skysight-inc/HackerNews huggingface dataset:
Of course.

> Cars are stolen with significant frequency, for example.

Presumably you'd report your car stolen, no?

> People also drive them without permission (e.g. a spouse gives the keys to a visiting in-law).

Then you'll be able to identify the person via a picture of their face, most likely, no?

> Establishing that an owner of a router or computer is responsible for anything it is used for unless proven otherwise

I'm not trying to say any different, in fact I'm saying that it is a "reasonable" assumption, and as with any reasonable assumption there are notable exceptions, by which showing the driver's face is a reasonable method by which saying "No, Your Honor, the person driving my vehicle is not me". In some states you may not even be obliged to identify the driver, only show that it "is not you".
They weren’t effected by the really bad Intel big names Meltdown. They’re still susceptible to Spectre.
Is there a social media in Germany that does not censor?
> Intel found a perf win that ends up having security implications.

Every Intel CPU has a lower perf than you will find on current benchmarks, but yes, there's a perf enhancement that will make the chip as fast as expected, but has security implications.
This is just a trusted RPC connection right? You're not embedding any sort of light (or otherwise) client? Are you running the nodes on the backend, as opposed to outsourcing to someone like infura? What are you running if so (geth, parity, something else) and how (single node or multiple nodes load-balanced)? Curious to hear the setup.
Both of those are bids, not projects for which the Boring Company has been selected.
I think this article could have been better organized, but I think it's fine that book reviewers talk about the authors when they think it material either to the content or to the purchase decision.

Here, I think the post makes clear why they talk about the author like this: some will have heard of Bob Martin for his political opinions, and could well wonder whether the book features them along with technical opinions. This would be a legitimate review topic no matter the political views.

Hacker News has a strong "focus on the tech, not the politics" contingent, so I'd think they'd be especially open to a book review that evaluates whether a technical book did what they were asking for.
Thanks for clarifying Mike, should be interesting to see how this actually pans out.
They would be donating it to themselves, so I hope not. One could maybe imagine a situation where they setup a super pac and have that organization spend the money on political advertising, but that seems so easy of a dodge that the IRS must have a way to detect it.
No they don't. I can write a paper or a thesis without any worry about how it's going to look visually to the person consuming it. I can post a video of something without any kind of concern for what size, container, or surrounding content might accompany it.

Content is content. Presentation is how that content is displayed. While they can work together, the content is the most important thing and presentation should always be secondary to it.
Best Served Cold: Responding to the Iranian Protests
In what world are construction workers paid $1000/day? That's an exaggeration, but your point stands.
More details at https://googleprojectzero.blogspot.com/2018/01/reading-privi...
It seems like it is not affected by the most serious bug, but may be by a lesser one.
> Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

> In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Interesting. So there are two different vulnerabilities. Spectre has been verified to affect Intel and AMD whereas Meltdown may affect both.

Edit: based on this statement,[1] AMD states they are not affected at all. This seems to be contrary to what the researchers have found?

1 - https://twitter.com/rhhackett/status/948676213505232897
I was at Amazon in the past but I am not currently there. That's as much as I'll narrow things down :)

-Edit- I used this acct as a throwaway in the past to respond to an Amazon-related topic and then just kept using it!
Is this really the "easy" problem? I've often wondered to what degree maneuverability or parts availability influences car maker's designs. If the design fundamentally requires parts that are single-source or difficulty to manufacture, as Tesla's design must be, then it's a difficult problem.
How much in advance do the intel managers have to register a stock sell?
Sure. I was just commenting on the fact that I've seen this type of setup everywhere lately and the content and presentation are inextricably linked. To me, that's a major problem.
Meltdown is the one that AMD is not vulnerable to (at least according to AMD, of course).

When AMD says they are "not susceptible to all three variants", that's a NAND, not a NOR.
AFAIK all of the major players have this feature and even developed it a while ago :

Google Music have been displaying some kind of 'I feel lucky' button for ages (it is not random but based on your listens). They also had artists maps years ago.

Deezer has its Flow

Apple Music has 'for you'

Etc ..

There are many variations in how these recommandations are surfaced to the user though.

I would be hard pressed to recommend one service over another as far as their quality. It is just all over the place depending on your tastes, listening styles and how much new tracks you want to listen to.

IMO Spotify has mostly found a sweet spot in how to present these results to the user.
Project Zero has published a detailed writeup on this. It's worth noting (in the context of Intel's response) that the P0 post confirms that AMD and ARM CPUs are also affected:

"Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD and ARM on 2017-06-01"

https://googleprojectzero.blogspot.com/2018/01/reading-privi...

