skysight-inc/HackerNews huggingface dataset:
I think a discussion on Steve Jobs' morality is among the least productive uses of this excellent essay.

Yet I'll add that people are complicated. In terms of his accomplishments, it is undeniable that Jobs was a force for good. As for his motives and methods, I have no trouble believing that Jobs (and the vast majority at Apple) used the image of counterculture in good faith, even while they changed it into a sort of hollowed-out version streamlined for capitalism.

Yet there are some positive strains of this myth Apple created that have an impact on them until today: the willingness to focus on small segments of the market or to quickly abandon legacy technology come to mind. Their affinity to the arts and humanities is also still palpable, and certain political decisions, such as their willingness to invest in clean technology or to support the LGBTQ community also seem to be rooted in spirit of the revolutions in the 60s.
`requirements.txt` has a linux only wheel - any help on getting it running with OSX?
The problem with coarsening timers is that many things can be used as one. Performance registers, received packet timing are just the obvious ones.

This problem has been studied a lot. The venerable TCSEC Rainbow Series dedicates an entire volume to covert channels (the light pink one iirc).

It is a statistical problem. Even if you reduce the timing precision or randomize it and effectively raise the noise floor, it just takes a little bit longer for the attacker to get his data.

A good analogy would be Differential Power Analysis (DPA). Measurements are collected over a period of time to enhance the signal.
The 10 Must-Have Features for Your Website
The exact definitions vary by country, I am not sure how it is precisely in the USA. In Australia, basically it means the company is not for the benefit of any given person and you cannot distribute profits by taking them and chopping them up - and you must distribute any leftover funds if the organisations winds up to a like-minded not-for-profit organisation., You can still however make money, pay employees (even if it's a large amount) for work done, etc.

Not-for-profits are also sometimes conflated with Charities. In Australia they are two different things, a not-for-profit can be a charity and vica-versa but they don't need to be both.
If P1 plays randomly and P2 plays all rock, then this is not a NE as P1 has an incentive to switch to all paper
You're incorrect. They have no reason to fear punishment from a wrong call.

For one, the law doesn't require deletion. They just have to make it publically inaccessible pending outcome of inspection. And if they're unsure about the legality they can punt it to another org and won't suffer consequences.

In fact, the law even stipulates that the data must be retained for 10 weeks to allow further action.
You missed the point, it implies criminal if he sold down differently this time. The contractual details are only important in so far as they dictate his behavior.
It will be easier for Toyota and Honda to get up to speed on electric drive train production than for Tesla to get up to speed on mass production of automobiles.

Tesla has an electric drive train, they have a car production line and they are producing electric cars.

Assuming it takes Tesla three years to reach their output goals on that production line, it will need to take Honda and Toyota less than two years to get up to speed producing fully electric drive trains, installing charging infrastructure around the world, and rebuilding their downstream in order to even have a chance of competing with Tesla in the EV market.

Nissan is the only viable competitor, and they have been competing on price against Model S. The Leaf is not a competitor to Model 3 even in the same price bracket. There simply is not the infrastructure to support the Leaf, or the salesforce willing to sell it.

This race is not just about a manufacturer building electric cars. This race is about who will be first to kill off or convert their traditional downstream to get EVs on the road at reasonable prices.
Empowering designers for faster iterations on live websites
you're not an ethnic minority, are you? You have no clue what it means for society to be unfair, and it has nothing to do with money.
Opinion: How blockchain can protect our personal data from hackers
Your code may be, but I would think most code isn’t CPU bound nowadays. If so, that may lessen the impact on Intel quite a bit.

Or does this indirectly affect network and disk speed, too?
There is a bit of a background to this that I don't see mentioned in any of the comments.

Since last summer's WWDC, Apple's policy regarding "templated" or white-labeled apps has bounced around quite a bit. At one point they suggested that cities (for example) would be required to develop their own "custom" app rather than purchase an appropriate white-labled app from a vendor. They imagined that the functionality could be provided via an SDK that the city would use to build their own custom app. Pretty much a non-starter for all but a very few large cities with a significant IT department.

