skysight-inc/HackerNews huggingface dataset:
The fact that Spectre was manifest on Intel, AMD and ARM suggests that any open source solution that utilized the same performance strategies would have also had the same attack vector.
Which is exactly what they're threatening to do. But they can't stamp out more underground growers without local support, which leaves the feds in a policy bind - accept state defiance, or produce a hard-to-track and harder-to-constrain underground market.
It means the only secure system is one where the performance of any given instruction is constant in all cases for that instruction.
I'd say this is more of a result of decades of trial and error in different architectures/topologies rather than some fundamental property of neural networks in general.
Hopefully. Timing is everything, though.
But in reality the bonus and RSU's are a very significant portion of compensation. I know several people in their late 20's in SF with salaries around $150k but after adding RSU's and annual bonus and other oddities like recurring "signing bonuses" they pull in between $200k and $250k per year before taxes. Even if it's slightly variable it is still a big difference from the base salary. As an example of why this matters, my base salary is $20k more than a certain friend of mine but my employer doesn't do RSU's and has relatively low bonuses, so in the end my friend makes around $50k per year more than me, which equates to a significant lifestyle difference.
That was a barrel, actually.

Bastard had the nerve to tell Alexander to "stand a little out of my sun."

Total nutjob. No respect for wealth and power whatsoever.
> There are a lot of jobs to be had here. But not in tweets. Think cancer research, molecular biology, taxonomy, behavioral and experimental psychology. The data

Did your comment get truncated?
Discussions like this are why we're supposed to flag posts quietly and not point that fact out. :)
except you can't account for debt without accounting for assets.

Japan, Greece, and Italy have the highest portion of debt to GDP (235%, 182%, 133%) except that Japan and Italy are very rich countries, Greece less so...
Ask HN: What installer technology do you use
I've recently been tasked with blowing up our desktop applications' old Windows installation method and rebuilding anew. We've dabbled with Install Shield and WIX. I've had minimal experience with Install Shield which was overwhelmingly negative but I am genuinely unsure if that was because I inherited this terrible homunculus or if Install Shield is just a nightmare.

Is Install Shield worth sticking with?
Is there something better out there?

Thanks
-Hal
He had his hands hovering over a woman's chest, not touching it.
No light will come from discussion of this article.
I have used Viz.js since 2012 in Aude [1], a tool to play with Finite State Machines, in order to display results from algorithms like minimization, determinization and other common FSM-related algorithms, and also to provide an automatic redraw feature when drawing FSMs. The user can also input FSMs in a small description language, and they are drawn automatically using the same system.

For people who don't know Viz.js, it is basically GraphViz compiled for the web as ASM.js using emscripten plus a convenient way to call it. Usage is simple: you give the DOT code, and it returns an SVG document as string (other formats are actually supported).

Viz.js is awesome. Thanks Mike Daines! And obviously, thanks Graphviz!

Webgraphiz uses a viz.js file. Is it actually the same Viz.js? (edit: yes, it is)

[1] https://aude.imag.fr/
Bingo! In fact, the specific precedent cited by the Supreme Court for convicting marijuana growers in CA was the price controls on agricultural produce during the New Deal era.
It's affected by the bug and will never be patched.
I wonder if Apple campus (the newly developed area) tied up all the design resources. I really can imagine the Apple designers going nuts on stairs and handrails and curvature of windows, designing everything meticulously, and having only little time for the actual products.
Diving into other people's code – How to read other people's code
I thought I missed out on bitcoin. Clearly what I really missed out on is making my own block-chain currency. Who wants some ShaneCoin?
Deploying Large Spark Models to production and model scoring in near real time
Yeah it seems less a case of missing shipment dates and more a case of announcing earlier in the cycle. Jobs tended not to announce stuff until it was ready to ship. I think Jobs had fewer leaks to deal with, which I think forces Cook to announce things earlier.
The article? Not really disguised much.
If we are going to stick with GDP we should at least use GDP per hour worked [0] so we look at the only thing that matters in the long run - labour efficiency.

Looking at this I am amazed how much more efficient Australian labour is than New Zealand labour $55.87 verse $36.83.

0. https://en.m.wikipedia.org/wiki/List_of_countries_by_GDP_(PP...
4 cores (8 hyperthreaded)
They are doing the same as the Intel microcode update presumably, offering kernel a bit to enable/disable indirect branch speculation. Usually it will be disabled on entry into kernel and reenabled on exit, so it helps the kernel, not necessary user programs spying on each other (retpoline for those)

See here:

https://lkml.org/lkml/2018/1/4/615
> It won't turn out well for women

All these shows won't turn out well for anyone under senatorial property qualifications (SPQR style, I mean).

