skysight-inc/HackerNews huggingface dataset:
This is why we can’t have nice things--random reports of things not working are pretty meaningless without context.

Yes, it’s fodder to continue to dump on Apple—I get that. But it certainly doesn’t help solve the issue, assuming there’s really an issue in the first place.

For the record, I’ve installed htop many dozens of times using Homebrew on a variety of Mac hardware and operating systems over the years and have never experienced an issues.

After many years of Mac IT tech support, I can tell you: it’s usually what’s not being reported that's the problem.

Was this a clean install or was it upgraded from a previous version of macOS?

Are there 3rd-party kernel extensions installed? Pretty common with antivirus software and hardware drivers.

When’s the last time Disk Repair was run? I’ve seen corrupted/damaged hard drives cause machines to kernel panic or hang.

Did htop ever work correctly? If so, when did that change?

I’d be pretty surprised to hear a new iMac that was unboxed and had Homebrew and htop installed would crash. Actually, if that were the case, they could boot into the recovery partition, format and reinstall.

I clean-installed macOS High Sierra 10.13 the day it was released on a 2009 iMac and have been running the public betas and haven’t had any issues since.

I’m running macOS High Sierra 10.13.3, build 17D29a. I’ve installed 157 command line and 71 GUI applications using Homebrew…

As someone mentioned, it’s only the problems that are part of some narrative that make news; people like me don’t post “Hey—I’m a web developer and I’ve been using High Sierra on a nearly 10 year-old iMac with zero issues, even when running beta versions”.

This doesn’t excuse Apple at all for the bugs and vulnerabilities that have been well-publicized; but lets not make it seem worse than it actually is.

Apple has already starting releasing mitigations for Meltdown and Spectre, like many OS vendors are doing.

I run a FreeBSD server on Digital Ocean; here’s their statement:

FreeBSD was made aware of the problems in late December 2017. We're working with CPU vendors and the published papers on these attacks to mitigate them on FreeBSD. Due to the fundamental nature of the attacks, no estimate is yet available for the publication date of patches.

This is pretty underwhelming, especially given the severity of these vulnerabilities.
Practical secret extraction from caches --- practical as in "papers documented C programs the authors wrote to verify their claims" --- go back to at least 2005.

Here's a very well-known paper: https://www.cs.tau.ac.il/~tromer/papers/cache.pdf

It's the speculative execution side channel that's new. What we didn't fully grok was the idea that code that never really runs could leave predictable cache footprints.
They probably made it oem for wd
Not sure, but looks like he took a new role at UC Boulder in November. https://www.linkedin.com/in/bobby-schnabel-860b61b/
> Amazon Redshift is based on PostgreSQL 8.0.2

Same wikipedia article you are quoting ;)

https://en.wikipedia.org/wiki/Amazon_Redshift
California Senate to Hear EFF’s License Plate Cover Bill
Thank fuck for security research and hackers.
Chuwi Brings Gemini Lake Products at CES
Careful. People on HN aren't really a part of the "post-PC narrative". People plugging keyboards into iPads and using them full-time to write papers at school are.

I'm not really clear why I'd use Transmit on the Mac either, except that it's a very pretty interface.
State Child Care Laws Should Not Require Kids to Submit Data to the FBI
I considered that but gut instinct told me the cost had to be cut from somewhere and made me afraid of the failure rate.
I'm seriously pondering what this means for PL research. There has been some work in probalistic programming languages, and a significant part of the community would like to avoid imperative features. However, it seems like this is a chance for some real invigoration in PL research agendas.
Any ideas on what can probably change the situation at some point?
And AMD were confident the same issue from Intel ME would happen to them.

Glad someone proved them wrong, and that hopefully we'll get a proper killswitch for these backdoors.
I pulled some old MyBook hard drives out of their cases and discovered they were unreadable via a standard SATA connection. They were older MyBooks designed for XP, so I thought it was just having trouble because they were using 4k sectors.