In any case, they have landed on a policy that requires the apps to be published by the municipalities directly rather than via the vendor. This isn't entirely unreasonable as it provides a strong signal to users that the app is "official" and lets the city promote their own brand rather than the vendor's brand.

So apparently as a concession to the administrative overhead that this change introduces for thousands of apps and organizations, they have introduced this fee waiver.

All in all, I think they ended up in a reasonable place but the last six months have been pretty frustrating as Apple figured this all out.

https://techcrunch.com/2017/06/21/apple-goes-after-clones-and-spam-on-the-app-store/
https://techcrunch.com/2017/12/20/apple-revises-its-controversial-guidelines-on-template-based-apps/
I suspect that in a society without an endless convenient supply of sugar, the body is much more accustomed to using ketosis to generate fuel. We find it very difficult to turn on that pathway, typically through extremely aggressive carb restriction (<20g/day).
There are other side channels where an attacker cannot cause the desired operation to be repeated thousands or millions of times back-to-back..

If Alice performs an operation only once, and it leaks sensitive data through a timing variation of 100-200ns, Mallory is in great shape with a 1ns clock source and in pretty awful shape with a 10us one.
Disclosure: I work on Google Cloud.

If you run a multitenant workload on a linux system (say you're a PaaS or even just hosting a bunch of WordPress side by side) you should update your kernel as soon as is reasonable. While VM to VM attacks are patched, I'm sure lots of folks are running untrusted code side by side and need to self patch. This is why our docs point this out for say GKE: we can't be sure you're running single tenant, so we're not promising you there's no work to do. Update your OSes people!
It’s common for stress-testing overclocking, too: https://en.wikipedia.org/wiki/Prime95#Use_for_stress_testing
Show HN: Autotutor - High school maths/physics exam practise website
Medicaid will pay as blindness is a qualifying disability. It’s a second payer though which is why some people will go through insurance first.
i just started. loving this book so far.
TL;DR: Nothing worth reading.
In my experience, engineers tend to fetishise the sciences to a degree even scientists don't. Physics and math are among the most influential, and their biggest successes were build on reductionism, or the ability to split large problems into smaller, manageable units. The first instinct is not to immediately solve a problem, but to reduce its size. They also seek axioms, i.e. simple, universal truths from which to build larger solutions.

This approach quickly turns into frustration: people behave irrationally, for example, which turns economics from an offspring of mathematics into something more akin to applied psychology. Laws fail to live up to a standard of "plain meaning", because the myriad conflicts of life are to nuanced to be exhaustively captured in simple language. That's where the distrust of the legal system, as well as "smart contracts" come from.

It's interesting to compare engineers and scientists in this regard: the most successful scientists tend to have a vast appreciation of culture beyond their field of study. Richard Feynman, for example, excelled in music and painting, and became a bestselling author.
> What would have happened if the AMD developer on the LKML hadn't said "AMD chips aren't affected by [one of the bugs]" before the big public post?

Why wouldn't they say it that way. It seems he was responding to a (justified) overreaction to mark all x86 chips vulnerable and so he pointed out explicitly that AMD wasn't. Why let his company get dragged down along with Intel unnecessary. So it is not like he jumped out on Twitter and broke "the embargo" with something like "Ha, ha, Intel is so screwed".

> the big headlines would have all been about "major class of speculative execution bugs

That's what Intel basically said in their PR response. But so far it seems the Intel (and maybe ARM) only bug (Meltdown) is far more serious than the Specter one. So even saying everyone is vulnerable would have been technically correct but a bit unfair toward AMD, wouldn't you say?
Harder to mass market, hire and develop tools without television, internet and also the dependency on other things not yet invented, freeing up of capital and access to credit
This is an exam practise website targeted at high school students. I collaborated with my father in developing it. The tech stack is PHP/MySQL/Javascript. No frameworks, just jquery and google charts. Everything else is custom code.

