skysight-inc/HackerNews huggingface dataset:
> For security reasons, the T2 is the iMac Pro hardware’s “root of trust,” and it validates the entire boot process when the power comes on. The T2 starts up, checks things out, loads its bootloader, verifies that it’s legitimate and cryptographically signed by Apple, and then moves on to the next part of the boot process.

How is this more secure from a locked down system using "standard" UEFI secure boot powered by any other TPM implementation?

I understand that this is not an in-depth technical analysis, mainly catering to the Mac-loving audience of the site and getting them to feel better about their platform of choice.

But I'd be interested to hear why I would trust this Apple T2 chip more than a workstation motherboard with a TPM on it, and secure boot on and loaded only with the keys of myself (in case I were to build my own kernel/bootloader and sign it) or a vendor I trust. I could be missing something, but the process outlined in the article sounds exactly like secure boot.
As time goes on, that argument is becoming increasingly debunked. Heartbleed, already mentioned in this thread, is a good example. OpenSSL is one of the most visible pieces of open source software, with millions of actual (not potential) eyeballs on it, and a complete security defeat sat in the code for years. I suspect that having "all bugs are shallow" programmed into our brains means that we don't take the time to review code that we use, because we assume that other people did. Group psychology, just like at accident scenes: nobody's going to help, because they're waiting to see what everybody else does. OpenSSL is popular and open source, so surely people would have found all the issues. Same thought.

OpenSSL is also extremely arcane. I tried to work on it once, and spent days simply understanding the data structures. It was, when I was working with it, entirely undocumented. Out of those millions of eyeballs, say a few dozen completely understand the library, and a percentage of them have the capability to review the exact algorithms being implemented. Simply publishing source code is not a silver bullet to gain competent reviewers and contributors, otherwise Linux would be bug-free and have bug-free drivers for every device in existence.

Linus's Law has compelling arguments against it. esr may have been wrong about the bazaar.
Beanie Babies in 1999 are as good an example - I think they're a much more comparable example than any "commodities".

If I pay $1000 for a particular Beanie, that doesn't mean someone with 1000 Beanies should expect the book value of their holding can be realised.

I'm saying that Bitcoins in a bubble work much the same way. That is, not like "any asset", but like any speculative investment in the mania phase of a huge asset bubble.

It feels like you're going out of your way to try not to understand this ...
Where is the disk key? Is it stored in the main board, or in the flash disk itself? E.g. if you have to replace the motherboard, do you lose the data, or because of being in the flash disk it is OK? BTW, if being in the flash disk, how secure it is the key handling?
Was he born at all? Maybe 742 B.C. has a grain of truth!

https://en.wikipedia.org/wiki/Phantom_time_hypothesis
I feel a little guilty about posting these non-stories. But I want to use this to pose a real question:

Crypto is clearly being being driven by a bubble mentality.

Is that:

a) Bad - because it will all crash and undermine the concept.

b) Not bad but irrational - the technologies that actually serve a purpose will rise from the ashes when needed.

c) Not bad AND rational:
- Maybe the "store of value" use case is a real one (driven by distrust of government etc.)
- If one believes that some currency will at some point become a significant store of world wealth in the future, you should pay a huge amount for it now (what if you happened to know where a lot of oil was, before it was used for transport)
- "irrational" pricing is not forecastable. E.g. Amazon was super over valued in 1999 (by any metric at the time). But it was STILL an amazing long term buy. So it was, in reality, very under valued.

Not sure. but would love thoughts!
Transparency for Congress's Scorekeepers
> Ubiquiti is dirt cheap for the entry level which pretty much outperforms any consumer oriented routers on the market.

Very true, but unless you're talking about Amplifi, this is usually a non-starter for 95% of the non-tech population.
> Just a thought: Why did alcohol prohibition require a constitutional amendment but drug prohibition didn't?

It probably didn't; the Wartime Prohibition Act was passed before the 18th Amendment was ratified and generally viewed not to require the amendment; this was never tested because by the time it went into effect, the amendment had been ratified.

The Amendment made prohibition a permanent policy as long as it wasn't repealed—which at that point was unprecedented—and was considered valuable for that reason.
> In fact, you can show that solving a linear systems has to have O(n^3) as a lower bound

Where did the author get this idea? It can be done more efficiently than that: https://mathoverflow.net/a/52557/40272
Yeah I know, I am so desperate to hope that obscurity will provide security :)

Seriously at least no more JS running free in browser makes me happy on so many levels.
Whoa! Where/How can you get a powerful PC with a 1060 for less than 600?

I'm not even being sarcastic, I'm thinking of building my first gaming PC this year.
Ethereum breaks new record by reaching $1,000 for the first time
Somewhat offtopic but:

> Eero [...] has laid off 20 percent of its workforce (about 30 employees), TechCrunch has learned. Eero confirmed about 30 employees were let go but declined to comment on its total workforce size.

