skysight-inc/HackerNews huggingface dataset:
Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what they're working on.

Meltdown however seems to be able to arbitrarily read memory (at about ~500 kB/s).

How does this work that it can read from the cache?
I... don't really see the problem with this?
Where and when can I buy a Mill CPU? This has been name-dropped in a few threads but best sources say it's been "in development" since 2003 which sounds like vaporware to me.
https://github.com/tensorflow/tensorflow/tree/r1.5/tensorflo...

> Eager execution is an experimental interface to TensorFlow that provides an imperative programming style (à la NumPy). When you enable eager execution, TensorFlow operations execute immediately; you do not execute a pre-constructed graph with Session.run().
I sometimes think it's a shame Hacker News isn't an independent startup separate from YC (or rather has to at some point turn a profit so motives for it to improve are there).

I know the MOOC is coming (?) but there are lots of things you could do with the social graph or even providing an Oauth API where you can have applications that access the interactions you have on here.
> if you get the 1TB model, your iMac Pro has two 512MB NAND banks

Looks like you meant “GB” here.
Eager execution is an experimental interface to TensorFlow that provides an imperative programming style (à la NumPy). When you enable eager execution, TensorFlow operations execute immediately; you do not execute a pre-constructed graph with Session.run().

https://github.com/tensorflow/tensorflow/tree/r1.5/tensorflo...
Made in China: New and Potentially Lifesaving Drugs
But Facebook are the good guys. They’ve even had that pride-flag avatar thing, don’t you remember?
> Exactly same what facebook does also.

My google-fu is weak - I can't find any source for Facebook providing information to ICE. Would you please help me out with some more information on this?
The SAB and clock changes are all to reduce timer precision. Reducing timer precision doesn't _fix_ the problem, but does reduce the rate of the data leak, which means it takes longer to exfiltrate the same information.

Whether this is sufficiennt mitigation depends on your threat model and the exact amount of rate reduction. For example, a leak of 1 byte per hour might be OK in some threat models but not others.
Polynomial time is unbounded. Indeed constant Time is unbounded.
How and why we teach non-engineers to use GitHub at Thread
I can relate to this. The problem is I already know how to get my work done (efficiently) in Emacs and find any change of my everyday tools to be daunting. Any advices on how to experience "what modern IDEs are capable of out of the box" without major pain?
The. “You’re descended from common criminals and so is everybody else” also holds true.

I don’t wanna know...
So far the possibility of JavaScript attacks looks the biggest concern for the normal users. (Assuming that you don't install any software from fishy sources, of course).
And cloud service and virtualization service providers are under the biggest threat.
You could have invented RISC 40 years ago!
It does a bit more than a southbridge, but it does take over all of the functionality that was traditionally in the southbridge. It's more like a cellphone architecture where the CPU is a slave to the black box that actually boots the device.

This is exactly the sort of vendor lockdown/lockout on a PC that people have been warning us about since TPMs and signed bootloaders started appearing on cell phones.
It works on JVM bytecode in classfiles and doesn't have an opinion on where it came from. Some JVM languages may be more likely to use features that aren't supported though, like reflection on classes you haven't annotated. I think we've used it on Kotlin and Scala at least.
I'm using Rust to build a PGP keyserver[0].

0: https://github.com/srct/sks-rs/
Maybe this is a good thing: policies like this are going to damage the Republicans in the midterms.

