skysight-inc/HackerNews huggingface dataset:
The patches you're seeing go out amount to little more than hacks that try to stop the CPU from doing branch predictions in some cases. It depends on the CPU, really. For example, and this is just a guess, netburst-era Intel CPUs may have even more of a hit as they relied on deep pipelines to get higher clockspeed, and any step in that pipeline may do a branch prediction.
Makes sense: since he noticed the calendar counting backwards he hung around to collect the holy foreskin and then waited until the Popes evolved and became powerful enough so he could give it to them.

It’s the simplest explanation.
I think the main takeaway should be "speculative execution creates exploitable side-channels, and you should assume your hardware is exploitable until proven otherwise." AMD and ARM are probably still exploitable with unknown exploits, possibly even at Meltdown-levels of exploitability, but people haven't taken the time to reverse-engineer the microarchitecture enough to find the exploits.

If I were developing processors, I'd be having emergency meetings on trying to craft exploits to figure out where our processors' weaknesses are. While being happy that Intel is getting all the bad PR for this and I'm not.
Nuclear weapons can hurt other people. Me using drugs can only hurt me.
Wright brothers spent about a decade to build a machine that can fly. Their cycle shop paid for it.
I use hnreplies.com, and it works pretty well. But it goes through periods of not working at all.

The problem with these services (there also used to be one called hnnotify.com, which didn't last long) is that they're developed by HN users, who don't seem to care enough to keep the services working 100%.

YC seems to prefer a development model where the community fills in the gaps of missing functionality, but this also means you can't expect much from the resulting services. I would much rather have this built into HN.
The problem I see with this concept is ROP mitigations like Intel’s control flow enforcement don’t seem compatible with intentionally using tweaked addresses with ret. The address they inject won’t match the shadow stack and the program will be terminated.
I do wish a different acronym had been chosen. When I search for "[language of choice] JWT" pretty much all results are relevant. But even if this new token schema takes off it will forever be a hassle to find relevant results for "[language of choice] PAST".
Is there an easy way to track donations from alcohol/big pharma lobbyists to the Republican party? I'm betting quite a bit of money, rather than concern for the prole's welfare, is behind this.

Sessions said this in March: "I reject the idea that America will be a better place if marijuana is sold in every corner store. And I am astonished to hear people suggest that we can solve our heroin crisis by legalizing marijuana – so people can trade one life-wrecking dependency for another that’s only slightly less awful,” he told law enforcement officials in March. Our nation needs to say clearly once again that using drugs will destroy your life."

As it happens, a person close to me who was a true alcoholic (physically dependent, would have seizures if they didn't drink, tried AA and failed through the 12 steps a number of times) successfully stopped drinking by choosing to safely vape pot instead. They vape about every two days. How exactly did pot destroy this person's life?

- edited to add big pharma
Intel tacitly threw them and ARM under the bus, IMO, when Intel named them specifically and unnecessarily. It seems AMD do not wish to return the favour.
Based on the description here: https://googleprojectzero.blogspot.com/2018/01/reading-privi...

These attacks are very practical. Unprivileged code, doing nothing inherently wrong (so very hard to detect), reading arbitrary memory locations contents at a rate of about 2000 bytes per second.

Another blog somewhere (I no longer have the URL) indicated that the Google group that helped discover the issue also managed to read arbitrary, normally inaccessible, memory locations from Chrome by running JavaScript. Which makes the attack feasible remotely using nothing but a properly programmed malicious website.
Collection of 1.4B Plain-Text Leaked Passwords Found Circulating Online
> Me using drugs can only hurt me.

Only if you exist in isolation from the rest of the world, surely. Otherwise there's family, friends, anyone you might hurt whilst under the influence (verbally, physically, etc.), and that's ignoring the indirect effects of the drug trade.
Ran into this one at work. We wanted to have a public imac as a simple terminal for clients to use our website and set things up. Nothing that needed to be super secure, basically just to walk them through the interface of our stuff etc if they asked, and that we could leave them alone at without any ability to bork the system.

This ended up being such a crapshoot that we had to buy deepfreeze because even the freaking guest account doesn't consistently work the way it should(or, hasn't worked consistently across versions of OSX over the past few years) and basic things like auto updates of software/the OS kept breaking if someone didn't regularly sign into the admin account.

It turned from a quick project that should have been easy and apple-y with basic security settings and enabling auto updates into something that someone from the team has to grab a checklist and verify once a month. It's a complete joke.

It's worth noting apple literally buys deepfreeze for the systems in their own stores. You'd uh, think that their own functionality in the OS would be able to handle that.
Cannabis use isn't the solution to opioid deaths.