Edit: Discussion https://news.ycombinator.com/item?id=16065845
I use HN via Tor. Occasionally I get a 'prove you are legit' message, which is fine. The biggest problem is that my account seems to be permanently flagged for restricted posting; after even a few comments I get a message: 'you are posting too fast', and HN won't accept more comments for awhile.

@mods: Perhaps after an account gains a certain amount of karma, even 500, that flag could be disabled even for Tor users.
Although for Desktop apps Java pretty much always looks uglier than a donkey's ass in a blender.
Will you be buying Intel-based machines? Or will you be running a hybrid-architecture cluster now?

I don’t know very much about computing on that scale, but I wonder if all the people selling off Intel stock are thinking this story through.
Do we know how news of this got out before the disclosure date?
Massive Intel Vulnerabilities Just Landed
Unless you have jeff bezos skills to convince ling term this is better.
Speculative execution seems like something that would be very intuitively insecure even to a layperson(relative to the field of course).

I'm wondering, was this vulnerability theorized first and later found out to be an actual vulnerability? Or was this something that nobody had any clue about?

I'm only saying this, because from a security perspective, I imagine somewhere at some point very early on someone had to have pointed out the potential for something like speculative execution to eventually cause security problems.

I just don't understand how chip designers assumed speculative execution wouldn't eventually cause security problems. Is it because chip designers were prioritizing performance above security?
There needs to be a real race where everyone sticks to the speed limits with penalty times applied for every second above the speed limit, with proper driver breaks and everything else truckers obey. Simple rule set. Of course journey times would be nearer 50 than 28 hours but there could be other prizes for fuel efficiency, luck at the lights and so on.

Also, there is the suitability of the car, I imagine a Tesla would be better than Rolls Royce luxury if you need to be in the thing for 50 hours.

Stock cars with speed limits may not sound like fun but it would be accessible. Maybe the 'golf ball run' where you have to take a set of golf clubs across the country to tee off into both oceans in record time could be the notional goal of such an event. It would also give an excuse for some faux golfing style in the fashion department.

Incidentally, in 1933 the petrol record was around today's EV time.
I'd say Heartbleed was worse. This one requires local code execution, whereas Heartbleed was "connect to any OpenSSL-using server, send a magic packet, and read the private keys from its memory."
Not much to add here, other than I'm super happy with ultralight "frameworks" like this.
Any good sources of typewriters?
6 minutes is a lot when it affects millions of people. 6 minutes * 1,000,000 riders is 6,000,000 minutes a day of lost productivity. What is the GDP impact of that?
Here's a list of what google tested:

Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz (called "Intel Haswell Xeon CPU" in the rest of this document)

AMD FX(tm)-8320 Eight-Core Processor (called "AMD FX CPU" in the rest of this document)

AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G (called "AMD PRO CPU" in the rest of this document)

An ARM Cortex A57 core of a Google Nexus 5x phone [6] (called "ARM Cortex A57" in the rest of this document)

https://googleprojectzero.blogspot.com/2018/01/reading-privi...
It's a developing story, but from the information we have so far, it does look like Intel involving AMD is a disingenuous since AMD processors are not affected by the most serious of the issues.
Indeed. But surely they wouldn't risk embarrassment by lying about this, would they? :)
One has to add the over 800 Model 3 which were made, but not delivered to the customers yet. So they made about 2300 Model 3 in Q4. And Tesla claims to be hitting a rate of 1000/week in the last days of 2017. So the production speed is picking up for sure. Not as fast as promised, but it is picking up, and probably will continue to rise significantly across Q1.
>Vote with your dollars.

I hate this saying. It's such a bullshit saying. a) There is no viable competition and b) It's incredibly profitable to lock people into an ecosystem, so even if you do "vote" with your dollars (hint: you're not voting) every company that you've now "voted" for has an interest in locking you into their ecosystem. The very act of "voting with your dollars" is part of the problem. This requires a principled stand and a demand, not more consumerism.
To be fair, the Intel post alludes to collaborating with AMD/ARM on mitigating Spectre, but userspace memory leaking is wholly separate from kernel memory leaking (Meltdown, which only affects Intel processors).
Week 1 in Information Security, 2018
Way better link, thanks.
Yep. I've seen scary errata and had paranoid cache flushes in my code as a precaution.