I found some information that claimed the older MyBooks would AES encrypt the data (even if you never setup a password) making the data totally inaccessible if the factory enclosure ever broke.

Fuck that shit. I pulled the drive back in and copied everything off, then formatted the disk from a real PC and threw that shit away. Today I always buy separate disks and enclosures that allow direct disk access.
"efficiently plagiarize cross-unit results"

At least they're honest.
Any recommended competitors?
More than enough people in the world, I see no reason to encourage more.
Killing Off Wasabi (2015)
Have you never done it before? It's intimidating walking through the door, but you'll rapidly discover that there's nothing terrifying about it. Professionals are really good at talking to you about your concerns. You might get lucky and find that your problems stem from the kind of anxiety that dissipates if you can just have someone guide you through venting it fully and clearly in a venue where nobody is judging you.
He is monetizing for his employer using his 100+B neuron network...
Or Elon Musk's idea to use nuclear explosions over the poles to change the climate on Mars and make it more inhabitable.

http://www.cnn.com/2015/09/11/us/elon-musk-mars-nuclear-bomb...
Broad Institute FireCloud Free Credits Program
This I can agree with. What maddens me is how brazen the thieves are in this case. People who have gainful employment are openly stealing bicycles and littering them throughout the city without any shame.
Build your own and use one of FreeNAS, Rockstor, or roll your own (as I have with ZFS on Linux).

I can't recommend any competitors specifically since I've just been building my own, but last I looked drobo didn't look that bad.
Well, here’s this week’s embarrassing bug. What in the world is going on over there.
Complaining may get attention, but doesn't always get the result you're seeking.

https://www.nytimes.com/2017/05/04/us/flint-water-home-forec...
> The Linux users I work with spend more time on sysadmin work than the Mac users by a hefty margin

This is why I use LTS Ubuntu. I don't do any sysadmin work at all. Every couple of weeks or so a dialog opens up saying there are updates, and I click OK. Everything "just works".
I mean yes, you or I might just get an ITX board or a Pi and run our own Linux on it to setup a NAS, but most of the average users aren't going to do that, mostly because they don't have the knowledge or expertise, or because they don't have the time.

Vendors with names people trust should be held accountable when they fuck up like this.

Also you can't trust everything all the way down. A Pi still has proprietary video chips, every Intel and AMD board has some kind of management software, etc. etc. There is no way for one human being to be all Tony Stark and build literally everything from the ground up.
> A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments?

There's a big issue with quality on devices but spreading conspiracy theories only harms that cause. There's no reason to believe this is connected to a government — and it's way below the level of craft we've seen in that regard – and making dubious claims is more likely to cause people to take you and the broader argument less seriously.

> This situation has been a problem for years now. What can be done? What regulation or law would help? What should we demand?

Two good starting points would be protection for security researchers and the requirement that manufacturers promptly support devices for a reasonable amount of time. Things like this happen because there's very little perceived cost to shipping something shoddy compared with not getting as many features to market as quickly as possible.

A followup point, especially for restoring trust that there aren't sophisticated backdoors, would be not just source code but fully reproducible, user-installable builds. This is still fundamentally a losing game if you don't trust the hardware but it'd dramatically increase the odds of someone being able to notice an error, not to mention being a huge win for users’ ability to improve an orphaned device.

The reason why that's unlikely to happen is that companies treat source code as a significant asset, which is why I first mentioned a longer support period. My favorite approach for this problem would be regulation requiring mandatory release of source code, the toolchain, signing keys, etc. if the manufacturer stops supporting something, so the places which want to keep their trade secrets can still do so but are required to help their users at the same time.
Meltdown and Spectre Are Good for Innovation
Either both contracted the software out to the same third party company who reused code or one contracted the software out to the other.

I've personally seen and worked on, many times, code originally developed for one customer reused in another project for another customer. Mind you, this is totally legal the way our contracts are worded.