Alas.
Yeah, adding a privacy/retention policy would be a good idea.

Under the hood its pretty simple (and open source), just an AWS lambda squashing the commits and stripping metadata before pushing to Github. Potentially you could tie the commit to an IP address, but I'm not logging any of that info.

I'm not really sure how I can prove that the code I'm running is the code you'll find on GH though.
http://www.catb.org/jargon/html/R/Random-Number-God.html
Nice to see GEOS referenced in this article - it also was the underpinning for the Atari ST line of computers that did well Europe and swung well above their weight.

If only I could find an ST 1040 again to appreciate Revenge of the Mutant Camels on a machine that was as good at desktop publishing, animating, creating sprite based games and and making music.
Well, several years ago would be a good time to plug Matasano, since it doesn't exist anymore. :)
For 3. I'd say no way. There's no way for Mailgun to know what services are doing with those keys, how important those services are to their customers, how difficult it is for the service owners to rotate their keys, and how much bandwidth they have to do that right now.

In an ideal world, every customer would have a good setup where they can rotate third-party supplier API keys painlessly and have plenty of bandwidth to handle security emergencies. Alas, there's a lot of bad setups out there, and some of them are critical to their customers' operations.

Nothing I've personally worked with had a setup bad enough to make that painful, but I'd be very worried about how reckless a service is to rotate API keys that aren't being actively exploited to do something dangerous without getting a positive confirmation from the customer.
Not OP, but maximizing continued growth on an upward trend are what makes me think "that a site whose Alexa Ranking has jumped up from 2,993 to 1,814 in the last three months alone would need to issue press releases disguised as informative blog posts."

Any marketer worth their salt would do this too. If you don't, you're wasting a golden opportunity.
IMO there's a nasty undertone of money-grubbing accumulation for its own sake that wasn't there during the Jobs days.

The iMac Pros are nice-ish machines, but I can't see Jobs trying to sell a >$10k BTO Mac as anything other than a very special edition with a whole marketing circus supporting it - not as a ludicrously expensive mainstream SKU with a "This is the price, you're going to buy it because it's a Mac, take it or leave it" attitude underlying the sales pitch.

Apple seem to be becoming increasingly tone deaf. The money may keep rolling in, but sooner or later there's going to be an event - a competitor, a new technology, a software disaster - that makes the wheels fall off.
RNAStructuromeDB: A genome-wide database for RNA structural inference
The first 2 features are pretty common in privacy-focused search engines.

The 3rd involves a closed-source browser extension doing who-knows-what... and who's it been audited by?
> if the security model was clearly leaking at that point

The leak is only clear in retrospect. Many, many things are only clear after you see how they were done.

It has been twenty years since processors with this vulnerability started appearing. Over those two decades, thousands of very smart engineers (including state-sponsored ones) have collectively spent millions of hours of analysis trying to find security flaws.

No one has found such a clever timing attack until now. So "clearly leaking" wasn't "clearly leaking" until this week.
how does it compare with bing for porn?
Not sure why this is getting downvoted; given what we know about abuse online, especially in anonymous systems, I'd question if this project should even exist.

GitHub put a lot of work into their anti-spam systems and this basically let's people bypass that completely. If I was them I'd shut it down right now.
Hopefully 2018 will be the year where CPU manufacturers finally start taking security seriously.
I'm not here to litigate how big a deal embedded cold start entropy problems are, so much as to point out that USB devices to increase "entropy" for consumer devices are silly and don't solve a real security problem, but do contribute to the misapprehension people have about the importance of "true randomness".
I understand that, but I don't know that either Spectre or Meltdown needs to be mitigated within the context of a KVM guest running on a host with mitigations. They are timing attacks, and virtualization may incur enough overhead/latency to make them infeasible (I don't know if it does or not, I haven't tested).

Also, theoretically, the KVM driver and/or QEMU could be updated to block speculative execution attacks specific to guest passthrough, though admittedly I haven't done any KVM or VT-x hacking so I don't know its intricacies; maybe this wouldn't work?

With a host that is using new vendor microcode to disable branch prediction within unsafe contexts (IBRS as a global alternative to retpoline, or IBPB), speculative execution attacks may be sufficiently mitigated at the host level without necessitating additional mitigation at the guest level.

I'm not sure if anyone who doesn't work at Intel knows that for sure yet, since it seems that some people are still trying to figure out how to get the new microcodes...
Open University Learning Analytics Dataset
Note: I'm not connected with the GP in any way and do not have any financial or material interest in Okta.

Users don't necessarily have to be employees, although for many smaller companies the employees may be all the users. For example, say your company buys computers for your employees from a vendor and gives the vendor access to one of your applications to send invoices and manage orders (with appropriate controls and privileges). You would want to manage this external vendor user in a way similar to how you manage employees' access to applications. For a system like Okta, this external person is also a user, though not your employee.