Other countries have strict laws about cannabis, and those laws are enforced, and they don't have the problems of opioid deaths that the US has.

The real solution to opioid death is adequate treatment for pain; and treating addiction as a health problem not a criminal justice problem.
Will linux distributions automatically use this compilation option (or its analog in GCC) for packages from now until forever, even if a faster mitigation is added to CPUs?
In a free-market R&D ecosystem, sure. The issue is, do we want that to be how it works. And its debatable how much of the initial cost should be loaded onto this cure, as the work builds on other work, and the technique will produce more interesting results in future.

And in this case, does it boil do to publishing the dna fragment? Is this another 'patenting a number' discussion?
>If you would have used Jenkins pipelines
Nice, way to start off with an ad hominem attack. Yes I'm lying to you about having used pipelines. That's what I do, I go on hacker news and lie about what I do, especially jenkins, to throw people off the scent. Seriously... if people dont know that pipelines are easily debuggable, that's a problem with the documentation, not with the person. It's also not a reason to attack people.

I have used jenkins pipelines. However I didnt use it from scratch so no, I couldn't do what you said due to all of the other issues. My point is that it does let you hang yourself, I prefer the config based systems as it's harder to hang yourself.

Your NodeJs anology is more apt but who cares you got the point. This is a discussion not a literature critique.

A dev framework to me is the type of stuff you've built up around a typical compile of a given "stack". For instance, doing ruby on rails, you're likely to have a bunch of build tooling you've built up to make that easier. I would prefer to distribute that stuff more generically and unrelated to jenkins vs some other build system, as opposed to building it all into jenkins.

As for mutating workers... you seem to be under the mistaken notion that I'm discussing the one thing you are discussing. But in general, if you have a turing complete language with complete system access like you do in the groovy, you can do anything and anything isn't always a great idea. I like the config based systems as it doesn't allow you to do anything, it allows you to do things we've deemed as good for building software. Jenkins boxes end up being shared resources in a large company so it's very difficult to audit what everyone is doing and side effects they are causing.

>Fail to see how that vague statement supports your argument.

Ok

>You can reuse the groovy code you write, which means you actually get more reuse.

You can but most people don't know how to or dont. It's a break from your typical dev loop and it's yet another framework to learn. I don't think it's effective unless you dive in and most people don't dive in. So to me it's a bad model. This is opinion.
Announcing Rust 1.23
Appcanary joining GitHub
Symfony Tutorial: Building a Blog (Part 2)
This document has performance impact estimates from Red Hat Performance Engineering: https://access.redhat.com/node/3307751
We forget that America cares very little for democracy, being largely an oligarchy.
Fuzz Stati0n Pivots to Node JS
State Governments Are Already Gaming the Republican Tax Overhaul
Thanks for taking the time to answer my questions. Excellent advice.
It's sort of been well-known that speculative execution opens up the possibility of side-channel attacks for quite some time. Hell, it's long-known that SMT (e.g., HyperThreading) can leak keys in a not-really-fixable way.

What's new and surprising is the power of these side-channel attacks--you can use these, reliably, to exfiltrate arbitrary memory, including across privilege modes in some cases (apparently, some ARM cores are affected by the latter vulnerability, in addition to Intel).
https://news.ycombinator.com/item?id=16070817
* https://unix.stackexchange.com/questions/396192/

* https://unix.stackexchange.com/questions/360830/
Fighting Fires with Fire Grenades
> on any non-shared non-virtualized system is there any reason to enable these workarounds

Does the non-shared non-virtualized system have any encryption keys in memory that you want to protect?

Do you use full-disk encryption or ssh to other machines or use a cryptocurrency wallet?
Most attacks aren't targeted at specific people. Hackers don't want to read your emails, they want your credit-card information, digital account passwords, or to compromise your computer to use in their botnet.

Sure, you might not have anything you want to hide in your life, but the drive-by javascript doesn't care about your secrets - it'll hack you anyway. Best-case scenario, you lose access to a bunch of accounts you used to use and need to create new identities from scratch. Worst-case, they clean you out financially, steal your identity, etc.
The trend is integrating security into the DevOps lifecycle (DevSecOps). At GitLab we already do SAST and are working on SAST for containers with Claire and DAST. I looked today but couldn't find a good IAST solution that was open source.
Can you confirm you don't plan to use the email addresses for any other purpose? It should be indicated on the page.
I concur with sibling commments that while a net positive a github profile is be unlikely to be given much weight at a FAANG company. Unless maybe it shows experience on something directly related to the particular team you're applying for. Performance in the interview is really what matters.