Since the workforce size can be inferred from this information (specifically, Eero seems to have gone from 150 to 120 employees approximately). Am I missing something, or why do they say Eero declined to comment on the workforce size? How did TechCrunch learn that those 30 employees represented 20% of the company workforce?
Yeah, I think I was right and wrong. Right in that the microcode cannot fix the problem but wrong in that the microcode can disable the problematic features (speculative execution, ???) to foil the attack. Unfortunately, that will be a significant and forever performance hit for existing processors.

It makes sense that the features can be enabled and disabled via microcode.
I feel a little guilty about posting these non-stories. But I want to use this to pose a real question:
Crypto is clearly being being driven by a bubble mentality.

Is that:

a) Bad - because it will all crash and undermine the concept.

b) Not bad but irrational - the technologies that actually serve a purpose will rise from the ashes when needed.

c) Not bad AND rational: - Maybe the "store of value" use case is a real one (driven by distrust of government etc.) - If one believes that some currency will at some point become a significant store of world wealth in the future, you should pay a huge amount for it now (what if you happened to know where a lot of oil was, before it was used for transport) - "irrational" pricing is not forecastable. E.g. Amazon was super over valued in 1999 (by any metric at the time). But it was STILL an amazing long term buy. So it was, in reality, very under valued.

Not sure. but would love thoughts!
The article claims that the costs for developing small-molecule drugs are soaring, as the number of druggable targets without good existing drugs falls and the difficulty of finding something sufficiently improved and new goes up. It also claims that the dwindling number of molecules that do make it to the market are going to increasingly be targeting small patient populations and charging enormous sums while still under patent to make up for those huge development costs. I agree with all that.

It doesn't say that small-molecule drugs developed today will remain expensive after the patents expire. Small molecule drugs discovered now should have approximately the same manufacturing cost as those discovered 10 years ago, even though the discovery cost has gone up a lot. So this is not going to make medicine in general breathtakingly expensive; in our lifetimes most people will never have the rare disorders that orphan drugs target, and in a couple of decades the exclusivity will be gone anyway.

I don't even think anyone expects a simple "take one pill per day" small molecule drug to prevent deleterious effects of aging. It would be great if that happened, of course. It couldn't be monopolized after the patent expires and it would be the complete opposite of an orphan drug; nearly everyone is going to suffer from aging eventually. More likely IMO it'll take genetic interventions, biologics, and a bunch of analytical techniques and frequently adjusted treatments to suppress deleterious aging effects, if it's possible at all.
The Power of Full Engagement by Jim Loehr / Tony Schwartz is basically all about that:

https://www.goodreads.com/book/show/68985.The_Power_of_Full_...
I don't think I could've made my own point this elegantly. Eventually trying to disprove what the other party is saying is literally the opposite of what normal token schemes (say, SAML or OIDC JWT) is trying to accomplish: trying to establish what the other party is claiming.
This is true, but there are certainly ways you can increase your energy capacity.

Eating healthy, exercise, getting enough sleep, relaxing activities like TV or video games. All of these can increase your energy levels and allow you to go longer before running out of steam.
Note that this is only for PV guests, which most people don't use anymore...
I find it hard not to have dark thoughts when thinking about this topic.

Feedback loops are powerful and dangerous. A positive one can carry you to ever increasing wealth, wisdom and power, but a negative one could destroy not just yourself, but your entire family and the generations to come.

The poor have fallen into a highly negative one, and they are increasingly going too far in to have any escape velocity to get out. If we try to help them, we only prolong the inevitable and create an even greater population of poor that we simply can't support. If we let them die, then the blood is on our hands, but we may be left with a world that is more balanced.
Insightful comment, thank you.

> or merely drain them slower

Can you elaborate? What does this mean?

> (see also: me and video games or TV)

Are you saying video games or TV: (1) recharge you, (2) fill time, or (3) drain energies slower?
> I think the most rudimentary concept that sold me on a proper IDE over an editor was syntax checking. Editors like emacs or vi may have better support for that than Coda or Notepad++ but knowing the script won't compile immediately vs deploying broken code and finding it there has more than paid for the difference. The most powerful feature of PHPStorm for me is setting breakpoints and having the Xdebug integration give me a peek at everything visually.

