(x) = x^2 if we don't know that u is non-negative-valued.
Monty Hall Problem: What Door to Pick?
Yes. The reference manuals for the cores indicate that they all do.

rpi 1: http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/dd...

rpi 2: http://infocenter.arm.com/help/topic/com.arm.doc.ddi0464d/DD...

rpi 3: http://infocenter.arm.com/help/topic/com.arm.doc.ddi0500d/DD...

As others have indicated further down, though, it won't open up much of a vulnerability unless they are speculatively fetching memory.
Is an Abakus Turing-complete?
A harbinger: https://www.theguardian.com/global-development/2018/jan/04/b...

There are no waves of violence washing towards developed nations from Bangladesh. But it's going to come at some stage, from some similar quarter, and will hardly be unjustified. They are paying the price for 'our' insatiable greed.
I know the annoyance you're talking about, but I think you're better off wrapping sort(1) with something translates from column names to indexes. Among the reasons: sortcsv buffers all input into memory [1], while sort(1) uses a divide-and-conquer merge sort to avoid this.

[1] https://github.com/johnweldon/sortcsv/blob/55818bd8e5f9feecc...
These sorts of articles always remind me of “We take security seriously”, otherwise known as “We didn’t take it seriously enough”: https://www.troyhunt.com/we-take-security-seriously-otherwis...
I agree, this is a misleading use of the word "true". It's more like "relatively true RNG" than "true".
If theres nothing to hide why get all bunched about it brah?
The memory access could potentially take a very long time, so it makes sense to start it as early as possible, in parallel with all the other operations. Saving a few cycles on each memory access adds up significantly overall.
Isn't it a reasonable request though to demand of university researchers funded by public dollars to be required to publish freely to the public since the public payed for it? Also they can double publish, it could be more of a "all papers are published here for public archival purposes but you can still submit to the journals you want." sort of thing.

The status quo is absolutely unnaceptable.
huh? the author of the article isn't a developer.
Maintain Context in Bot Conversations
More specifically, Elsevier has high impact factor journals. Somebody had the shitty idea to "rate" scientists "objectively" using some naive version of PageRank (rank = impact factor). Scientists, being scientists, aren't stupid and invented the equivalent of SEO, only there is no Google to tweak the algorithm in response to SEO-spam. Spamming publications of just acceptable quality for high impact factor journals is now a winning strategy for getting tenure, grants etc. Happy sciencing.
HP Announces Kaby Lake Chromebox
Glad to hear this!

It's a complicated problem. In classical music, ContentID has a hard time differentiating between various recordings of say the Goldberg Variations. People were getting dozens of ContentID matches from Glenn Gould, Andras Schiff, and so forth, and each time they'd dispute the claim, the next one would come with a different recording. Nobody was doing anything nefarious, but you couldn't get any peace. Soe we (Kimiko and myself) decided to put her music into ContentID ourselves. Now it mostly identifies correctly as Kimiko's recordings, and people can ask us (robert@opengoldbergvariaitons.org) to de-monetize any video where the ads bother them. Some people don't mind, and as a result, Kimiko gets a small amount of revenue for her work as well.
Is this good news for AWS? Some customers will be forced to upgrade to a larger instance.
Great answer!
visjs.org can render graphs using canvas : http://visjs.org/network_examples.html
Well, we need a way to do this with FPGAs.
Presumably would be $233T less the interest rate that the debt was lent at, right?

So if the average debt is created with a 4% interest rate, there is ~ $9 Trillion more in debt than there is in savings. That's almost half the entire market cap of the S&P 500. Unsettling.
To be fair, if getting through the documentation for a feature is tough, then engaging in the discussion about its performance and the potential impacts of these recent mitigations will be much, much more difficult.
That’s easy for you to say. You’re not the person having to admit to a billion dollar mistake.

Everybody stalls for time when the stakes are this high. How long can I reasonably spend tying to turn this into a small problem before I have to go public with it?

Saying it’s a bigger problem than it turns out to be is a PR nightmare of its own. If there was a cheap fix then you cried wolf and killed your reputation just as dead.
https://en.wikipedia.org/wiki/Confused_deputy_problem

That said, I don't think it's good label for what's going on.
So your friend is benevolent enough to not trigger the bug again because it would be wrong, but not benevolent enough to report the bug to Coinbase? Right...
>seems to be to be problematically obvious.

Agreed, it's so painfully obvious it's problematic. Human psychology has an interesting habit of ignoring obvious painful truths, as Margaret Heffernan details in Willful Blindness: Why We Ignore the Obvious at Our Peril[1].