For all we know WD could have paid DLink to produce the whole damn thing and just stick a WD logo on them. That sort of thing is far from unheard of.
Possibly implemented by the same third party vendor.
I can confirm that Redshift is based on Postgres. And I know that straight from the source: Dave Steinhoff, one of the founders of ParAccel, is on our team.

https://www.intermix.io/about-us/
How does it work Alberta travel insurance
Backblaze didn't pioneer this, but they sure took it to a new level! [1]

1: https://www.backblaze.com/blog/backblaze_drive_farming/
Transmit/Mac when it's discounted is definitely worth it IMO. $45 is a little steep, but Transmit performs really well, especially when you have a lot of little files to move.
Perhaps one of my favorite people of all time, you can find some decent documentaries on YouTube as well. It's hard to sum him up in an article so if you're interested in any of the things he accomplished, check out some videos and books about him, truly an extraordinary man that had so much taken from him with no credit given.
A general question: why is no one suing people who put in back doors? Where are the "reckless negligence" suits? Especially injured third parties, who never agreed to an overreaching EULA.
It’s even more puzzling given how many other FTP/SFTP graphical clients there are for Mac OS. Not just Transmit and Cyberduck, but also Fugu, which is open-source like Cyberduck (although it has not been much developed of late) but Fetch, which is commercial and older than Transmit (dating back from the 80s) yet cheaper at $29.

I just don’t see why Transmit is worth it with all those other options.
Is there a way to crowdfund security research? We need more people looking into these.
You can always lock the bike outside of a locker. Just remember to lock your front wheel and back...and protect your seat :(. The bikes google are using aren’t that high end, a low end bike with bolted everything could probably survive out in the open for a day without much problem.
> There's no reason to believe this is connected to a government

Why the fuck not? Over the last 5 years, we have time and time again been shown that governments can and do engage in backdooring everything they can get their hands on. I mean, there's hard evidence that they were intercepting packages with cisco gear and making modifications to them. And with that kind of historical record you think there's no reason to believe government could be involved with WD? What?
Have fun with PayPal and Visa then. Some people just don't get it.
The IBPB mitigation clears indirect branch prediction state on context switches between processes so it does help with processes spying on each other.
Why the shit is this even being discussed on HN? This is clearly self-promotion and should be banned.
It wasn't until we learned my great-grandmother's Hebrew name (last year!) that we made a connection between that and a Yiddish lullaby my grandmother used to sing to my sister. Long story short our best theory is that it was passed down from my great-great grandmother, who was born in the 1870s.
My bad. Thanks for changing the title.

FWIW, it’s POWER not Power.
I respectfully disagree. There are a lot of statements like "deficits are good" and "we need to raise aggregate demand" and "there should be a Job Guarantee."

There are strong prescriptive and value-laden keynesian overtones. I don't want to name names, but just search for the "Job Guarantee," for instance, and you'll see lots of writing about it.
DHS issues new rules for searching electronic devices at the border
Who takes the time to write a blog post about how they bought a Mac recently and everything is just going fine as expected? Not many people.

Look at it this way: there are literally dozens of complaints posted in this thread. But Apple sold 5.39 million Macs in the most recent quarter.

You're always going to hear more from people who are unhappy, than the quietly satisfied.
Regarding the first point, I don't positively state that governments do covertly subsidize backdoored products, but it's realistic and a real attack vector. Even if for example the state were totally benign right now, we need to be able to talk about the worst case in case the state goes haywire, without being put in the corner of crackpots.

Regarding the second point, I completely agree with you. First a period of binding and liable responsibility of the manufacturer for the product including software, followed by the release of full source, toolchain and necessary cryptographic material. I think this should be law, and the first period must be time-limited. Reproducible builds could ensure that backdoors in the software are at least retrospectively detected, and the company and people behind it can be hold accountable for it.
maybe it's a negotiation tactic/they want arguments to be able to offer less
Oracle, with its undo log and some clever in-place tuple modification and space reclamation, seems to have sidestepped the issue to a much greater degree than Postgres. Oracle is MVCC-like, but sacrifices technical elegance for performance.