Emacs has had mechanism (flymake) to call out to a background process to lint code for decades now. Recently (as in since 2012), there's a new package called flycheck that reimplements flymake's functionality. Since then process-based linters have exploded. At least in JS and Python, you can do syntax check and possibly fix your code exactly the same way as most IDEs. Better yet, these linters update so fast, you generally get much better linting on Emacs/VI than IDEs. Updating these linters is just one command line call away, whereas in IDEs, you typically have to wait for months because they are embedded. The speed of improvements is just so much faster in simple text editors. The problem with Emacs and VI are not linting, but something so much more basic such as keybindings and window management.
Many times touch is more convenient than the trackpad especially when I am feeling lazy. I am reading this thread on a Y2P, lying on my side, laptop on the bed, one hand supporting my head and the other scrolling the page on the screen. Much easier than any other method.
> I would say that the best strategy is

Apologies, can't help myself being a cynical bastard.

I would say that the best strategy in long term is to invest in assets that actually produce cash flow to the investors.
Yes. If part of the OS is written in ARM, that needs a separate chip to run on, this will be hard to hack.
I really wish the community would deal with the reality that open source software really isn't outstandingly secure - and that in fact there are exactly zero reliable processes in place that can guarantee its security.

Suggesting that "the community will find bugs, because eyeballs" is wishful hand-wavey exceptionalism that has been disproven over and over.

It's an unprofessional and unrealistic belief system that has no chance at all of creating truly secure systems.
I think one of the multiple factors that helped the right to add a lot of people to their pool in the last years, it's because the regressive part of the left have abandoned the thesis of "I will defend your right to speech even if I don't like what you said" instead going for the "Let's censor all that hurt my (subjective) feelings". Of course this it's not the left in general, but a small but vocal minority.

Probably the best way to fight a bad argument (e. Racism, Sexism, etc) it's not to censorship, but educate and discuss about it, and expose the fallacies in their logic. Censor ideas we don't like, gives them a martyr status. Of course it's hard and requires work, but at the long term freedom of speech it's a great investment for a democratic society.
It's always fun to think about how the cute little family traditions you grew up with might have originally just been the quirk of an ancestor from 200 years ago.
It seems it uses Embroidermodder under the hood. That supports 45 different formats, which are listen on the Wikipedia page.

https://en.m.wikipedia.org/wiki/Embroidermodder#Embroidermod...
Twitter are using Graal in production right now and say it’s saving them real money. Truffle’s a bit earlier in development still.
> …only a very, very small fraction of users ever replace or investigate the firmware on their devices…

Remember that the users we are talking about here are US government agencies. Yes, they do investigate firmware. Yes, they do code reviews of your firmware source code. No, they won't let you just ship them a Chinese router with factory firmware on it.
12.50 USD/hr.

Hi from Amazon's shit tier.
>XRP is counterparty-free

You have 100 USD and 100 XRP in your ripple wallet and the gateway you deposited USD to fund your wallet closes shop, you are now left with the bag in the hand and you must trade 'em for another gateway's IOUs, or try to find someone to buy them from you.
[Disclosure: Skymind co-founder here.]

The Skymind Intelligence Layer helps data scientists operationalize their models on-prem and in the public cloud, and uses Docker to do that.

https://skymind.readme.io/v1.0.1/docs/quickstart

https://skymind.readme.io/v1.0.1/docs/docker-image
> Since the workforce size can be inferred from this information

The 20% information didn't come from, and wasn't confirmed by, Eero, only the 30 people part was confirmed by the company.

> Am I missing something, or why do they say Eero declined to comment on the workforce size?

Because Eero declined to comment on the workforce size.

> Am I missing something, or why do they say Eero declined to comment on the workforce size?

From whoever leaked then information about the layoffs, who was not speaking on behalf of Eero when they did so.
Anything can be thrown out a window!
When I was in similar situation (bought an old SGI O2 box and didn’t had any other SGI machines to plug HDD into to get /etc/passwd), I used telnet RCE/privilege escalation exploit: https://www.exploit-db.com/exploits/20149/, worked like a charm. These old systems have many vulnerable services running by default, including telnet.
> "Science advances one funeral at a time"

This is mostly due to age related brain function degradation, most scientists now have to relearn and try new things several times in their middle age. Unfortunately many lose that ability with the age, but retain the power they have gained before that.

If scientists could retain the abilities of their young brain for longer, science would benefit greatly from improving the ratio of learning/working time.

In general i agree that without death resetting ossification and concentration power would take longer, but is the death of billions of people worth that? Is the current interval the perfect one, or maybe we should intentionally create antibiotic resistant bacteria to make it faster again.

If no why is intentionally hindering the development of life extension any different than trying to destroy the effects of life extension we achieved so far?
LTC. I have had 3 other buys/sells that went through normally, but one buy for approx $1k LTC @ ~$100 is stuck and my support request is sitting with no response. They don't respond to requests and so far haven't even acknowledged a backlog of pending buys, despite daily messages of various delays and outages. Could they be tying up customer funds on purpose?
Is anyone on here involved with the HCA by any chance? I have a question about your efforts.