"We turn a blind eye in order to feel safe, to avoid conflict, to reduce anxiety, and to protect prestige. But greater understanding leads to solutions, and Heffernan shows how-by challenging our biases, encouraging debate, discouraging conformity, and not backing away from difficult or complicated problems-we can be more mindful of what's going on around us and be proactive instead of reactive."

>if it's correct, too much would follow

Precisely why we subconsciously ignore difficult truths, because confronting them would require surmounting seemingly insurmountable obstacles.

[1]https://www.amazon.com/Willful-Blindness-Ignore-Obvious-Peri...
That's a good point. I may consider a stand alone utility to wrap this[1] code that converts names to indexes.

[1] https://github.com/johnweldon/sortcsv/blob/master/main.go#L1...
Indian-American born and brought up in the States.

We never discussed caste. It was a non-issue.

Prime Minister Modi is also Low Caste. That didn't stop him from being elected.
Show HN: 1 Word, 1 Site Is Aiming to Be the Global Registry for 1 Word Branding
Lol. If that's true (and I'm not disputing it) then how would switching to MySQL fix that problem?
Matt Dillon: Intel Meltdown bug mitigation in master, performance effects
Matt Dillon hardly needs an introduction, however, I'd just like to point out that he's one of the few folks that I trust on estimating these CPU bugs, as back in 2012, he actually found a bug in AMD CPUs that resulted in an erratum from the vendor:

* http://www.dragonflybsd.org/mailarchive/kernel/2012-03/msg00...

* http://www.theregister.co.uk/2012/03/07/amd_opteron_bug_drag...

He was also involved in providing a public analysis of the Intel Core bugs back in 2007:

* http://undeadly.org/cgi?action=article&sid=20070630105416
We've updated the title from “Apple retracts confirmation that Meltdown is fixed in 10.12 and 10.11”, which is the sort of thing that makes a fine initial comment but not what the guidelines ask for headlines.
I know Apple doesn't have divisions, but would it seriously harm the brand to have a B team keeping the Mac Mini (and other established products) updated?
It is totally awful, but I wouldn't say you can't be productive. Speech-to-text is good enough now that you could substitute it for typing. It won't be as fast, obviously, but that's not an insurmountable obstacle.
...nor are 486s, 386s, AVRs, 8051s, and a bunch of other low-performance in-order CPUs.

There's also this...
https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...
If this was the case, could one observe such a trend already in places with proper public transport (light rail etc)?
I suspect that commuting traffic will increase to eliminate this advantage. Already in major metros, long commutes suffer low speeds due to congestion during rush hour periods. Without a commensurately vast increase in infrastructure investment, I do not foresee a significant change in commute experiences from self-driving cars.

I predict that most people would not elect to live 2 hours away from offices despite being able to have access to entertainment and work while commuting.

The evidence is already here: various tech companies run shuttles to far-flung areas (Google has shuttle service from Stockton to Mountain View), yet employees aren’t moving to these lower-cost areas in large numbers.

Workers with families will have upper bounds to how long a commute they’ll endure. Their families are more important to them than being able to have entertainment, and meeting times limit the amount of time that can be used for work done while commuting. At that point, it’s approaching remote work, which is a promising idea, but isn’t a solution for long commutes by itself.

I see self-driving cars changing last-mile and replacing hub-and-spoke commutes as a replacement to taxi services and short-distance shuttles.
In an in-order CPU, you can still use a branch predictor to predict what to fetch and decode, so that you don't stall waiting for instruction fetch to finish after you resolve the branch.

In practice, advanced in-order designs contain more local reordering mechanisms, e.g. in the load/store unit, but they lack the unified global abstraction of a reorder buffer. The most successful timing attacks involve a mis-speculated load, so they wouldn't apply to these mechanisms, but it's not completely out of the question that they are also an effective side-channel.
I remember some broken SSL certs generated during boot of some routers.
I doubt Indians in the US, especially the ones who grew up here would be participating in any type of caste "system", but people in the lower or lowest castes wouldn't be in the US in the first place due to lack of resources.

It's more about your education level and how useful you are than who your ancestors were, but that is many times intertwined.