There's only so much war waged on progressive policies before more and more even right-wing types feel their toes being stepped on.
It's very likely that because this is a performance driven optimization that exposes the security hole it is at a layer beneath the microcode from how the instruction pipeline/branch prediction was working to begin with. The wiki page for Instruction Pipelining is pretty good https://en.wikipedia.org/wiki/Instruction_pipelining. There was already problems in multicore systems for false sharing/other cache issues. As far as my understanding goes microcode is only useful for the logical wiring of the various subsystems of the CPU together to perform the requested operation, but it is not generally 'inside' the actual operations (ex: at a certain point shift left one bit turns into currents through gates, and there's no microcode at that level). If you bring it to a higher level of abstraction on a particular motherboard you might be able to flash the firmware of the BIOS, and the memory controller has a known issue you may be able to use the BIOS to access it differently but for a certain class of issues if you can't change how you signal the memory controller to work around it and the memory controller is not a replaceable part you might be screwed and need a new motherboard that just doesn't have the issue which seems to be closer to what we have here.
I eat quite a lot of hard cheese, high in Vit.K2 and Vit.D, apparently; though it has a reputation for being an unhealthy luxury item. Seems the other Vit.K2 rich foods, like Salami, have similarly unhealthy images.

Natto, https://chriskresser.com/vitamin-k2-the-missing-nutrient/, apparently is a good source that I'd never heard of before AFAIR.
Arm Computer Vision and Machine Learning Library (MIT)
Sadly, in our present world stupid is dangerous because machiavellians and martyrs alike are magnetizing it with arguments that are as wrong as they are emotionally convincing.

I don’t usually do this here, as it’s not strictly substantive, but damn that’s a concise and lovely way of putting it.
Message Enrichment with Kafka Streams
But the thread's based on an invalid assumption. I posit that inventions were never "easy." They just seem that way in retrospect, from the outside.
"I wish I would understand even a fraction of the stuff that's going on with software synths." -- May I suggest trying syntorial[https://www.syntorial.com/]

If you want to create music without fiddling with UI you could also look into -- Sonic Pi[http://sonic-pi.net/] or Overtone[http://overtone.github.io/]
Extremely happy to see this happen. I had played with a little Graal/Truffle language and tried using SVM when it was closed source, but ended up setting down the project (not really because of SVM, mind you). Maybe now I can restart it. :)
Google OAuth 2 tokens are also RS256 JWTs
Dow Surges Past 25,000
The new current Taiwanese administration has not confirm that the 1992 Consensus: https://en.wikipedia.org/wiki/1992_Consensus

The Chinese government has been engaging in some saber rattling because of that.
The keywords there are “aimless” and “incremental”. I think those properties are correctly valued in any fast-paced workplace.

I think one of the things that career inventors need to overcome is selling themselves. Often the fun part is in the work of inventing, but conveying the value of the process is just as important and less straightforward.
Status of Antivirus in the World of Meltdown and Spectre
Let’s talk numbers.

There’s 250 billion stars in our Milky Way galaxy. Our local supercluster has 100,000 galaxies in it. Previous estimates were that there are 100-200 Billion galaxies in the observable universe and this article suggests the figure is 10x as much as that.

The Kepler telescope has been discovering planets around nearby stars for a while now, and the impression we get are that at least half of the stars seem to have planets around them.

With 250 Billion stars in our galaxy and 200 Billion galaxies or more just in the observable universe (also cosmologists believe the actual universe is larger than the observable universe by an unknown amount), that leaves us with somewhere in the neighborhood of 25 Billion trillion (that is, 25 Billion * 1 trillion) planets in the observable universe. 100 Billion + worlds just in our galaxy.

We also believe that the laws of physics are the same across the universe and that water and other basic elements are abundant throughout the universe.

So to me it seems like even with extremely remote probabilities of life existing, to me it seems most likely that there would be lots of planets where life started.
Well it's a violation of their own privacy policy, which is why the Wa. state AG is suing them:

From: https://www.motel6.com/en/faq.html | https://web.archive.org/web/20171124044157/https://www.motel6.com/en/faq.html
What we will and will not do with Guest Information

1. We will not sell trade or rent Guest Information to
parties outside the Company, our franchisees and affiliates,
or permit our affiliates to sell such information to parties
outside of our group of companies, franchisees and affiliates.
Hmm, interesting question. On the hand JITs do devirtualization, so that on lots of code paths the indirect calls are replaced with direct ones. Which should mitigate the performance issues. However I think the JITs also need to insert the logic and branches for re-jitting and spectreulative execution. These might be additional indirect calls.