When I was working in neuroimaging, one of the greatest hindrances to effective open data sharing was the lack of a standard for how data should be organized. Basically, what this amounted to was people from different labs would just throw their data on hard drives and ship them out to people who requested it as-is, with a variety of different organizational schemes (or no organizational scheme at all / raw data directly from a scanner with lots of missing and somewhat important metadata). There was an effort to change that (http://bids.neuroimaging.io/) although I'm not sure how well it has caught on. I've had discussions with friends in other fields (bioinformatics) where apparently there really isn't any standard at all and data organization is basically done according to the researcher's (or postdoc/grad student's) own idiosyncratic methods.

I've always felt like this sort of "here's the dataset as-is, take it or leave it" distribution severely limits the discoverability of open data, since it makes it substantially harder to index and make it easy to search using a variety of relevant criteria (in the case of neuroimaging, it'd be nice to be able to narrow down the kinds of brain images out there based on scanning modality or scan sequence). It also hurts the potential re-usability of datasets, since distributing data without properly populating key metadata fields can make it effectively useless in many cases.

With this context, I was wondering what efforts the HCA folks are making towards dataset standardization. Maybe this is all still in the works / a little to early to ask, but how is the data ingestion phase described on the HCA website [1] going to conform data and ensure that data is usable?

[1] https://www.humancellatlas.org/data-sharing
And now people have found (made?) two workarounds for those hardware design specifications: Spectre and Meltdown.

So people made workarounds for those two workarounds: software patches.

Maybe even more other people will find (or make?) workarounds for those software patches?

Will we witness an semi-endless cycle of workarounds until the current design specifications are slowly becoming worthless?

Or will we suddenly witness new updated (patched?) design specifications (with some extra free features we never knew we wanted) and all buy new hardware?
> "love the sinner but hate the sin."

The homosexuals still receive a disporpotionate amount of hate relative to "other sins", often by people pretending they are not hating as they parrot this phrase.
Do you mean the box that comes with Google Fiber?

I have odd issues with some of my devices every few weeks, though none of my Apple stuff, where they seem to stop getting DHCP leases (or stop using them?) for no discernible reason.

Restarting the Google box always fixes it, but it’s extremely annoying.

That was never an issue with my AirPort in charge of things.
AWS WAF major outage (us-east-1)
822 parking spaces at N. Berkeley. Are they really going to build “way more” housing units?

Not that many people live in reasonable walking distance of the suburban commuter stations; building on the parking won’t really change that. I would love it, though, if we could radically upzone the whole area for a mile around.

Walking for half an hour to work is great. Walking for half an hour just to get to your train is no way to live.
Good point, so could we make it "just write back but don't evict", something like fsync() for memory...?
You'd be taking a long punt in backing a reversal on nuclear.. the excess costs built into overcoming planning opposition and compliance may make it less attractive as a mitigation compared to PV and wind and pumped hydro storage. Not that the energy density or scale matches you understand: just that inside a 15-20 year deployment timeline more people will put money into lower energy intensity paths.
I don't know either, but I read on HN some time ago that the size of a CD were comparable to ... I don't even know, a human genome. So, assuming that's a lower bound, 1% of 600MB is still 48 million bits. 2^48 would be the number of different strings representable with 48MB, but maybe not all of those will be viable.
Great advice. It's easy to get into a cycle of "I'm tired today -> I'm not getting anything done -> I'll stay up late and do some more -> I'm tired today..." where what you really need to get things done is a good sleep! But it's so hard to go to bed when there are things to be done...
Yes, the flow you describe is pretty much how it goes. The OS will "overlay" the fork'ed child process if exec succeeds in loading the program specified. If not, errno is set and typically the child process reports the problem (using something like strerror_r[0]) then exits.

In either case, the parent process can free the memory allocated for the execve call once it returns.

0 - https://www.freebsd.org/cgi/man.cgi?query=strerror_r&apropos...
The software was not stolen, it was purchased from a Canadian company. The explosion happened because of the CIA's sabotage efforts.
This is what KPTI does, wipe caches, and if you did this often in user code, performance degradation would be all over the place. Also, heavy AVX routines that use encryption keys... would be great to attack.
It might seem silly to have them with, say, a single core on a single processor--but, consider the case where multiple cores (or dies, or even sockets!) are sharing the same main memory.
I'm pretty close to doing the same thing, but I hestitate because basically that will just mean Coinbase got an interest free loan from me, and the LTC are worth over twice as much now.
I really wanted an XPS 13 with a 3840x2160 screen. Now that it's available I've been turned off by the meager performance gains for casual gaming on an integrated Intel GPU. And then there's Meltdown/Spectre.

AMD isn't safe either but I'm looking at the new HP Envy x360 15" with Ryzen inside.

Someday, maybe - RISC-V and less disappointments.