skysight-inc/HackerNews huggingface dataset:
I think there's a huge benefit to talking about the ad problem here. One of the reasons it is hard for linking/quoting Stallman to actually get you anywhere in discussion is that the Stallman view is one of absolute philosophy. "This is philosophically wrong" is not something the average consumer cares about, just like privacy invasion is a ghost nobody cares about until they see its effects. Things like convenience and things being free are very visible, noticeable traits, and the counter to those arguments need to also be visible.

Advertising is a very visible effect of both privacy-invasive systems and proprietary software. People care about how ads affect them because they can see it.
Thanks! I see. So it seems like the program basically has to capture sensitive data while it is in I/O transfer (and hence in kernel memory) just at the right time, right? Which is annoying and might need a bit of luck, but still possible.

Incidentally, this seems to indicate that zero-copy I/O is actually a security improvement as well, not just a performance improvement?
But the potential harm from driving is very clear. The worst case scenario hits more than 30,000 people every year in the US. Smart people can calculate a dollar cost to that damage.

What's the worst case scenario from having an Echo? How many people does it affect each year? What's the dollar cost of that damage?
https://lkml.org/lkml/2017/12/27/2

It makes reference to the nature of the bug and explains why AMD's chips are not affected (from an AMD engineer).
I have no JS and I can see the images fine.
Well, my thoughts have been that space related efforts have high costs because they must be engineered to extremes. Software, hardware, human processes & standards all must be of a high reliability and quality due to the requirements of the operating environment. That usually translates into expenses and demands that are higher than most terrestrial ventures. But that is an assumption (or gut instinct) and not necessarily a fact.

I am sure that the space industry has a wide range of needs, and maybe some of those needs are "less expensive/lower barrier to entry" to work on if they are related to something where the operating environment is controlled, well-understood or known.

Depending on what you mean by the term "IT", you could mean just computer/networking technology, or you might mean everything related, information systems too. If you mean everything related, we have to consider what remains after we remove that from the set of candidate work. To some extent, I am not sure how one can "get out of IT" and work in space (or any other industry) since IT/IS is the backbone of almost everything these days.

What remains? Well, maybe things like: mechanical/structural/electrical engineering, architecture, healthcare, science, research, operations, processes and standards, agriculture, a wide variety of arts/crafting...

I'm not trying to be disparaging - anything if that (I have been asking myself how to get into space too) - but I'm trying to figure out, what is there to do in space that isn't related to IT/IS in some way.

Could you be a pilot or astronaut (operations)? Could you be a biologist, chemist, etc.? That might combine your interests in biotech with your interests in space. Maybe you could go do research on synthetic biology in space, for example (and be the first to "invent" new extraterrestrial life forms!).

I am sure you'll figure it out, and good on you for trying! I still haven't figured out where to start to get into space, myself. But I also have a ton of diverse interests which make it hard to focus on any one (especially with a day job).
Your typical system has a rather large number of pieces that rely on that protection against read access in order to keep an attacker from obtaining information that would allow malicious corruption, modification, and deletion of data. Intel are being weaselly.
This is the homeopathic theory of government intervention: the much-less-government Belle Epoque had greater wealth concentration than a century later because government still intervened some in 1875. The lower the concentration of government, the more potent grows its poison, as libertarians attribute society's problems to this diminished residual. If things aren't better following government reduction, the solution must be to shrink it further, not to reconsider the theory.

People still peddling revolutionary communism have a parallel homeopathic theory about capitalism. Bring up a bunch of empirically observed problems in the former USSR and they'll go "Oh, those 20th century 'communist' societies were state capitalist, not real communists; the problem was that they didn't get rid of capitalism enough. Under Real Communism we'd have all the good stuff and none of the bad."