I also concur that getting a referral from an any employee that you might meet is the better than just blindly sending in your resume, though not as good as a strong referral (i.e. someone you've had direct experience working with before). You will get more attention from the HR side and the employee referring you will have a better idea of what teams will be relevant than the HR people will.
The hair was the giveaway to me. I stared at the two "which one is real" images for a couple minutes thinking, "They both have that fake looking wavy hair, I thought for sure neither was real."

Cheap trick NYTimes. Cheap.
Just a reminder - we were naked for most of our history and were able to survive.
Well, critical applications, like flight systems, run on a different ecosystem and are verified. (And it costs a lot.)

But my usecase might be a physical computer that isn't networked which does data science with some programs and prints out results.

These patches are focused at Amazon and cloud providers that are in the business of running separate individual's applications on the same machine.

In the consumer world, the slope would be browser scripts and user applications that aren't running as super. But even then, do you download and run software that you expect might steal information or damage your computer?

These are fundamental security questions. Creating rings and sandboxes are what create the assumptions of privacy and security.
One thing I saved a lot of money on last year was with farm CSA's, where you put upfront $500 or so and then receive a box of veggies and eggs every week for the entire season that works out to about $20/week (or $15/week depending on single person). This assumes there is some farming where you live but BC, Washington, Oregon, California all have these CSA schemes. Because I consistently had so much food around I stopped eating out so much as well. Before I did this I would usually stop by a grocery store on my way back from the university lab every night and spend about $10CAD, so $300/mth or so VS $80/month, for 5 months.
A month ago I ran benchmarks on CPUs vs. GPUs on Google Compute Engine, and found that GPUs were now about as cost-effective as using preemptible instances with a lot of CPUs: http://minimaxir.com/2017/11/benchmark-gpus/

That was before preemptible GPUs: with the halved-cost, the cost-effectiveness of GPU instances now doubles, so they're a very good option for hobbyist deep learning. (I did test the preemptible-GPU instances recently; they work as you expect)
> Personally I'm not sure either way, and I think being sure (either way) is just naive.

I think it's worth pointing out that there's lot of space between "absolutely sure there is" and "absolutely sure there isn't", and I doubt any fairly intelligent person actually holds either of those absolute positions. Which is to say that really, the arguments are over the degrees to which we think it's likely there is life, or intelligent life, elsewhere.
Amd claims that two of the three spectre attacks don't work on their hardware and the last one (variant one) is fixable with negligible performance impact.

https://www.amd.com/en/corporate/speculative-execution
A new Wireless Router for Home that you should Buy
This unfortunately also affects almost all mobile apps and modern Windows installations, as they all run Javascript-enabled ads. Maybe this might cause Microsoft to reconsider what it allows to run on Windows but I don't see mobile ads going away any time soon.
I'd still love to know the details.
Police unions are also uniformly opposed to legalization, as it will reduce the need for police by definition if the hundreds of thousands of "crimes" per year vanish into smoke.

Fewer officers, less money and less power.

Of the 8.2 million marijuana arrests between 2001 and 2010, 88% were for simply having marijuana (ACLU).
It looked like one of the proofs of concept was using javascript code to escape the sandbox and read memory from the browser's address space. So that seems to be quite a realistic attack vector, right?
don't take my word for it, but I'd bet you could disallow LAN comms on port 80 and prevent this. Typically a toxic client would flood the arp table until the router believed the toxic client should receive all communications and then the toxic client would mitm and forward traffic on the expected port to other normal clients...if the toxic client can't send stuff on port 80 to a normal client they can't easily mitm them
IIRC, the Google Project Zero folks went ahead with the announcement early, because what had already leaked / been speculated, was so close to the truth. Apparently a bunch of smart people were paying attention to a recent set of kernel patches, and starting putting "two and two together" relatively quickly, based on the contents of the patches.
The 50% was for a microbenchmark of C++ code making heavy use of virtual. V-tables and jump tables get much more expensive. Any execution path that is known at compile time is not affected.
I really don't see the problems. It looks to me that people have an emotional dislike of these devices, and then try to rationalize arguments against them.

For example, by far the most common argument against these devices is that they could be spying on you by listening to your conversations 24/7. This is true, they could be. However, it's also true of cell phones, which 99% of the complainers have had near them 24/7 for the past 10 or 20 years. If you think the Echo is a terrible device because it could spy on you but you keep a cell phone in your pocket all day, you're trying to justify a negative emotional response to the Echo, not rationally analyzing the situation.

