skysight-inc/HackerNews huggingface dataset:
> So let's look at the facts. The bones in your body are made from material which has a tensile strength of 150MPa, a strain to failure of 2% and a fracture toughness of 4MPa(m)½. For a structural material that's not good. We can make alloy steels that are ten times better in all three of those properties.

Regular structural steel, used for all sorts of typical building applications, has a yield strength of 250MPa and an ultimate tensile strength of about 400MPa. So bone with it's 150MPa tensile strength, about 60% that of steel's yield strength, is pretty good!

For comparison, typical structural timbers have a tensile strength of around 18MPa.
52 weeks/year, 40 hours/week = 2080 hours. You can turn those knobs up/down based on vacation, non-billable time, etc, but just to pick a number, let's say you have 1,500 billed hours per year.
$250,000 / 1,500 hours = $167/hour.
I know car mechanics who make more than that.
If someone's telling you $250k isn't realistic, they're either underestimating hours worked, or underestimating billable rates, or thinking about being a full time employee of a consulting company (rather than an independent consultant.) They're likely contractors, not consultants"
- A Seasoned Tech Consultant
Why, in your opinion, is GM’s Chevy Bolt still being outsold by the Tesla Model S?

Also FYI “electric engines” are not a thing.
Taiwanese Buddhists. Now there's a random sampling method!
> So I think the host kernels’ perf degredation will still affect it.

Oh, yes, definitely. I was just responding to "that these overheads are multiplicative." (I suspect additive rather than multiplicative was meant)
Wow, had no idea there were others writing a blog:). Yes, shared bedrooms, before when our place was smaller we had two in the living room.
Reminds me of dieselgate. "Our product is ok unless operated out of spec" didn't work, iirc.
The core of this attack is extremely simple and elegant; use a value from a speculated-but-not-completed instruction as an index, causing one of a set of cachelines to be touched; then use a timing measurement on those cachelines to see which one was accessed, thus determining the value.

This is a nightmare for the cloud, but IMHO for personal computing, it only furthers the notion that you should trust every bit of code running on your system, and my long-standing view that protection features like paging, rings, and access bits should really be considered more of barriers to prevent accidents than any real isolation. Timing-based sidechannels are notoriously difficult to excise completely.
You can't unwind completely. Once the cache is full, to load something on the cache, it has to evict something else. You might be able to evict what you just loaded, but you can't undo the earlier eviction.
Ask HN: Who started in cryptocurrency in 2017 and now make money?
Or whether it's all the hype from the news, especially for people who started many many years ago.
Apparently Apple is gearing up to create their own video content.
As far as I know they HAVE to register a trade in advance. I.E. three months ahead: "I will sell 600 shares on 15th of December if the share price is above 50". This information is public and other people can use this information before the trade actually happens.
https://meltdownattack.com/meltdown.pdf

>6.4 Limitations on ARM and AMD
We also tried to reproduce the Meltdown bug on several
ARM and AMD CPUs. However, we did not manage
to successfully leak kernel memory with the attack described
in Section 5, neither on ARM nor on AMD. The
reasons for this can be manifold. First of all, our implementation
might simply be too slow and a more optimized
version might succeed. For instance, a more shallow
out-of-order execution pipeline could tip the race
condition towards against the data leakage. Similarly,
if the processor lacks certain features, e.g., no re-order
buffer, our current implementation might not be able to
leak data. However, for both ARM and AMD, the toy
example as described in Section 3 works reliably, indicating
that out-of-order execution generally occurs and
instructions past illegal memory accesses are also performed.

Seems like the possibility exists that AMD/ARM could be affected, based on the behavior they saw, but they were not able to successfully verify.
> I want people who actually are racist to talk, so I know who I don't want to be friends with.

I keep seeing this statement, but all i can think is:

Fuck, i wish i was lucky enough to have so few racists around me to be able to think i can spare the time and mental health for additional ones.