It's not very convincing.
Ask HN: Tiny, silent workstations that can do 4K60Hz?
I'm looking to move to a 4K setup, but would like to have a completely silent, fanless (even if low-powered), compact PC for local development (think vim/VSCode/Firefox/Thunderbird) and remote access to cloud servers. I've been researching thin clients and "media" PCs like the Mele PCG35 (which can nominally do 4K@60Hz with integrated graphics), and would like to know if anyone has a working setup/hardware config along these lines.
This Small Device Could Silence the Maddening Symptoms of Tinnitus
This is actually happening.

BART is going to San Jose. It will go to San Jose Diridon thus completing the loop. It will take longer than everybody likes and probably cost more money than was originally budgeted, but it's going to happen.
While dependency management is still an ongoing pain, it is miles ahead of Rails just for the fact that they are compile time dependencies. Last time I was responsible for deploying a Rails app the standard deployment method was to pull and build the gems on the production system as part of the deployment. Before Docker solved this I always thought of dependency management as one of Ruby/Rails weaker points.
Social science has observed that race has real implications in a society. http://archive.boston.com/news/globe/ideas/articles/2007/08/...

Are you saying that it's beyond the pale to even have a conversation about diversity and immigration policy? Are you assuming that an inflow of people from anywhere in the world is always good or neutral?
> This is exactly the moral dilemma with free speech vs hate speech

Two societies chose different paths, each--in my opinion--appropriate for their circumstances. In America, we have the First Amendment. In Germany, they have Volksverhetzung [1]. The problem is Twitter, Facebook, et al think shipping information across borders is the same as shipping boxes.

[1] https://en.wikipedia.org/wiki/Volksverhetzung
you will get a kick reading Nietzsche biography.
Uh... they don’t say the exploits don’t allow for READING of data...

That’s the most concerning thing then
While I agree with most of the analysis, I don’t see any issue with the “operating as designed”. I mean, it is operating as designed. Really, I think they screwed up here. Instead of saying it’s an accident or a mistake, they are saying it’s the result of a careful and deliberate design choice.

That is lawsuit fodder.
Requests like these are better sent to hn@ycombinator.com, but note that they simply won't reply to you if they get busy or don't feel like it.

From my testing, HN has various anti-abuse features to prevent people from creating accounts to dodge bans or moderation penalties. E.g. if you create an account using Opera's VPN, your account's comments will all show up as [dead].

Perhaps they believe that there's no valid reason to use a VPN to check HN other than to dodge penalties. Either way, it's important to remember that we don't see the good things that come of choices like this.

(Or that it's just a random bug.)
Lotteries can be a very rational way to distribute resources broadly. In an emergency situation where several people need a resource but there is only a limited amount available randomly distributing the resource is the fairest and the most rational way to get it to those in need in order to prevent other activities such as hoarding, scalping and favoritism.
Integrating Bootstrap 4 into Your Laravel Application
You should reach out to him and see if he would be willing to do a AMA about this (aka if you know him well enough); even if it wasn't successful I'm sure many people would like to know the details and have their questions answered.
I don't understand this code. Can you explain?

does this mean a branch can be incorrectly bypassed?
>Why the U.S. Spends So Much More Than Other Nations on Health Care

The conclusion of the article: Because prices are higher.

Seriously?
There's no dilema. It's just an excuse for control. Letting Nazis speak will not actually convert modern society into Nazis.
You're not paying for everyone - a significant chunk of the transfers you're endorsing are paid by deficit spending, so you're still signing up other people who don't get to vote to pay for what you want.

Of course there are probably government spending you disapprove of (long-term prison sentences for drugs, war on drugs, "bridge to nowhere", and military/foreign wars are likely candidates)

Everyone disapproves of some government spending, but it involves compromise between differing perspectives on what government should be doing.
If I understand this correctly, paravirtualization in this scenario means that the host kernel is impacted by the KAISER patch's overhead AND the guest kernel is impacted by the KAISER patch overhead, and that these overheads are multiplicative. Could someone more knowledgeable than me explain and/or verify my assumption?
Bet you a dollar some lawyer had to vet that three times over before they published it.
Yes as far as we know it allows user-space code to read kernel memory, but not modify it. It affects Intel but not AMD according to them (not sure why Intel says otherwise).