The comment I replied to above, by reaperducer, attempts to argue that the Echo is implicitly commoditizing me every day because I interact with it. This may be true, but does that also mean I'm being commoditized by Whirlpool and Moen and Philips and Tesla and Trader Joe's? If yes, then what does that even mean, and how am I meant to avoid it?

You then jump in with a vague hypothetical about a future update making the device start trying to sell me socks. I'm pretty sure Amazon isn't going to start putting ads in with my music or weather reports. If they do, I'll stop using the device. It only cost me $30. I've spent far more on devices that now sit on a shelf unused. That's just the nature of consumer electronics.

If you want to convince me that these devices are inherently bad or have massive inherent problems, it's really simple. All you have to do is tell me what problem they cause me that could be eliminated by getting rid of the device. So far, everyone who's attempted to do this has either stated a problem that wouldn't be eliminated (e.g. the spying potential or the daily interaction getting the brand into my brain) or a problem I don't suffer (e.g. getting ads).
Considering that every single function call into a dynamically loaded library will be affected, that negligible "otherwise" won't be so negligible in the real world.
You'll get an infinite number of snarky comments about the War of Northern Aggression back in the early 1860s but the more modern answer is yes states have taken cases to the Supreme Court with highly mixed results WRT nullification of laws. Its not really the kind of thing where historical batting averages have any influence on next weeks attempt, but historically I think individuals have scored slightly better with the Supreme Court than states have. Its also very fuzzy to categorize when the court case technically involves a private citizen who merely happens to be the states attorney general as his day job, is that a win for the state or just a win for some dude?
I assume that's why they were acquired. At this point, they were a little bit more of a "feature" than a product. I suspect this tech is driving vuln alerts on repos:

https://github.com/blog/2470-introducing-security-alerts-on-...
Revocation isn't such a big deal if you have short lifetimes in your tokens and do auto-refresh (which is quite easy to do in a single page app)
Which in some cases might make it cheaper for customers to use their own hardware, resulting in cloud providers losing business.
This might also be of interest: https://github.com/paragonie/past/tree/master/docs/02-PHP-Li...
But that also means you're missing the opportunity to educate the rest of the HN readers who would like to understand -why- something is bad (like me because we're rolling out public key JWTs). Even just a link to a blog post would be better than just "because I'm me and people agree".
Kansas (assumably) has a working general assembly and is perfectly capable of passing legislation at the state level to express their will in whatever way they see fit. Meanwhile, at the federal level, the will of the majority of citizens is what should be represented.
You're definitely coming off as an edge-lord for calling this inane. Today, I'm sure Twitter would melt because of it (you can't even have a shirt people don't like without causing outrage), but the country was very different back then. Plus these missions were more than a scientific endeavor, because it took more than science to put everything in place for it. It was the biggest accomplishment by us as a species, so they wanted mark it with what they considered the most important thing in their lives. To me it's cringey that you can't look at it objectively without taking some kind of offense to it. But hey, that's just me.
Bravo for attitude but we should not forget energy conservation rules.
>I also think Sessions should enforce every law

Do you appreciate what that would entail?
Laws exists on the books so that when the political class wants someone squashed, they can. They are swinging swords of Damocles above the throats of citizens that are snipped when convenient.
No, your ancestors were distant relatives, 2nd cousins etc...
Lenovo updates ThinkPad with Intel 8th-gen processors, USB Type-C power adapters
I'd prefer it to be builtin too. Just a number beside my username in the top right, that when clicked, takes me to a list of comments and submissions that have been commented on.
Hmm, I like that you're not sure whether someone has replied to you.
If a state like California sets up an imprisonment scheme under it's laws that violates federal law (to choose an example that has happened recently), it's still illegal prison overcrowding, not legal prison overcrowding.

A system under state law in violation of valid federal law is, because of the supremacy clause, an illegal system.
Nocturnal bottleneck
> The nocturnal bottleneck hypothesis is a hypothesis to explain several mammal traits. The hypothesis states that mammals were mainly or even exclusively nocturnal through most of their evolutionary story, starting with their origin 225 million years ago, and only ending with the demise of the dinosaurs 66 million years ago.
I'm sure conservatives would put up w/cannabis in exchange for effectively overturning Roe vs Wade, which is the effect this would have precedentally.
Has there ever been discussion about a permission for "running as an app" that would make a distinction between web pages and apps? I like that the web gets more features that allow apps to run cross-platform, but I don't fully understand why we make no distinction between pages and apps.