Good for you, be glad you apparently have few to none racists around you, so you don't know what it's like when there's tons of them and they all talk unhindered.

Edit: LMAO, i do wonder what kind of people i managed to upset with this.
SAP helps companies innovate through simplification. We are hiring Cyber Defense and Response Experts VIRTUAL + ONSITE in the following countries:

BG (Sofia)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

CN (Shanghai)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

CZ (Prague)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

DE (Walldorf/Berlin)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

FR (Mougins)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

MX (Mexico City)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

SG (Singapore)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...

US (Palo Alto, Bellevue, La Crosse, Newtown Square)- https://jobs.sap.com/search/?q=sapglobalsecurity&locationsea...
To add to this, I believe Signal is open source and has reproducible builds so its chances of getting away with mischief on a large scale are much lower than Facebook's / WhatsApp's. Even if you (weirdly IMO) think Whisper Systems is less trustworthy than Facebook.
> The question should really be why are bones not reinforced with metal or metal composites.

They are! Calcium is a metal.
Again conflating the issue to include AMD. This feels so disingenuous.
I remember reading about CPU side-channel attacks over a year ago but nobody really talked about it: https://github.com/felixwilhelm/mario_baslr
Neat. I’ll show this to my wife. She will love the colors.
All Android One devices allow unlocking the bootloader, and they are meant to be inexpensive.
Did you forget the Technical University of Graz students who came up with rowhammer and KAISER in the first hand?
The issue is with the chip. So, it should impact any OS running on the chip. This would include Windows as well as MacOS running on Intel chips.
So, basically CPUs will read instructions inside a branch even if the branch is eventually going to evaluate to false. Does the CPU do this to optimize branch instructions? The results of instructions that are executed ahead of time are stored in a cache. How exactly does this exploit read from the cache? I understand it uses timing somehow but I'm not quite sure exactly how that works. (I mostly do software.)
A perfect occasion to invite others into my current exercise of using the web without JavaScript.
The content source is open to contributions from anyone, but we filter them all. So that's "open", but not really. The software itself is not open either, but that likely will be changing soon.
Yet another argument against running any native or 1-to-1 bytecode in the browser like WASM
> That term 'hate speech' - what does it actually mean?

Read §1(3).

https://www.gesetze-im-internet.de/netzdg/BJNR335210017.html...
It's also possible to detect input events from accessibility. Little Snitch detects and ignores those events (tested via "Synergy" - a keyboard/mouse sharing application), as does the download icon that appears in the upper right corner of iBooks (I don't know why).

The accessibility preferences panel appears to accept those synthetic events, however.
> It's easier for Tesla to find someone skilled in car manufacturing than it is for other manufacturers to build the brand demand that Tesla has. They have solved the hard problem, but failed the easy.

But Mercedes, Audi, BMW, etc., have an incredible amount of brand demand too. They'd have even more if they cut out their entry-level cars and only sold flagships like Tesla has done up to this point.

The reality is building a desirable car brand is not that hard. Just make absurdly expensive cars that few people can own and you're halfway there. Then slowly introduce more affordable models.
Is it? Or is he a monster who brought 5 beings into a existence of suffering?

https://www.samharris.org/podcast/item/is-life-actually-wort...
Also the car analogy sucks. Actually I think im starting to hate all analogies.
Yeah I was wondering this myself. Even if there's some fiddly hardware fix to make speculative execution secure, how much of its performance gains will we have to give up to get there?
Just for reference, pink was worn by boys until early-mid 20th century [1].

[1] https://en.wikipedia.org/wiki/Pink#Modern_history
GymPact, the App That Pays You for Working Out
You might also want to watch Frontline: Coming From Japan [The Fall Of The US Television Industry] (1992)
https://www.youtube.com/watch?v=aesJTsZqm6c

and read: https://www.washingtonpost.com/archive/opinions/1990/09/30/j...

to understand what happened in home electronics, especially TV sector. It was an economical revenge for WW2.
Comments seem to focus on inefficiencies in the system, but I think that misses the point: the subway adds incredible value that only real-estate developers see.