Details in this blog post from several months ago: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...

They didn't get it to work but obviously someone else has.
Twitter should not enforce ridiculous German laws. The tech companies need to call the bluff of countries that demand censorship.
It looks like a bunch of paper that should be thrown out.

Or like the old man montage near the end of 2001 A Space Odyssey.
Exercise Alters Our Microbiome. Is That One Reason It’s So Good for Us?
The AWS forums are really weird. If you don't have any AWS Console cookies (incognito window, for example), they load fine, but if they know you've got an AWS account, they require a login.
Why Kapwing's Subtitle Maker is the best subtitling software
I can promise you that in a world where goverment forces you to use Amazon Echo I will join forces with OP and fight for "government guaranteed" ad-free Echo experience.
Also I will very strongly demand that government does something about those damn flying pigs.
Should Presidents Be Required to Physically Murder an Aide to Launch Nukes?
Yeah, sort of "Don't worry I'm not going to shoot you in the torso, arms or legs."
The comment was present tense.

I certainly agree with you regarding previous handling of phone metadata, among other issues such as secret interpretations of law, but I was satisfied by changes/fixes made in the USA Freedom Act[1]. What current issue are still outstanding which you believe need to be addressed? (Serious, I like to learn and would be great to know if I am missing something).

[1] https://www.congress.gov/114/plaws/publ23/PLAW-114publ23.pdf
Nailed it, at least for the video I watched. Rahimi's NIPS Test of Time Award was swiftly condensed into a few minutes of magic, with all the other side-commentary swept away. Amazing work! Any details on how you did it?
Why the New York Times is in the hot seat so often
First domestically manufactured hot food vending machines appear in China
“For a change.” They’ve got some deserved bad press lately, but “for once” is absurd.
25% bump in CPU usage from that graph, ouch.
Apple development fees are wayy too big compared to value of the google and user experience..
I think this is possibly the xen PV side of the fix. Linux' PTI mitigation isn't enabled for paravirt xen:

if (hypervisor_is_type(X86_HYPER_XEN_PV)) {
pti_print_if_insecure("disabled on XEN PV.");
return;
}
in particular, I don't understand this comment:

"if you set this value to one,"

which value?
I guess I've stopped reading security articles by Peter Bright ever since he spent a whole series of articles shitting on project zero for disclosing vulnerabilities after the 90 day disclosure window when Microsoft had just been sitting on the bug.

https://arstechnica.com/information-technology/2015/01/googl...
Set up a Pi-hole and your entire network is protected from this dreck. The beauty of the Pi-hole approach is that you can add more blacklists on the fly and every device on the network benefits. People are actually starting to spin up Pi-hole servers at work to block this stuff.

I have one running at home and it makes a noticeable difference in my network performance. Highly recommended.
I would not be surprised at all, considering the patch I saw for the AMD processors was literally a one-line if statement around the set cpu insecure flag that added a check for AMD processors.

Google is failing me or I'd post a link.
You can dedicate your entire life and more to something, and still be wrong.
I have no idea what happens when the official security disclosure happens and the bugfixes get released.

And what the SEC can prove and what they can't, I do not claim to be an authority of.
FYI, bundler was planned to be integrated into Ruby 2.5, but will now likely be in the following ruby release.
Hey, I can't get my 25% executive bonus if I don't somehow squeeze another 2% out of my department's expenses.

This yacht won't pay for itself, you know.
But why?

One answer is a bit buried in a sub link in the article. On that page, you’ll find arguments for the following reasons: tradition, by products of the quest, collection of rare mathematical things, glory, pushing hardware performance, and contest rewards.

Personally I’m forced to admit I enjoy seeing them found while being unable to form any cogent justification.

http://primes.utm.edu/notes/faq/why.html
In the case of asymmetric competition, a company with vastly more resources might curate a list of undisclosed problems with competitors' products, for when a major event like this strikes, they can drag along the underdogs. The optics are different if 1) the dominant player can pretend it's "working together" with the other vendors, 2) the dominant player condescendingly points out mildly related issues in competitors' product, and 3) the name of the alternatives keeps getting linked in a "we're in the same boat" way.