Any feedback or tips on marketing or desired features will be much appreciated :-)
They would be in the same position as they were before, only without that system it wouldn't be worth researching the drug to begin with.
It's funny how Germany is not in the "unable" list but I still got this answer:

"Thank you for your application to join GitLab. Unfortunately at this time we do not have an entity or payroll solution to hire employees in your country and do not have a business need for contractors in this jurisdiction currently."
I have a hard time believing that senior Intel engineers were ignorant of the potential issues here. Cache timing attacks have not only be known for well over a decade, but actively exploited. And it doesn't take a genius to consider the interaction between cache latencies and speculative execution. The thought has crossed my mind (and I'm neither an EE nor a researcher), but like most people I assumed the CPU obeyed page protections consistently and didn't bother testing the assumption. At least some Intel engineers working on these chips wouldn't have had to assume anything, and if the issue hadn't crossed their mind we probably have bigger problems--sheer incompetency.

More likely than not, the misfeature was a calculated risk, either at inception or after the fact. And I bet Intel has had investigators quietly doing damage control internally for the past several weeks or months in anticipation of subpoenas.

Some ARM CPUs apparently can leak system register values, a much narrower version of the Intel design issue. And I'd bet that was also a calculated risk undertaken at some point in the design phase.

On the flip side, it's not a coincidence that AMD isn't vulnerable like Intel and ARM chips are.

Ultimately I don't think the issue is that people are blind to the problems, it's that they systematically underestimate the potential for exploitation. And ultimately that's because of the economics at play: at the end of the day even if, theoretically, Intel lost some huge class action suit, they'd still probably enjoy a net gain for their misestimation of the risk.

And it's not just Intel. Otherwise good engineers are absolutely confident that containers and VMs provide strong isolation guarantees, despite years of exploits, simply because were the marketing and technical literature completely true and accurate it would make it cheaper and easier to design and deploy software services. It's motivated thinking, not ignorance. Every time these exploits come out nobody is particularly surprised--it's always 100% obvious in retrospect, and it would be 100% obvious prospectively if the incentives were better aligned.
Sure, that kind of stereotyping by parents teaching their children to be bigots is probably harmful overall! Harmful neighbor country rivalries last centuries, probably because of just this kind of reinforcement. Then every now and then you get a Kosovo or a holocaust.
It is pretty common for an article that is written about breaking news like this to be heavily edited as time goes on. The last edit on the article is listed as occurring after I left my comment. I would bet the original headline was written in a rush and eventually one of the editors at Reuters had the same objection as I did and rewrote it with a less negative slant. In fact, the current headline is even more positive than the one I last saw and that currently appears on HN. They appended "despite progress" at the end.
Sams Teach Yourself C++ in 24 Hours (5th Edition)
Those opening generalities are addressed in the paper and supplementary information. I really don't care for this derailment.
Reddit does geofence some subreddits in at least Germany, returning status code 451
The invention that took a long time to come up with was agriculture. That was the killer invention.
There are many dedicated servers that are shared across users or clients and were expected to be isolated.

Any user who has access to a system (developers or support or sysadmin) has the ability to read arbitrary memory. The vulnerability can probably be leveraged to privilege escalation or bypass the isolation.
> crippling all userspace applications seems like going too far.

Depends on the system IMO. I certainly want the TSC when I'm profiling something highly-performance-sensitive on my workstation. Yet I am hard-pressed to see why any userspace app on my Mom's chromebook requires a ~1ns counter.. some stuff there may be currently using it, but that is different from "actually requires it"/"should continue to have it from an overall cost/benefit point of view".
I think hate speech is a bit like drink driving. Perfectly harmless itself but can cause follow-on real world problems that do impact people's lives - ie discrimination in hiring/etc.
Other than the i3, which has a 125 mile range, all of BMWs other vehicles are hybrid rather than true EVs. Yes that’s probably the way the market will go (Toyota offer a hybrid option on nearly every model now), but it’s not really the same as a true EV like Tesla.