Sure there is waste/bureaucracy/corruption in the system, but the bigger point is that the economy isn't setup for the MTA to profit from its own success.

Being close to the subway increases property values massively, but none of that value sees the MTA's bottom-line or repair-fund.

This was shocking to me and one that seems like an easy fix - a "subway tax"

E.g.: charge a T% subway tax for any sales over $D within X meters of a subway station.

Somebody smarter than me would figure out the right values for (T,D,X) and other incentives. (Maybe less if you're adding affordable housing, maybe more if you're a corporation, maybe say the funds can only be used for capital projects, ...)

This encourages the MTA to add more stops and make repairs to encourage more sales close to the stops. Win-win.
I couldn't find it in the blog post or the Compute Engine Security Bulletin, does anyone know which version of Linux Kernel contains the mitigation?
And we can't even read TFA with javascript disabled, you have to be less secure just to read the google security blog.

Edit - mixing it up with this other article (https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...)
Papers describing each attack:

https://meltdownattack.com/meltdown.pdf

https://spectreattack.com/spectre.pdf

From the spectre paper:

>As a proof-of-concept, JavaScript code was written
that, when run in the Google Chrome browser, allows
JavaScript to read private memory from the process
in which it runs (cf. Listing 2).

Scary stuff.
That's fair, but the leads on multiple press releases are that this affects all processors equally which feels very disingenuous to me. Intel's latest press release for example.
"all traces" includes timing differences in execution of non-privileged code, which it turns out are not rolled back.
Creationism is not "just a metaphor for evolution." It is a word which covers a wide range of beliefs, include those who argue that each species was the result of a specific act of divine creation.

("In Creationism, special creation is a theological doctrine which states that the universe and all life in it originated in its present form by unconditional fiat or divine decree." - https://en.wikipedia.org/wiki/Special_creation )

Take this quote from "The Vanishing Case for Evolution" by Henry Morris, http://www.icr.org/article/vanishing-case-for-evolution/ one of the founders of the Institute for Creation Research:

> The absence of evidence for evolution does not, by itself, prove creation, of course; nevertheless, special creation is clearly the only alternative to evolution.

How can special creation - one type of creationism - be both a "metaphor for evolution" and "the only alternative to evolution"?

Obviously it can't, which is why it's incorrect to summarize creationism as you did.

Progressive creationism is more accepting of evolution, in that it says "microevolution" occurs but "macroevolution" does not. Even this cannot be seen as a metaphor for evolution, because it rejects part of evolution.

Perhaps theistic evolution fits your description (https://en.wikipedia.org/wiki/Theistic_evolution ) but otherwise most types of creationism do not.
Municipal broadband only goes so far in terms of protecting citizens from throttling, am i right? If you need to access a website hosted on a server outside your municipal broadband network, will those packets be throttled as they pass through various datacenters controlled by monopoly ISPs?
From an investment or technical perspective? I'll assume investment.

I do it the hard way as the summaries often leave out a lot or bias facts. Especially mass media.

Start with the coin official site. If you like the pitch, skim the white paper. Abstract and conclusion tells you a lot.

You can learn a surprising amount from just the tone of the founders.

Next, check out the community. Usually Reddit or Slack. Read both sides, e.g. for ETH and ETC. As a general rule, don't invest in something until you know its downsides. If there are no downsides, then you don't understand enough about it.
It isn't just that ATS is understaffed. I gave up trying to contribute because I got tired of getting active pushback on basic style issues that I would expect CS undergrads to have figured out by the end of their first semester.

Case in point:

https://github.com/githwxi/ATS-Postiats/pull/35#issuecomment...

Seriously, "When the dust settles, we will think of better names ..."