My favorite ARM experience was where memcpy() was broken in an RTOS for "some cases". "some cases" turned out to be when the size of the copy wasn't a multiple of the cache line size. Scary stuff.
> IIUC - you can transpose 'password' with seemingly anything stored in memory managed by the kernel, so Intel using this sort of deceptive language is poor behaviour.

Intel wasn't being deceptive. That is exactly what they said, "software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data." This is in the very first sentence of their response.
> I payed for Google Music for a bit a while ago and I hated it and switch to Spotify.

It's always so interesting how people can have similar experiences but come out with completely different perspectives. For me, the Google Play Radio feature is the most important thing they have. It's like a Pandora that doesn't play you the same three songs over and over. When I would try and use the radio feature on Spotify it would play music that was not even close to the original other than it maybe being in the "alternative" category.
You've mis-read this section - it was answering another commenter who claimed to be having the same issue but was in fact having a different issue as you described in your quote.

The underlying problem the update caused was acknowledged by an AWS rep in the thread who suggested moving to an instance with more CPU resources.

> If moving to a HVM based AMI is not easy, changing your instance size to m3.medium, which provides more compute than m1.medium at a lower price, may be a workaround.
Yes, I'm sure if someone called Catholics pedophiles and backwards barbarians, they would be treated similarly. Or Muslims themselves making similar comments about homosexuals or Western women. Somehow these laws only ever seem to be used against conservatives.
That article links a commit [1] that contradicts this statement

> AMD processors are not subject to the types of attacks that the kernel
page table isolation feature protects against. The AMD microarchitecture
does not allow memory references, including speculative references, that
access higher privileged data when running in a lesser privileged mode
when that access would result in a page fault.

And Axios [2] that Zdnet quotes gave a comment from AMD:

> "To be clear, the security research team identified three variants targeting speculative execution. The threat and the response to the three variants differ by microprocessor company, and AMD is not susceptible to all three variants. Due to differences in AMD's architecture, we believe there is a near zero risk to AMD processors at this time. We expect the security research to be published later today and will provide further updates at that time."

And a comment from ARM:
> Please note that our Cortex-M processors, which are pervasive in low-power, connected IoT devices, are not impacted.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/...

[2] https://www.axios.com/how-the-giants-of-tech-are-dealing-wit...
Worse, screens today are about companies directly tapping into brain mechanisms to induce as close to addiction as they can get. Opiate of the masses indeed.
According to Google's Project Zero post [1], Intel has known about this since 2017-06-01.

1. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Meanwhile on my office PC Windows 10 seem still struggling with the concept of a meaningful progress bar or a readable list of system update (BEFORE triggering a 2 hours WTF update for obscure reasons).

Apple do know how to manage packet for system update and provide a dumb-customer-prof one « The AppStore » for paying developers.

If developers write messy scripts how come you would it be fair to blame apple. And you will find dubious install process on every plateform from dirty .bat on Win to « easy » makefile for Unix that work after 2 hours of hard tweaking.

Sorry for the rant :/
> The study, which analyzed Gallup surveys of 450,000 Americans in 2008 and 2009, suggested that there were two forms of happiness: day-to-day contentment (emotional well-being) and overall “life assessment,” which means broader satisfaction with one’s place in the world. While a higher income didn’t have much impact on day-to-day contentment, it did boost people’s “life assessment.”

Couple huge notes here:

1. Overall life assessments improves; that is a part of happiness.

2. These numbers are 2009.. during the recession. They are way higher now almost certainly.

3. Needs to be COLA adjusted (linked article does that)

4. Is this pre-tax or post-tax?

5. I can't find the study itself, but I can't see how household composition wouldn't affect this number.

$130k single person in SF Bay Area might have well peaked on day-to-day happiness - you are generally making enough to not stress about breaking a budget.

At $130k living in the SF Bay Area with 2 young children, you are still going to need to budget, leading to heavy marital arguments about money that hurt day-to-day happiness. I would venture that $350k (pre-tax) is about the level where such a couple would peak by eliminating budget pressure.
My problem with the article is that if you try to follow all of that advice, you are left with no real leverage to work with, and the sad reality of the vast majority of jobs is that you will not get a raise unless you have leverage.

If I had to compile my own advice, which is inevitably incomplete but I think gives more actionable advice than the article, I'd say:

1. Don't openly criticize your colleagues. Word tends to get around and it erodes their trust in you.

2. Don't threaten. That makes your manager defensive, which is counterproductive. You can imply your dissatisfaction and your manager will infer the risk of losing you, but threatening to leave tends to get a defensive reaction.