I'm not suggesting this is the case here at all, as it's unlikely that Intel identified this precise issue with AMD long ago and haven't checked their own vulnerability (though there's always a chance that an issue is found by company A when analyzing the strengths and weaknesses of company B's products, which then turns out to apply for their own products too). But I wouldn't be surprised if somehow there were some loosely related AMD issues that came to light now, and it's impossible to tell if those would be current finds or older ones.

Given Intel's dominant position, they may come out ahead in P&L or gross margin terms even if it turns out to be a clearly Intel issue, as the perceived or real loss of performance may trigger an upgrade spree, sold unit counts inevitably dominated by Intel purchases.

AMD has just started to catch up in overall performance, and in the worst case bug impact to Intel, they may even get competitive single-threaded performance. Also, there has been speculation that Apple has been evaluating ARM processors for some future laptops, and a sudden drop of the baseline is an interesting turn of events.

While this in theory benefits the underdogs, financially Intel may well come out ahead due to their market hegemony.
Phones with 4k output is nothing new for example, and those had even weaker cpu's than desktop market atoms
So you say thech companies are above the law?
What could go wrong…
She's active on twitter: https://twitter.com/alicemazzy
> Do you use fascist techniques like criminalizing speech

“Criminalizing speech” by itself isn't a particularly fascist technique, since it's been done by movements all over the political spectrum, starting long before fascism. Fascism (in the broad sense) isn't really defined much by technique (you could perhaps credit Naziism or Italian Fascism specifically with some techniques, like the distinct propaganda approach of the Nazis, but even that isn't as distinguishing as the ideological goals of the movement.)
No, I don't think that's correct. KAISER/KPTI isn't enabled on the guest side on xen PV instances:

https://news.ycombinator.com/item?id=16065647
You might mean this one:

https://lkml.org/lkml/2017/12//27/2
Meh. Mac OS X package management is irreparably broken to begin with. There is a "package manager" but... it only knows how to install, not remove packages.

Then the software vendors are divided as to whether the software should be installed by "dragging" an image into Applications folder, or by running an installer of some sort, which is usually a package that installs other packages or some such. Then, there is a Apple store crap on top of all this, which, if I remember correctly, is also a package manager install.

Apple sucks at software. Mac OS X is stuck in 1995, as far as package management goes. The consumer does not care, hence Apple has no incentive to fix this mess.

Apple has a beautiful thing going: the "drag to install" and the self contained software images. Yet, they won't make any effort to regulate this.

P.S. The "uninstall" process on Mac OS X is usually some sort of a crappy shell script, which executes various "rm -rf" commands. The reliability and quality of those commands is left to the creativity of developers, that normally have no clue and write shell code by looking up examples on the Internet. It's a wonder uninstalls do not wipe out the whole disk more often.

What. A. Mess.
What about all the kernel interrupts due to network and storage traffic?
Note, the second video has animated nudity.
Random code that makes direct kernel calls? Or is that not necessary?
This is crap and a lazy claim. In the US, for instance, fascist tactics from democrats appear to originate from neo-liberals (Clinton, Obama) rather than leftists (Warren, Sanders, Stein).

If you squint, you can see that capitalism and regulatory capture have always been core to fascism. Neither are leftist values at all.

If you're obliquely referring to, err, recent "PC" culture, that seems to share a lot more with puritan culture than a form of government.
Sorry, I'm being imprecise. Yes, they're reading from kernel memory. But the specific thing they're reading is useful as a KASLR bypass.