Also both Audi and MB have hybrid and full EVs (well VW who own Audi, and share the same platforms).
When your deep into marketing, your only vision is to promote your brand
My topcolor is #abcdef. I’m also quite fond of #123456 (though not as a topcolor).
https://en.wikipedia.org/wiki/Tobacco_packaging_warning_mess...
What I have found helpful when feeling paralyzed by options is to create more easily digestible goals. Sure you may be not be able to do everything, but what can you do now? Even if you don't have much free time, if you're able to hit your bite-sized goals, the feeling of progress is what can help you feel motivated.

Let's say you're a developer interested in design, and you have a goal of creating the best-in-class application for whatever, but you're not too knowledgable about the design process. Instead of diving into the deep end of UX patterns, usability studies, tests, validation, platform-specific do's and don'ts etc. — start by picking apart your favorite app, and really dig into what makes the UX great, or what doesn't, think really deeply about the problems they're trying to solve and why. Take lots of notes.

Don't have time for that? Let's break the goal down further, and start by thinking about what your top 5 best-in-class apps are and why you think they're great. This can be as high-level or as deep as you want, so long as you're hitting an achievable self-made goal on a regular basis to keep you going.
Favorite stance:

> Or, well, just anything that is not a web browser masquerading as a text editor.
You might cause backslash in other direction if you are too militant. Ultimately, kids want the same as other kids have once they go to preschool.

Also, the association between apparently girly and bad or dumb is not healthy if you happen to be girl.
Ask HN: What are the most difficult aspects of home gardening?
Gwern has done some self-experimentation and found Vitamin D to negatively affect sleep https://www.gwern.net/zeo/Vitamin-D
Tion system with Node.js from scratch
This argument assumes its conclusion, as well as relying on some extreme edge cases (how many people have 15 children in real life? Hardly anyone). Also, I'll take that patch of desert, not least because I like my solitude.
Yes they will exploit it. But I think the real problem is, when you don't know if what you see/hear is advertisement.
Like seeing a news paper article which is actually advertisement. Or a blogger who says a phone/shoes/etc. is the best she/he every tried. While it's actually bought advertisement.
There used to be a monthly news magazine to provide examples of the "Lies of Our Times" - https://en.wikipedia.org/wiki/Lies_of_Our_Times
Nicely done. Words like 'is' incur liability because it can be interpreted as making factual statements that you could be held accountable for. Hurry, get your law degree so you can skin Intel alive ;)
Overview of Red development history
In the simplest Meltdown case, the offending instruction is really executed and a General Protection Fault occurs. That is handled in the kernel which at that point could (simply?) flush all caches to remove the leaked information.

The real problem with Meltdown seems to occur when:
1) The offending instruction is NOT really executed because it is in a branch which is not actually taken.
2) The offending instruction is executed but within a transaction, which leads to an exception-free rollback (with leaked information left in cache though).

AFAIK neither is (or can be made) visible to the kernel (which could explain the very large PTI patch), but I do wonder if they are events that can be hanlded at the microcode level, in which case a microcode update from Intel could mitigate them.
You keep saying that but you haven't read the document. Basically it says 'there are pros and cons' but we still recommend the drug. Very little explanation on to why, and on that consequences on long term use of the drug. There is basically zero study there on the consequences on what they advice, just educated guesses and they tell you "yeah do it but check with a doctor regularly". This is not science.
Kind of shady, I don't think I will write on this platform anymore.
You can change the colour of the logo with CSS filters, something like this:

[href="https://news.ycombinator.com"] > img {
filter: hue-rotate(-50deg) brightness(150%);
}

… but that doesn’t fix the favicon.