For your use case described above, a system/platform like Okta may be a good fit — all your user identity management and application access management would be on Okta alone.

Keep in mind that individual applications may still have copies of user identity and profile records and their own (closed) mechanisms of storing user privilege information. Those cases would have to be managed separately anyway, even though it generally may not cause any harm as such to keep such "junk" around when the main user identification record has been purged from a central system like Okta (the same can be said of AD, LDAP, etc.).
Really? I've read it a few times but I never thought it was a great book.
you might want to look at yacy for that.

https://yacy.net/en/index.html
Trustonic is about as trustworthy a name as "Safecorp" or something similar. The name itself is just one big red flag.
This attitude is unsustainable.
Looks like both Benchmark and Travis Kalanick wanted to sell more stock than they were able to. Can someone explain who was able to sell stock and how their sell preferences were prioritized and executed? Was everyone able to sell at least one percent of their holdings, for example?
"The problem with doing something right the first time is nobody appreciates how hard it was."
I think this is inevitable as long as what you're using your tech knowledge for does not relate to a goal you value. There can be intrinsic interestingness in ideas, but there has to be a connection back to what they might be used for.

For instance, when I first started learning to code I was interested in making video games. Along the way there were all kinds of concepts in real-time rendering which had intrinsic interest and which I enjoyed learning on their own (e.g. even ones I never put into use). However, if it weren't for the intensifying factor of what I might use those ideas for, and without having the potential applications in mind to get me through the boring parts—I don't think I would've enjoyed learning the material all that much.

If you end up spending your time coding to develop things which you find pointless, for people whom you don't respect, it may be even worse than mere lack of motivation.

The only solution I've found is to earn money in other ways, while working on tech things in my free time if/when I feel like it—or to find a position at a small company that you believe in. I've found the first to much more doable so far, but I do keep an eye out.
Angular core team here - unfortunately, this post ignores Angular 2+ entirely (its @angular/core on npm) - the numbers are only for AngularJS (1.x). We’ve reached out to the NPM team to get this corrected.

See https://npm-stat.com/charts.html?package=%40angular%2Fcore&p...
Yeah sure and I bet this will be the year of the Linux Desktop, too.
They're still around. I've put one together over the course of years, a) for nostalgia value, and b) for my children to at least be able to use the system I learned to program on.

Mine is a 464 w/ DDI interface, 64KiB RAM expansion, SDcard based "floppy" drive, mouse, and RS232 serial port. Still only a green screen, though, and I've yet to make a ROM box.

Also see:

https://github.com/Octoate/cpc-sdcc-rom/
Give a man a fire, he's warm for a day.
Set a man on fire, and he's warm for the rest of his life.
> I could compile kernels.

Compiler bloat is definitely an issue. There has been a lot of work that goes into intermediate representations and all sorts of optimizations that results in very diminishing or no returns for many use cases.

Runtime bloat is a much bigger issue. You have multi-stage runtimes that have an interpreter, a bytecode compiler, and a JIT. Huge amounts of RAM use and very CPU intensive. This makes sense for webGL games, but totally pointless for the common case of running tracking adware on websites whose only real content is a page or two of text.

The main problem are applications with poorly written event loops and memory leaks. That is why modern computing feels bloated. Slightly better compiler output or another 5% improvement in JS runtimes cannot solve this problem. It is a type of induced demand - the more RAM and CPU you have, the more accessible computer programming becomes to people who have very little idea of what they are doing and how to do it properly.
> There are some legitimate-sounding reasons to switch to GDP instead, but I think the real reason was GNP turned negative.

GNP never turned negative. If you mean GNP growth rate turning negative, well, if you look at real GNP and real GDP historical charts, the places where GNP growth goes negative line up pretty much with those for GDP growth, though GDP tends to have lower peak and higher trough levels.
If I had to point to anyone, I'd say that Satya Nadella is being giving a lot of credit for a major turn around at Microsoft.
> AMD ships microcode update to disable branch prediction

Mods, please fix the title. The patch adds ability to disable indirect branch prediction sometimes. This is not nearly the same as disabling all branch prediction always.
The Art of Electronics by Horowitz and Hill

It covers nearly all aspects of electronics both theory and practice. It’s still relevant after all these years.
The GDP is only an approximate measure and is only roughly correlated with wealth.

There are many things that contribute to GDP but do absolutely nothing to increase wealth, prosperity, or productivity.

This funny video reminds me of that: https://www.youtube.com/watch?v=HBgJqgUmSZE

Summary from the video:

Person A says he'll pay Person B $20K to eat poop.

Person A does it.

Person B says he'll pay person A $20K to eat poop.