I think I understand that the subtext of this thread is: can you only bypass KASLR with it, or can you read pretty much anything from kernel memory? And yeah: it sure seems like you can work out arbitrary kernel values; it's hard to think of a way this bug could work where you can figure out the symbols of specific kernel functions, but not arbitrary values in the kernel.
Can't find the app in the play store . Is this country locked? Is there a apk from f-droid or a legitimate GitHub repo?
A trivial counterexample is an organ transplant. It doesn't make sense to flip a coin when deciding whether to give a healthy liver to an octogenarian or a 3-month-old.

There are different forces at play here (not 'ambition-sensitive' ones), but it's a case where randomness fails miserably. Obviously, the 3-month-old should get it -- indeed, this is how scarce organs are actually distributed.
> criminalizing speech to stop the spread of fascist ideas

i wonder... is that actually something that works? or does it just mean fascist ideas gain a more polite presentation?
They may not have realized it would make it to the media; until this week there was not much chatter, and then today Intel's stock is trading lower while every other chipmaker is trading higher. Their PR team may not have been prepared for that situation, and they may be worrying about CTOs giving more serious thought to AMD (or even non-x86 chips) for their data center upgrades.
Not the OP, but my vitamin d was also low, and was exacerbating my auto-immune thyroiditis. I ended up needing 10k/day to maintain levels and keep the antibodies in check. For me at least, no amount of sunshine will help. We live in the north, and I have dark skin. I almost always wear shorts/short sleeves and walk about two hours outside in the morning and afternoon (walk to and from work). Never wear sunscreen, don't tan, etc. At a certain latitude, if your ancestors were from the tropics, there's a point at which no amount of sunshine will suffice.

I used an online 'calculator' (so can't vouch for its accuracy), but it basically said that at my skin tone i needed about 2 - 4 hours of sunshine in the summer months at my latitude and 16 hours + in the winter. This may be possible in the summer, but there's not 16 hours of sun in the winter at all, so there's no way this is going to work.

On the other hand, my wife is white, and gets much less sun exposure and wears sunscreen, and her vitamin d level is noticeably higher when she gets sun. Mine... not so much.
There are many that allow you to unlock the bootloader. If all you want to do is run your own apps, pretty much all of them allow it.
I do not assume that bytecode interpreter or compiler is bug free. But I assume that the interpreter can be trivially updated, while a bad CPU bug may require hardware replacement or taking terrible performance hit.

As for a particular bytecode format, I have no idea. Webassembly is a possibility, but it is still slower by factor of 2 compared with native code. Perhaps CPU-specific symbolic assembler will be a better choice as long as one can realibly alter it to workaround CPU bugs.
What good is having an opinion if you can't express it or discuss it in an open forum?
I don't get why more developers don't take notes from CD Projekt.
Except it absolutely is true. The incumbent ISPs were granted hundreds of billions of dollars to wire the country with fiber. They took the money, and did jack shit with it.

http://newnetworks.com/ShortSCANDALSummary.htm
Reading over that, I actually recognize I miss the older HN - where the conversations seemed fairly long and in depth. It's still often the case, but it does seem like the average length and depth is decreasing.
imgur checks your referral header and if it can figure out you've navigated to the image directly (or there's no referral header), it will redirect you to the image viewer + ads page, instead of just displaying the image file.

It's a pity, given the reasons imgur started, but it's the cycle of all image hosts I guess.
> what else?

Strong force and Weak force. See: https://en.wikipedia.org/wiki/Fundamental_forces

> What forces is made a quark of?

Quarks experience all 4 forces. That doesn't mean it's made of those forces though.
Apparently I'm the only one who is happy about this. I went through undergrad/grad school just as the explosion of foreign students occurred. Don't get me wrong, I'm open minded and liberal but I saw class rooms go from a dozen English speaking students with close connections to the professor to rooms stuffed beyond the fire code specifications of 50+ students who I couldn't even communicate with, not to mention the precipitous fall in education quality associated with this transition. Foreign money and skill is nice but I saw top tier programs go to shit to cram in a bunch of high paying mediocre foreign students. Domestic students deserve access to high quality education, and I personally saw major US programs fail at that.
Code is here - https://github.com/rkindi/vidDistill