For example, as I recall, Oracle actually writes new row data to the page the row lives in, overwriting the old data in place on commit. It also writes the modifying transaction ID to the row header. If a different transaction finds the row, it will see that the transaction ID doesn't match (it's newer than itself), which forces the database to go to the undo log to look for the older data.

I'm not privy to the technical details of how the undo log is implemented or how it avoids the vacuum problem. I suspect it's related to the fact that the undo log is separate from the tuple data, so undo bloat doesn't affect table performance to the same extent as with Postgres.
Disabling Javascript on Facebook allows you to read these public blog posts without any popups, login, or ads.
Interview with John Sculley about Apple II [video] (1988)
Off the top of my head I recall there was the Sony rootkit lawsuit: https://www.cnet.com/news/sony-settles-rootkit-class-action-...
Never fails to make me quite emotional reading about his story.
Common Lisp without any changes: https://people.eecs.berkeley.edu/~fateman/papers/ADIL.pdf

Fortran with some changes required: http://www.ens.utulsa.edu/~diaz/cs8243/adifor.html

C with some changes required: http://www.ens.utulsa.edu/~diaz/cs8243/adiff.html
Transmit for iOS is $10, but I bought it because Panic is known for making premium-quality software to match the price.

…So I was quite surprised to find out it doesn't support the SMB protocol (i.e. Windows file sharing). That's one of the most common file transfer protocols, not to mention the only one that current macOS can serve out of the box. And the lack of support is not an OS limitation, since there are other iOS apps that support it (e.g. Documents by Readdle). So what gives?

I suppose the lack of support is inherited from Transmit for Mac; macOS can mount SMB network drives natively, so there's no need for a separate app. (Although I might like to use one anyway - mounting network disks is always a laggy affair, since most software doesn't expect the filesystem to be that slow.) But iOS has no builtin SMB client, so it would be quite useful there - is useful, with those other apps.

The list of cloud services supported by Transmit for iOS is also rather small - S3 and DreamObjects, that's it - even (especially?) compared to Transmit for Mac, which supports something like 10 other services![1] Why couldn't they port that functionality over?

The app does have a quite nice UI, and unlike some, I place a high value on that. But a premium UI is no use if I can't even connect to the servers I'm trying to access. Maybe they'd have gotten more sales with an app that could.

[1] https://panic.com/transmit/
I don't think so. LeCun seems to oppose Marcus's views...

Related: https://twitter.com/ylecun/status/921409820825178114?lang=en

I think LeCun doesn't want a repeat of AI winter because of exponentially rising hype and expectations out of Deep Learning. There have been few examples like Selena which he seems to think that people are trying to ride the deep learning wave to generate false buzz (and cash!) for themselves.
Of all of the pop culture tributes / references to Tesla, probably my favorite is the band Tesla[1] and their album The Great Radio Controversy[2]. And, of course, the song Edison's Medicine[3] on the Psychotic Supper album.

[1]: https://en.wikipedia.org/wiki/Tesla_(band)

[2]: https://en.wikipedia.org/wiki/The_Great_Radio_Controversy

[3]: https://www.youtube.com/watch?v=-2zwBRa0YhA
Oooh! I recently had a super high percentage event, it was because of a bunch of IO that happened right when I woke the Mac up, and I guess the system monitor dropped a few samples and nearly divided by zero.
William James Makes a Lesson Plan for Himself
Spectre is simple to prevent: just don't modify the cache while speculating and the CPU can still do all the same branch prediction and speculative execution pipelines that exist today.

It doesn't even have to be that drastic, the CPU can still fetch any memory that's not calculated. Both sides of a non-computed jump for instance, or the next line of an array that's being scanned in order.