Edit: India, like most places, is in the middle of re-drawing it's caste system along socioeconomic lines. Of course, the lower castes will still be on the bottom and possibly discriminated against due to being behind on resources being passed down to them.
I once swapped out a counter-based distributed routing system where the counters were not synchronizing quickly enough between nodes, with an RNG-based one. It worked well for months until one fateful weekend when the client called in a panic, the distribution was going 100% one way causing a terrible catastrophe for them. It turned out the system was working properly but the RNG had a very long, extremely unlikely yet technically possible run of low numbers. To try and recover they had changed the weights from 20% to 80% and finally 99% to no avail, the RNG was dead set on fucking shit up that day and the day ended in disaster.

moral of the story: behind every RNG Cthulhu waits, sleeping.
I think there is a lot to be gained by creating better systems for searching and synthesizing diverse pieces of biomedical knowledge. But indeed this is mostly a field of research, rather than something that could be directly marketed. Did you think about going (back) into academic research?
Only 10 to 20% of programmers are women. Doesn't that justify the mention?
I can see from your profile that your account is "half troll", and there is not really room for troll accounts on HN, while we do value legitimate "devil's advocate" or contrary positions. This is how we maintain our level of discourse.

In the old days of the internet, asking for anything searchable is the action of last resort, and generally considered quite rude unless truly unfindable or incomprehensible. Taking action on one's own intellectual curiosity is invaluable for education.
I completely agree this is a stupid system that profits mainly Elsevier and other toxic journals. But this still seems to me to be a step in the right direction compared to before, when researchers were not obliged to public their publicly-funded research publicly. Now they are, which is the way it always should have been.

It seems to me that the current peer review model is dying anyway, and new technology (especially the web) is slowly but surely killing it, especially in the fields of computing science and mathematics. I commend Germany's approach, but I don't think the UK's approach was a complete disaster.
I think you're missing that the misdirection happens in the kernel. On an indirect branch (i.e. "jmp <register>") the CPU picks a value for <register> from a small cache when speculatively executing, since the real value isn't known. A malicious program can fill the small cache with addresses of kernel code that do some computation with kernel data and then depending on the result, touch different parts of user application memory.

There is no memory protection violation because it happens in the kernel; obviously, the kernel can read its own memory.
> Lol. If that's true (and I'm not disputing it) then how would switching to MySQL fix that problem?

It's explained in the blog the great-grandparent linked:

https://eng.uber.com/mysql-migration/
They might mean the often long hours. The "death marches" that have been written about here:

https://www.amazon.com/Death-March-Developers-Impossible-199...
Not that I know of.

But you can see the term of the day, "translator", here[0][1], and it isn't much of a leap to see how that evolved into translator-compiler, and then shortened itself.

[0] XLT86, 8080 to 8086 Translator http://www.s100computers.com/Software%20Folder/Assembler%20C...

[1] Pg. 47, Trans Z80 to 8086 Translator http://www.patersontech.com/dos/Docs/86_Dos_usr_03.pdf
Writes in postgres touch all indexes. When you index every column, you have to touch every column's index for every write.

Writes in MySQL (using InnoDB) just touch the pkey index, to which all other indexes point, or something like that. (Can someone who knows MySQL innards better — I avoid it like it's contagious — please confirm or clarify?)
Thank you for that perspective - that makes sense. I hope there is an easy way to pin an entire site and not page-by-page so, for example, a full documentation set could be kept.
Back in a college graphics class I had a lot of fun, and some lucky success, with roughly simulating watercolors with GL shaders. I kept several textures that represented the paper, it's wetness, and the paint. The shader would calculate new states for each based on the previous state, time and user input.

The cool thing was that you could watch the paint disperse in real time and could add things like gravity to cause it to drip down the page.

It wasn't physically that accurate, but it looked pretty good and was super fun to hack on. If only I could find the source :(
Why so? I see this written quite a bit, but it doesn't square with what my phys undergrad...

There are many sources of truly random events (as in quantum), including tunneling in diodes.

Then there are chaotic systems which are good enough to be random. There, even in a deterministic universe (it doesn't appear to be) and given infinite amount of computational power (impossible), you'd still be unable predict the future (due to measurement error).

TRNG are hard to do correctly, but why are they limited to geiger counters and radioactive mtls? Is it because you can't "hack" the nuclear core (not exactly true, but sure)? Again that would be a doing the TRNG right, not a lack of randomness in physical systems.
I do AI-related analysis inside the pharma world, on the image/data side. While I employ numerous traditional analytical methods to extract info from images, few are as sexy as deep learning (though that approach is rising in day-to-day utility in bio-imaging) or most ML/PR approaches. How much ROI benefit is there to devising a higher level of performance or adaptation? And do we have enough data to train from?

Often it's more productive to simply throw in a bunch of bias early and use a closed form method that's familiar, sufficient, quantified, straightforward, and interpretable. This becomes all the more likely when the quantity and quality of training data is limited or variable. Scientists we serve aren't especially keen for us to play around with cool new toys when they're on a tight schedule.