Some of the other bits done in JS can be done in CSS; this snippet, for example:

for (let i = 0; i < document.getElementsByTagName("font").length; i++) {
if (document.getElementsByTagName("font")[i].getAttribute("color") === "#ff6600")
document.getElementsByTagName("font")[i].setAttribute("color", "#FF83C6")
}

This is very inefficient (though document.getElementsByTagName is probably O(1) due to its return type HTMLCollection being live, so the end result is probably still only O(n) on the number of <font> elements in the document; it’d be O(n²) with document.querySelectorAll); you should only get the <font> elements once, like this:

const fontElements = document.getElementsByTagName("font");
for (let i = 0; i < fontElements.length; i++) {
if (fontElements[i].getAttribute("color") === "#ff6600")
fontElements("font")[i].setAttribute("color", "#FF83C6")
}

It can still be made more efficient, but all I wanted to do was rewrite it in CSS anyway:

font[color="#ff6600"] {
color: #ff83c6;
}

Same deal on the table cells just above it:

for (let i = 0; i < document.getElementsByTagName("TD").length; i++) {
if (document.getElementsByTagName("TD")[i].getAttribute("bgcolor") === "#ff6600")
document.getElementsByTagName("TD")[i].setAttribute("bgcolor", "#fbbfdf")
}

Use this CSS instead:

td[bgcolor="#ff6600"] {
background-color: #fbbfdf;
}

On the performance matter, a rule of thumb: don’t call getElementsByTagName, getElementsByClassName, querySelector and querySelectorAll more than you absolutely have to. Or anything, really. Cache things in temporary variables aggressively. Take these two lines, for example:

document.getElementsByClassName("pagetop")[0].innerHTML = document.getElementsByClassName("pagetop")[0].innerHTML.split("|").join(" ")
document.getElementsByClassName("pagetop")[1].innerHTML = document.getElementsByClassName("pagetop")[1].innerHTML.split("|").join(" ")

You’ve evaluated `document.getElementsByClassName("pagetop")` four times instead of once.

const pagetops = document.getElementsByClassName("pagetop");
pagetops[0].innerHTML = pagetops[0].innerHTML.split("|").join(" ")
pagetops[1].innerHTML = pagetops[1].innerHTML.split("|").join(" ")

Even then, this indexes pagetops twice as often as is necessary, but that operation is quite a bit cheaper than getElementsByClassName. I’d say then to use for..of or forEach or similar, or assign temporaries.
Meltdown, reading arbitrary memory through a side-channel
>>> By "user to root privilege escalation", I'll assume you mean leaking kernel data without root, since this attack doesn't directly allow escalating privileges at all.

The attack allows to read all the memory. Isn't there a way to scan for passwords or ssh keys and turn that into a privilege escalation?
They said it wasn't the paragraph before
Eelo’s crowdfunding success shows how important data privacy is for users
The feature was previously hidden behind a about:config option[0]. Not a ff user but might check if it is back and for now let your users now?

Is chrome or edge affected?

Should the SharedArrayBuffer mdn page be updated; or maybe moz://a will fix it quickly enough to allow it on by default again.

By the looks of it, this will affect a lot of webgl code.

[0]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
Tesla misses its Model 3 Q4 production goals (already halved) by another 47%
One thing is s3/gcs latency. On my last job we had a Go server running on ec2/gce and do some occasional read from s3/gcs (same, single region). We used to be running on ec2+s3 but later switched to gce+gcs for cost reasons (gcp only costs ~60% of aws' cost for our setup). But the thing we noticed was that when we were on aws reading ~10KB single file from s3 usually takes <100ms, occasionally hit 100ms+ but rarely hit >200ms. On gcp that's usually >100ms, sometimes hikes to >1s and rarely goes <100ms.
We talked about NSA and how people are leaving for greener pastures. Wondered two things:

1) Have any of them ended up in Project Zero or working on stuff like this

2) Wonder if NSA knew about this vulnerability and now someone there in a windowless office is sighing saying to themselves "Welp, another backdoor we can't use".