Some memory references would be sequential instead of overlapped, but it wouldn't be the end of the world.
Great. Now we just have to think of new attacks using the same general idea to slow down all computers by yet another 10% :p
I believe https://github.com/google/tangent counts, though I'm not 100% sure.
I should say that the housework we do ourselves is not captured in GDP.
Wasn't that how they did truecrypt/openSSL?
It looks like they built their own chips for their servers:

https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-...

Notable quote:

"Google designed Titan's hardware logic in-house to reduce the chances of hardware backdoors. The Titan ecosystem ensures that production infrastructure boots securely using authorized and verifiable code."

This is what we need. Authorized and verifiable code, none of this opaque binary blob BS.
Or how about it crashes your computer and you'll have to hold down the power button ?
AI Uses Titan Supercomputer to Create Deep Neural Nets in Less Than a Day
Removing, from what I can see, a pretty good piece of software from sale doesn't seem the correct option.

Then again I understand making it free / heavily discounted may irritate people who have bought it already.

Is there a better option for apps such as this?
Turns out there’s some kind of build issue with htop; the Homebrew formula has been modified to not install on High Sierra.

Here’s what I got when attempting to upgrade; for the record, htop still works fine for me:

==> Upgrading 1 outdated package, with result:
htop 2.0.2_1
htop: This formula either does not compile or function as expected on macOS versions newer than Sierra due to an upstream incompatibility.
Error: An unsatisfied requirement failed this build.
He does oppose Marcus' views, but he also knows neural nets are only one approach to differentiable programming. The term is confusing though. It should read like "linear programming" does, but people are not interpreting it that way.
You're right. The standard leaves the interpretation of type declarations in CL up to the implementation. I was coming from a CCL perspective, and I should have checked the others.

In CCL:

? (defun foo (a) (declare (type (integer 0 100) a)) (+ a 10))
FOO
? (foo -1)
9

It's dangerous to assume the effect type declarations will have in CL. You have to test it.
Mobile game development and software permission requests
A friend recommended that I post here about our new game we just released to the Google play store. I read through the rules and guidelines and wasn't going to post, thinking that maybe this wasn't the place for it. But I kept thinking about how we've had a unique experience with independent software development and might be able to answer some questions about it. So please feel free and ask us.

Also I wanted to ask this community about software permissions. Does it bother you that so many apps ask for so much? Do you think it's nefarious? I have a hard time believing they need so many when our game is so complex and yet only asks if we can make the phone vibrate.

My brother and I spent 5 years on this game and are proud of how it turned out. Here is a link for it.

Uciana, a 4x game by Birdshel.
https://play.google.com/store/apps/details?id=com.birdshel.Uciana
Not disagreeing with you, I was just trying to connect that the index size is a function of the breadth of information.

For example, I have digitized roughly 300 volumes (books) which collectively represent about 100,000 pages of information. That collection which represents a big chunk of my originally print reference library creates a relatively small n-gram index of about 22 GB. But it is a small sample of generally available reference material and doesn't include the 22 years of digitized Scientific American articles (much harder to parse out for indexing when starting with the PDF form). But it still answers a lot of reference queries quickly and accurately for things I am interested in. For things that I become interested in and have yet to have started curating a set of references for, its worthless.

As a result my experience is that the closer I get to my long term interests the more likely I am to find something in my library to answer the question, things that are more temporal (news, new research) are not there at all generally, and things that are only now of interest are similarly not represented. The thing that Search engines do so remarkably well is that they cover a very wide swath of interesting material preemptively.

To host that locally would be a more significant effort for me.
Honestly, Slack is so slow and resource intensive for what it does. I've been using the web app version more lately which fixes a lot of the issues but it also comes with significant limitations like not showing you as online if the tab is backgrounded.
There is also those who silently live with the problems because it is too much work to get a resolution. I no longer use a mac but a few years back there used to be wifi issues with my recent ibook where when you open it up, the wifi doesn't find the network half the time. It took month for any fixes even though this is Apple developed hardware and OS and people were getting no answers on their help website. Eventually it got fixed in one of their updates only to come back on yet another update before finally being resolved.