Hongwei is a great researcher, but he hasn't displayed particularly good judgment wrt. software engineering, and no amount of external contributors can fix problems that come down to a maintainer who actively pushes bad practices. It was almost heartbreaking to walk away from ATS for me, but I came to the conclusion that I just wasn't going to be able to fix the things that needed fixing while Hongwei was making decisions like these.

At (IIRC) Hac Boston 2012, Edwin Brady gave a talk on what was at the time a very work-in-progress version of Idris. There were several points during the talk where he went to demo some basic feature in the repl, got some nasty error message, and went "oh right, I haven't implemented that yet." But even then, it felt more polished than ATS does now.
Is it really disappointing to get hired at one of these places so many people admire and desire, only to find it's nothing special at all? Or is the problem something else?

I've wondered about that. My job isn't spectacular, it's pretty good. I used to want to strive for a spot in a bigger/high impact/significant company like Amazon or Apple for example, but eventually came to realize I'd probably never do anything interesting there, even if I was capable of it. I don't know. I used to feel like I missed the boat and my career would never be as rewarding because of it. These days... Starting to feel like I'm actually doing alright, making the most with what I've got.

I stopped pursuing that career direction because I'm geo-locked, so to speak. I can't leave this city.

Anyway, sorry you're having a terrible time. I've been there. I hope the situation improves soon. Maybe you should bank everything you can, take time off, then get back to finding work with a fresh mind. Good luck.
Actually building production lines and supply lines is a very difficult problem that needs a lot of experience, fine tuning and time. It's like building a moderately complex software. Getting most features in is relatively quick. But then debugging all issues is very slow and tedious and just needs a lot of time.

It's definitely not their easy problem.
So it's your contention that Intel never guaranteed that ring 0 protected memory couldn't be read by code running in ring 3, thereby rendering the concept of memory read protection useless by design?
Spotify's strength is their recommendation engine, IMO. It's really good.
I find myself nodding your head at the first sentence.

I think the second sentence is agreed upon/accepted knowledge. The batteries and electrics are NOT difficult.

I'm not sure if the third sentence is relevant. Maybe it is, maybe it isn't. Tesla-like success required thinking outside of the box. If GM just started cranking out mediocre electric cars like they crank out mediocre gasoline-powered cars, I'm not sure it would have made a difference. It took a new company with a fresh approach like Tesla to drive the market.

Whether it's a GM or a Tesla that ends up winning in the long term is up for argument, and it certainly seems like it SHOULD obviously be the big existing carmakers. But they didn't seem interested in doing more than bolting an electric drivetrain to an existing car, which wasn't enough to get people excited about the revolution that electric cars represent.
Well, given the serious side effects of Malarone, if you stay 2 years in Africa, you probably don't want to pop it like M&N's.

A medical act is always a balance between the costs and the benefits of it.
You mean enable KPTI.
The fall of Logan paul
I think they're extremely well positioned from a marketing POV and the first attempts at competition from Detroit have fallen flat. I expect them to enjoy a position similar to Apple where they no longer really need to be the most innovative or practical so long as they are stylish and desirable.
Microsoft | Software Engineer 2 | Seattle WA | Full time, Onsite

Microsoft Project, with over 20 million users, is dedicated to providing every Project Manager in the world, the tools they need to effectively manage projects. For over three decades, Microsoft Project has been the industry standard in Project Planning for companies of all sizes. As a business, Microsoft Project continues to be one of the most profitable products for Microsoft.

As a Software Engineer on our Team, you will have the opportunity to work in small, self-organizing crews, made up of Software Engineers and Product Owners, with a mission to bring the best project management capabilities to our users on both the PC and the Web. Delivering strong results will require you to engage with the wider engineering community across Microsoft Office.

Key responsibilities:

- Design and develop new features and capabilities in C++ for Microsoft Project.

- Enable key new scenarios like Co-Auth on both the PC and Web.