Would be interesting how it balances out in total.
I think "public key" as in "asymmetric cryptography with public key."
For the owners of vast numbers of systems that cannot be updated, the consequences will be worse: they will remain vulnerable to a set of vulnerabilities with known exploits.

Fortunately, chances are that those systems are stable, isolated environments which won't be running any new and untrusted code either. That means they will just remain vulnerable in the same way that everyone knows their houses can always be broken into by a determined-enough attacker; to try to achieve 100% security, to close all the side-channels, may be impossible and have plenty of other negative effects.

Sometimes, just knowing is enough because it leads to more informed risk analysis and decisions. That saying about "known knowns, known unknowns, and unknown unknowns" comes to mind.
Anyone know the implications to the security of the crypto currencies? Are they highly prone to theft now?
Or T2 is like the Fat Agnus, Denise, and Paula chips all rolled into one, similar to the Amiga. Everything new is just recycled from the past.
You mean this one? https://itunes.apple.com/us/podcast/the-civil-war-and-recons...
Also to Google for finding and documenting it so well. Google security team really should be given an award.
Botoku: Heroku for chatbots
Yes, but the T2 has much more control over the boot process and hardware. The T1 was relatively isolated, communicating with the rest of the computer only for Touch Bar related stuff, and verifying data in the Secure Enclave.
How many data scientists are interested in deploying their own models? And how many of you would learn docker in order to do so?
What methods exist for safe disposal of heavy metals?
>Apple needs to work on making it as automatic and invisible as possible for this to happen to everyone's machine even if they're tech illiterate.

I suppose there's some degree of tech literacy required just to know that you should have a backup. But, honestly, Time Machine is probably the easiest backup system I'm aware of and I run all three major operating systems including running a cloud backup on my desktop Mac.

If I were to point a finger at anyone, it would be Microsoft. (I don't really expect Linux to be drop-dead simple.) On Windows 10, it's still not really "just works" out of the box.
Not sure if there is any research, but I have noticed that younger people seem to be more open to talking about mental illnesses like depression. I have even seen people on Twitch talking about their illness to the chat! That was unthinkable in my day, and I'm only in my low 30's.

If there is less stigma in admitting it, people are going to come forward more. Thus more cases are recorded. Which is good, as then they can get help. I remember people saying you need to see a shrink as an insult. Imagine people making fun of you for seeing a doctor about your broken leg!
I don’t know what the OSX protection was, but that’s probably Meltdown. Meltdown = using native code to read kernel/system memory.

Spectre is the one that can be done with JS.
Because there are additional features coming soon: following users - and notifying a person they are being followed, subscribing to topics/websites/etc.

Following a user and them being notified requires a hacker news username to be verified, so we aren't sending out 40 emails that "tw1010 is being followed by jermaustin1" when the only person who cares would be the real tw1010.
The challenges of blue/green deployment with AWS Lambda and CloudFormation
My guess is at least one exchanger will run away with coins and blame it on the CPU vulnerability being exploited.
Blond/red hair doesnt make you viking. But being black or asian does make it extreemly unlikely, just as being blond makes it extreemly unlikely that your paternal great-grandfather was an african king.

With the viking thing, mapping blond hair in the uk, along with family/place names, creates a diagram of the 1066 invasion.
That's what I was trying to say a bit more tongue in cheek...
Google hires in UX roles: https://careers.google.com/fields-of-work/design/

If you think you have talent in that area you could spend the next two years working in that area, then apply
Here be filing:

http://agportal-s3bucket.s3.amazonaws.com/uploadedfiles/Anot...

Apparently Washington has a "Consumer Protection Act" that makes deceptive practices illegal and a "Washington Law Against Discrimination" that includes "anti-discrimination protections in places of public accommodation".
> I cannot recommend purchase of any machines based on the Intel Core 2

Does this also apply to Core 2 successors: i3, i5, i7, M?
> The article mentions the memory comes in two banks. Is it replaceable, or is it soldered to the board?