3. If you are trying to be less underpaid, then approach it from a perspective of fair compensation for the work that you do. Do not hide that you think it's unfair, but also make sure that you're well-justified in thinking it's unfair.

4. If you are trying to get paid more despite being fairly compensated, then have a discussion about where you have to up your game to earn more.
I think you're closer to our root issues than most of the comments, but there are still links further down the causal chain from here.

College admission is hyper-important and hyper-competitive today because life is hyper-competitive. Stagnant wages and a steadily increasing cost of existing are destroying leisure and stability in all age groups, not just the teenagers.

It honestly terrifies me. I'm extraordinarily lucky in almost every sense, so personally I'll likely be able to live a good life no matter what. But I feel like the systems that undergird every part of our society are getting more and more fragile. Huge groups of Americans are one small misfortune from ruin, and that's choking everything from entrepreneurial risk-taking to teenage partying and other pure leisure activities that used to shape our culture.
I don't think rural coops get much push-back from deep pocketed monopolies who just passed over serving those areas.
Can someone with a little more experience this low-level let me know if this is as bad as I think it is?

Because this looks real bad:

> Reading host memory from a KVM guest
https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
https://googleprojectzero.blogspot.com/2018/01/reading-privi...

Seems that Google/Project Zero felt the need to go ahead and break embargo. Worth adding to the above list of news sources.
From that article, I got a very different impression (despite its clearly negative tone). The quote that really stood out to me was

"How long does it take to build such a factory? From that other car company, you may have heard that car factories could be brought from no plans to mass production in two years, no time at all, or whatever is less. I ask Mr. Demeunyck how long the Luqiao plant took from start to finish, and he proudly tells me that it “took only five years. They do things fast in China”... "In Europe, or in other places with tight permitting, it would take a few years longer,” Demeunyck says. If anyone tells you he has picked no location, and secured no permits, but wants to have a new car plant up and running in two years, call an ambulance."

Apparently, what they are really arguing is not that Tesla is bad at production, but that Tesla is trying to do something nearly impossible. In this light, the problems Tesla faces are not because they lack the skills or expertise to deliver, but problems that any other car company would face if they were to do things on the schedule Tesla is trying to achieve.

Thus, Tesla is really just taking a huge gamble -- they have a chance to pull off something very impressive, even if they fall 6 months or a year behind schedule. And if they fail, they failed because they took on a challenge that was simply too hard for any company to achieve. To me, it really resembles the gamble that SpaceX took, which paid off very well in the long run. So while I think there's a real chance that Tesla will fail like all of their detractors believe, I think there is also a real chance that they will be wildly successful.
any ideas what those findings are?
"In the last seven working days of the quarter, we made 793 Model 3's, and in the last few days, we hit a production rate on each of our manufacturing lines that extrapolates to over 1,000 Model 3's per week" - from Tesla's release.

Also another 860 Model's in transit currently that will count in Q1. It's getting there.
This statement doesn't necessarily generalize, but I can't say I'm a huge fan of what the Spring-flavoured Dependency Injection ended up looking like around here either. It's like... we've taken on ridiculously long startup times, to turn what would be compile-time errors into run-time errors. Seems like a double-whammy of bad.

Maybe I'm a little overly jaded, but the Java apps I've worked on (which is admittedly only a handful) have all had these giant sprawling messes of dependencies; it feels like there's a lot of code to accomplish very little. The Golang-based services I've worked on feel like the opposite; very little code to accomplish a lot of things, without much ceremony.

Edit: And that's not to say that I'm opposed to dependency injection; rather, I'm quite happy to do constructor-based dependency injection by hand. When that starts to feel painful, I look at the system I'm working on and wonder if it's getting too complicated/has too much coupling/etc.
I think that analogy paints a pretty clear picture, this is a flaw because it's undesirable behavior in unexpected circumstances. A bug is unexpected behavior in expected use-cases.
I do not think the processor was designed to improperly unwind from speculative execution, such that the state after failed speculation is not identical to the state prior to speculation.

But yeah, this an old discussion, and a deep rabbit hole. There's many layers to consider bugs at. Implementation can differ from developer intention, developer intention can differ from group agreement, group agreement can differ from design document, design document can differ from product development intention, and product development intention can differ from communicated functionality.

I'm betting this would be implementation differing from developer intention, although I would consider (almost) all of the above to be bugs.