Person B does it.

Nobody is wealthier. They both ate poop. Yet $40K was contributed to the GDP.

Moral of the story: Don't eat poop.
ELI5 how having a timestamp with resolution in the range of nanoseconds allows spying on user activities and how they are actually accessing performance.now in a user's session (ad? extension?)
> "What about the women who are the predators?" the author claims, though the #metoo was fundamentally about sexual assault, not specifically men assaulting women.

It's strange that amidst all the coverage, Corey Feldman's bravery has gone largely ignored.
It's apparently a pretty controversial position to have now, but I'll say it again:

Leave JS off by default. Whitelist sites that absolutely need it. Running completely untrusted foreign code on your hardware has been, is, and likely will continue to be a source of security problems.

As a bonus, you get to enjoy much faster-loading, nearly ad-free and cruft-free pages on almost every site. Now couldn't be a better time to try it out.
I don’t want zero days published before Apple has a chance to fix.

Because you think you are safe until publication?

What kind of "if I don't know about it, it isn't happening" worldview is that?
Abstractions – illustrated by 3 sad tales of the slow app. talk slides
I don't disagree with the premise, but given that nobody can afford to make the actual 'engine' part of a search engine other than Microsoft, Google, Yandex, and Baidu you're pretty much stuck with having your queries ending up at one of the four anyway.

Masking front ends are ok but not any more effective than say using Tor to route your search requests.

Today this suggestion, you should use a private search engine, is equivalent in my mind to you should only use cash to buy things. When you have a panoptic view of both, digital and commercial activity the ability to create a reconstruction of what you have been doing or thinking through meta-data analysis becomes quite difficult to avoid.

At this point having your browser spam with other searches as a fuzzing technique would be effective.

I suggested (only half joking) that a fundable startup might be a system where subscribers send in their license plate and for $10/month or something every month they will get an envelope with one, two, or three other license plate symbols printed on magnetic material to stick to your car. It doesn't have to look like a license plate to you and me, only to an automated license plate reader which leaves a lot of room for avoiding state laws about having multiple plates.

The idea being that members plates will be thoroughly mixed with a bunch of false hits in license plate reader data bases everywhere making use of that data impractical for your enemies.
If you don't want it to be flame bait I'd suggest you phrase it more politely.

Feminists didn't put a gun to the leadership of NYT and demand they do what they did. They reacted in the dumb ways that any corporation scared by the idea of bad PR would and do regularly, and have been appropriately chastised for it.

Both sides of this get it wrong: Women are cast as hapless victims way too often, and their opposition in turn over-simplify every case, ignoring power dynamics, social pressure, and the numerous other completely legitimate reasons women have to say yes when they want to say no.

This is going to be a long and painful process, but it's overdue, and necessary.
Absolutely, I didn’t mean to imply that they weren’t lazy in this particular case, I just wanted to make sure because I often hear people dismiss actual problems (eg recently I heard someone say that most people with anxiety are making it up...). Obviously that isn’t the case here, but I sometimes feel compelled to defend people who might suffer from burnout/anxiety/depression/etc, so I wanted to be sure.

But, sometimes, laziness really is the thing.
fixed the capitalization.
I'll have to figure out whats locking up the scrollbar in the CSS though.
Who are you to say that a person eating poop doesn't create $20k of value? Someone did, after all, pay them $20k to do it...
Yes? In an ideal society the company would create the treatment and the government would foot the bill for the citizens, followed by costs lowering over time as new advancements are made.

There are already a bunch of extremely expensive treatments for diseases and afflictions that affect a small portion of the population. Some of which are fatal if not treated. Should they be expected to just die because the treatment is as you said 'really really expensive'?
Yeah, it's kind of annoying when you click on an article that looks interesting and it's locked up behind a paywall
Ask HN: Is there any scalable “blockchain”/cryptocoin?
Hi,

I am wondering if there is scalable cryptocurrency (maybe with smart contracts feature) having typical "blockchain" properties of trust?

Best,
Wiktor
It varies a lot by field. I'm a computational biologist and have dealt with both the CS and biology ways of doing things. In CS you send a formatted LaTeX manuscript to the publisher and they basically just print that, but the traditional biology way is just to send a Word document with little formatting at all. It is considered the job of the publisher to turn the Word document into something that actually is formatted.
Microsoft has since shortened the title somewhat. It used to be Important information regarding the Windows security updates released on January 3, 2018 and anti-virus software.
Most news outlets did a really poor job being clear about what the picture was of. (Yes it was staged to look like he might have been touching; and at a glance in an airport on a muted TV many probably thought that's what he had done.)

Context and detail matter. Our TV culture is toxic in that it vastly over-simplifies and rapid fires everything.