Depends on your definition of replaceable. Apple can do it, and you can too, since it’s not soldered onto the motherboard. However, you’d have to open up most of the computer and remove the display, which is “unsupported” by Apple.
> I had a very low vitamin D serum value. //

How did you test it? Are there companies who do a wide range of basic tests for common vitamin deficiencies? Like can I send a sample and them say "you're a bit low in D and marginal in A", or whatever?
Admins: why did you take this down? The previous submission didn't get any attention and this had some good discussion.
tptacek was saying everyone should be cautious about PKI-based JWTs and provided encrypted cookies as an example of something that is rarely (if ever) implemented safely and securely with PKI cryptography. My point is that while the 'seal' function of PAST may be of questionable value, the 'sign' function is not. I think it's important to disambiguate those two uses of asymmetric cryptography.
I think something like universal basic income might be an example. This gives people a little more security to improve their education or be entrepreneurial. Ultimately, this ought to give them improved probability of upward mobility with less risk of downward mobility.
I Know Where You've Been: Digital Spying and Divorce in the Smartphone Age
> It's possible life evolved many times on earth

It's also possible it evolved elsewhere and rode here on a meteor - or was brought here by some other lifeform several orders of magnitude more advanced than us, using earth as their own cosmic terrarium.
When I bought a 2016 MacBook Pro, I was expecting to buy an external GPU + an nVidia card so I could do deep learning/video gaming.

Unfortunately, using nVidia GPUs with a Mac is still fussy even in High Sierra. And with the GPU instance price drops making deep learning pay-as-you-go super affordable, it's no longer worth the physical investment in a card, especially because they depreciate quickly.
I can't think of any cryptocurrency-specific attack vectors off the top of my head. But if malicious Javascript code can use Spectre to escape the browser sandbox, then wallet private keys are potentially vulnerable, just like everything else on the machine.
If your crypto coin lives on a box connected to the internet you're living dangerously. That said, I live dangerously too.
Not if you use a hardware wallet (Ledger or TREZOR). If you're using a web (Coinbase) or desktop wallet, you might be at risk. In reality, it's pretty unlikely to be exploited.

Someone could steal your login credentials for any web service, but the risk is mitigated if you use 2FA, or some sort of IP whitelisting.
So you can do a code review on the entire Linux codebase and you are skilled enough to find any security vulnerability? Can the person you hire do it? Would they have found the Heartbleed issue that was in open source code for at least two years?
Possibly. I don't recall when I first noticed it and I hit the downvote karma threshold a few years ago so there's a good chance they're accessible at the same time.
Intel Issues Updates to Protect Systems from Security Exploits
Google displays Ada for money. It doesn't sell your data, it rents out your eyeballs
Everything is vulnerable to Spectre.
> I guess everyone is forced to believe something un-provable about life

> Looking at all of those galaxies forces you to come to terms with how little any of us really know for sure.

Only if you are forced to look at all that - in detail - and since that's not essential to a mundane life, there is no obligation to believe anything much.

I mean, I'm trying to make a point about believe in distinction to knowledge. There is yet a weaker modus operandi, which I'd call awareness for now, but that's a loaded term, too. If you hold two thoughts about contradicting possibilities in mind at the same time, that's not believe. Believe happens when externalities force a decision, also called leap of faith. Then you choose to believe in one possibility. Knowledge on the other hand means the possibility of round about 1.
Interplanetary Embassy – build your own non fungable planet token
Well you're being rather disingenuous. Those exact terms [1] also include:

Compliance with Law

This is a United States Site and is subject to the laws of the United States.
We may disclose Guest Information to law enforcement agencies, or may be
required to disclose it during the discovery process in litigation, pursuant to a
court order, or in compliance with any applicable law, regulation, rule or ordinance.

[1] - https://www.motel6.com/en/faq.html
> Should possession of 100 lbs of weapons grade uranium be a crime?