- Collaborate with engineers in Dynamics and VSTS, enabling deep integrations across the broader Work Management offerings from Microsoft.

- Learn from and contribute to the vibrant community of engineers across Microsoft Office.

Knowledge, experience and skills:

- 3-5 years of experience in designing applications in C++

- Experience in working on a large codebase

- Understanding of Windows based Native Applications

- Ability to work collaboratively in small self-organized teams

- BA/BS or MS Degree in Computer Science, or equivalent experience

Apply directly here: https://careers.microsoft.com/jobdetails.aspx?ss=&pg=0&so=&r...

PM me if you have questions
Every EBook. Every Video. Just $5
Different Tesla.
Is the Internet on Fire?
Signs of a Massive Human Migration to the Americas
He's probably spent more than that on electricity to max out his CPUs for 14 years.
Well, the fever is useful to fight the desease, so keeping it up (unless it's becoming life threatening) may help you heal faster.

But most people want comfort. Or just be productive. Or have obligations. And a fever sucks for that.
I just sold all my altcoins for BTC on Binance as soon as I saw this and transferred them to gdax. Hopefully I can sell them for USD on gdax and transfer to a real bank before they get hacked.
I didn't mean to be misleading. You're right – when I doxxed myself and I emailed you about it, you took care of it instantly. Thank you for that.

I meant, your time is finite, and you can't possibly respond to every email. It's not a slight against you. It's just a scaling problem. But yes, "if they don't feel like it, they won't respond" was a poor choice of words.

This is a bit of a tricky comment, since you've kind of forced me to say something, or to stay silent and accept your slight. But it's already a meta-thread, so maybe there's no harm.

It's a bit strange to drop some hints that my words shouldn't be taken at face value. I'll just note that (a) those you deem unworthy of a response have no idea why, and (b) the timespan we're talking about is either 1 month or 1 week, depending on how you want to look at the situation. Waiting a full week for a response to something that's been happening for a month seems pretty fair, no? I don't expect you to respond to every email, nor respond very often.

Lastly, the only reason I pasted those emails was to represent you accurately. You've often complained that people misrepresent your actions or act in bad faith, and I've seen this firsthand. I didn't want to do that to you in a public complaint. It was a gesture of goodwill, not malicious, though I see it could be taken the other way.

There's more that could be said, but trust me when I say I don't mean to be a thorn in your side.

Best.
> It's kind of semantics though isn't it?

I never understood how this sentence became a defense. Yes, yes it is. It is semantics. Everything is semantics. The difference between getting fired and getting laid off is semantics, and everybody cares about it and recognizes it. The difference between "I'll pick you up at 5pm" and "I promise I will pick you up at 5pm even if my car breaks down and the train gets derailed" is semantics. Calling something "semantics" isn't a defense to your argument; it's often more like a concession. (And the difference between a defense and a concession is, as I'm sure you realize, also semantics...)
Exactly. But you can't tell introvert geeks that. You need to present it like a life hack.

I know, because I used to be an introvert geek because Mali kicked my ass.
From https://www.chromium.org/Home/chromium-security/ssca :

This research has implications for products and services that execute externally supplied code, including Chrome and other browsers with support for JavaScript and WebAssembly.
The thing about calories is that the high side is easier and greater than the low side. But it is easy to accumulate with excess calories. There is a severe limit on how much of a deficit you can establish relative to a baseline energy intake, but a wide-open range in the area of excess intake. Furthermore, fat is easy to store but hard to mobilize. So if you eat 15000 calories one day, then create a 1000 calorie deficit over 15 days, it won't average out to the effect of a regular intake over 16 days. The body finds ways to economize energy use and hang on to the fat.
I don't think this is the last we have seen of side-channels, it's just a ridicolously hard problem to get right. And for that reason I can't feel too angry at the procesor makers.

And I certainly expect to see more things like this (but at least hopefully with lower bandwidth).