That said, there do exist a number of problems that are so noisy or contain so many signals that finding some sort of low bias method that's also domain agnostic could be a big win. Fortunately these kinds of problems are famously hard (like protein conformation prediction, or 3D shape modeling) so if we can make even a little improvement over the status quo using DL/ML, our scientists are usually willing to put up with the higher costs (and often lower punctuality) in our development of novel learned methods.

Often scientists want to play around with new tech too. Working with them to exploring novel approaches (like deep learning) to serve their projects' "stretch objectives" is sometimes an opportunity for us both to get ambitious and try out something new.
Most modern Indians don't have such a strong affinity to their caste but it still plays a role in their lives. Indians who moved to the US don't usually group based on their caste but in India it is still the case, especially in rural areas. Politics in India are divided along caste lines and you see all sorts of things like these, which are usually politically motivated. I can't comment on whether this particular incident is politically motivated as well.
Right, but at a cost of a leaky cache abstraction. Which is now hugely expensive to work around, making me question how that ever got approved if the security model was clearly leaking at that point (which has been known for the entirety of speculative execution, right?)
Modeling GraphQL Type Modifiers with GADTs
Probably not, since being a male programmer is hardly unique in any way. Probably should pick a different angle for your story.
“Meltdown”/“Spectre” and Pale Moon/Basilisk
Retrospective on leaving academia for industry data science
Few people probably use Windows for its own merits but rather because it's either required in order to be able to use a specific software or mandated by the environment you're working in. There are better alternatives (macOS and Linux being the most widely used ones) but you can't always use those.
Location: New York City, NY

Remote: Willing to consider

Willing to relocate: No

Technologies: C++, C, Python, Java, PHP, SQL, HTML/CSS, Javascript, Windows, Linux, Git, GUI design, technical writing

Résumé/CV: https://www.linkedin.com/in/remyoukaour/

GitHub: https://github.com/roukaour/

Email: remy.oukaour@gmail.com

I left Stony Brook University in 2017 with a Master's in Computer Science, and am currently seeking a software development position. I'm open to contract, part-time, or full-time opportunities. I care about writing code that's not just correct, but documented for the developers' sake and designed for the users' sake.
How should your company handle version control?
Uber's explanation of the problem neglects to consider their poor usage of the tool as contributory to the problem.
Thank you for that link! I'll write out the conclusion I came too from reading those comments:

Instead of measuring the literal time interval between instructions, the number of cycles between two points is measured (using the RDTSCP instruction).
I'm not against space exploration, but it's interesting to me that while we wonder about life on other planets, and dream of placing our own lives there, most of our own planet's life (which could help provide cures for all kinds of ailments) remains undiscovered.
I'm abusing the term, I know. But the idea is simple, right? Even a minuscule update to the kernel entropy pool makes a previously compromised state unusable. So you don't want your CSPRNG to just be a bit generator, like HMAC or CTR.

(Zvi Gutterman refers to the property I'm talking about as "backwards security", so my abuse of the term is particularly egregious).
Avoiding having to empty the instruction pipeline when a branch happens and restart. My favorite simple video explaining pipeline is still this old Apple one from back in the early 2000s:

https://youtu.be/PKF9GOE2q38?t=237
Absolutely, always wanted to finish my Epidemiology PhD. But eeh the pay is awful. Not that I /really/ care, but that's getting into personal details. Still, whatever I could come up with now would not be much different than what I would come up with during academic research. The machine in my head is working regardless.
Preserving minutiae for future archaeologists is a bold and exciting idea which should be funded and pursued. It is not however, the mission of the LoC.

Edit: not to mention that I think you have a far too rosy view of the world we’ll be leaving for people 100 years from now.
It is used to determine which instructions to fetch and decode, so that you don't have to wait until the branch is resolved to query the instruction cache, instruction TLB, MMU, DRAM, etc. If the branch was mispredicted, you have to stall to wait for this to complete.
> my property tax burden is like 10x the developer

Care to elaborate? Why would that be the case?
> unintended language contradictions are common

Yes, definitely true. Although some contexts, like a security disclosure, might warrant a very carefully non-contradictory worded statement that leaves no doubts of interpretation.

> the language can also indicate potential false positives, again because of the nuances of language.

Yes, but in this context, false-positive aren't important to the audience of the disclosure. Nobody really cares if their account was "identified as affected, but in the end wasn't".

If you announce that 1% of your user base was affected, and it turns out that 50% of this 1% were false-positive, great! You were still right in announcing that 1% of your user base was affected. You can always correct this later and announce that things panned out better and only 0.5% of your users were impacted.