Not that I know much about these things but from a distance I don't think possession should be a crime even in this case. Of course, you need to follow proper procedure to store it.

I am more concerned with where they obtained the said material, who supplied it to them, who produced it and so on.
Like cryptokitties but with planets.
FWIW: Historically, such statements have not been viewed in other jurisdictions or courts to mean they could not/would not provide information to LEOs.

IN fact, this very privacy policy also includes the standard term that they may disclose info to LEO's, you just omitted it.
Koneksa Health

Full Time in NYC only
Write short cover letter to 'Allan'.

Lead Senior DevOps
http://koneksa.applytojob.com/apply/VKpGmyTuMs/Senior-Dev-Op...

Lead Data Engineer / Software Engineer
http://koneksa.applytojob.com/apply/F1iFQVd6mF/Senior-Data-E...
No, even with the second sentence it is still borderline. According to regular case law of the Federal Constitutional Court the most charitable interpretation needs to be taken. Without the second sentence this is a factual statement (even though extremely worded, it has happened at least once on New Year's Eve 2016) and transports a political statement. No court would do anything about that.

Twitter has nonetheless removed a very similarly worded tweet by a member of parliament.
That's called no integration. It's a conglomerate.
There’s no way they can do this in the foreseeable future, since they need to continue to support current Macs without T2 as well.
It's impossible to read the article because of the ads.
I cannot tell from the photos, but sadly I bet they didn't return the far superior 7-row keyboard to us stalwart ThinkPad owners.

The latest (sucky) layout doesn't even have a Fn toggle to use a 10-key numeric overlay so using extended (ALT+<n> chars) practically impossible. And no Pause/Break key kills me. Every. Single. Day. </rant>

Tip: If you're shopping/researching Thinkpads (or any consumer Lenovo gear), the "Product Specifications Reference" — aka 'PSREF' — documents are the bee's knees. (Last rev. was 20 Dec 2017, so this new stuff is not yet listed.). Link, http://psref.lenovo.com/
The analogy holds better when humans are transistors, not cores.
What happens when you use that wallet by plugging it into the computer, or by entering its information on a computer to perform a transaction?

People say "Hardware wallet" like it's a magic incantation.
Except for when they forgot to require a password for root access to her OS...
He says "mainboard", so it's fair to assume the computer would not be bootable in this scenario, which precludes the use of Target Disk Mode.
A list of artificial intelligence tools you can use today
The low hanging fruit to mitigate Spectre would be to flush cache lines which were touched by false-speculation branch executions. Of course there'd be possible interaction with other, truly executed code hitting the same cache line.

Iff the microcode had instructions for cache line state manipulation it would be possible to emit µOps flushing cache lines touched in the other branch when merging with the true branch.

However this mitigation would only be possible if there were µOps for doing that and the instruction decoder was powerfull enough to do this kind of thing. Eventually we'll likely see silicon in which cache lines get additional status bits that keep track by which OOE engine the data was fetched and after branch merging flush all cache lines not matching the taken branch.
Maybe just change "agnostic" to "neutral": PNST? "Independent" is probably better, but PIST may not be so great a choice (:
This network was trained using an adversarial approach. What that means is that a second network that does exactly what you say was used to train the first.

They kept training until they created images that could reliably fool the discriminator. A more powerful discriminator would just be used to create better fakes.
Apple addresses the (known) vulnerabilities in the 10.13.2 and 10.13.3 updates.
Hate to be the bearer of bad news, but nearly every hotel/motel shares information with some subset of law enforcement themed agencies, regardless of what their "privacy policy" says on paper.

e.g. Why do you have to write down your car's plate number, by law, if you pay cash for a hotel room? So the law can find you when you're on the run and therefore not using a credit card, of course. This is law enforcement 101, one of the oldest tricks in the book.

It's not just ICE, there must be literally dozens of three letter agencies privy to the same information from Motel 6 and its competitors.