skysight-inc/HackerNews huggingface dataset:
from what i understand, it’s both. if you don’t protect the hypervisor, the guest can break through and read it’s ram. if you don’t protect the host, your apps can break into your own OS and see it’s ram.

i could be wrong; if i am, clarification would be good!
Except for that whole web thing that has most of the world running untrusted code just about every minute of every day

Certainly those who e.g. have JS off by default are currently in the minority, but perhaps this will be the defining event that causes everyone else to think more deeply about letting untrusted code run, regardless of how sandboxed it is.

Things like TEMPEST[1] have shown for many years that side-channel attacks are extremely difficult to defend against, even for an attacker who is merely in proximity to the hardware and can't influence it at all; nevermind running code directly on it. It was only a matter of time. A lot of malware researchers already don't trust VMs and use separate physical hardware, precisely because of these risks of sharing trusted and untrusted code on the same hardware.

[1] https://en.wikipedia.org/wiki/TEMPEST
cardiovascular issues seem to be centered around inflammation not specifically fat. Not dietary cholesterol or saturated fat. There's lots of evidence to also support intermittent and extended fasting.

In general minimizing starchy carbs alone, along with refined sugars and grains goes a long way. If you eat vegan or keto/lchf. I've done both... with vegan, I still had to take a large amount of insulin and gained weight, even at 1500-1800 calories a day... on keto, I eat a little more but managed to lose 63# last year and come off insulin (mostly).
> I know it's a politically charged subject but I don't see why from an economic/mathematical perspective it's any better than moving the same investments to the market.

It's worse on average, it's better at minimum (ignoring, for this analysis, municipal bankruptcy)

> My state starts doling out pensions at 5 years. A friend of mine worked for a state senator in the 90s for 6 years. He's got something like $1200/mo guaranteed during his retirement for 6 years of borderline political work ~25 years ago.

Assuming a 2% of highest full years salary per year of service formula at typical retirement age (a fairly generous public, non-safety pension), with 6 years of service that would require a base salary of $120,000 over the highest paid year of those six, that’s—today, not in the 1990s—a fairly senior staff salary for the California State Senate, which has the highest legislator and staff salaries in the nation.

Your description is not necessarily impossible, but it's extremely far from typical.
Does TrustZone mitigate this? Can the secure world be compromised via this side channel?
Nice to finally see this comment after much text implying that eyebrows are some crazy useless feature of humans. The ability of humans to sweat for cooling is one critical feature that has helped the species survive. The full body sweating that allowed humans higher endurance than any other animal on the African plains would have been much less useful if they were continuously blinded by the salty sweat pouring down off their foreheads.
Yo this guy just explained the rock eater in Neverending Story
The choice of values (what to measure) certainly has many subjective components. That said, a good chunk of people tend to value (to some degree or another): cost of ownership, reliability, fuel economy, performance, appearance, seating/cargo capacity, and resale value. Many of these criteria can be measured, more-or-less, in objective ways. Some criteria tend to vary more across individuals (such as appearance or driver "feel").

I mention this because if a person states their preferences across the attributes they value in a vehicle, it is quite feasible to have a detailed (if not "objective" then at least a rather neutral-point-of-view) discussion about the matching set of vehicles and what they offer across the dimensions.
Why They Lost the Wheel (1973)
While possible, having first hand experience working for the MTA (not NYCT though) led me to believe that it was most likely not the case.
I wonder if she would have thought of structured games as the "wrong" sort of play, making "work" out of play.
A Hit Man Came to Kill Susan Kuhnhausen. She Survived. He Didn't
http://bitnewz.net/News/Article/bBitcoinb-Is-The-MySpace-Of-...
No u
I couldn't find exact numbers but it seems like Must owns around 20% of Tesla. Some shares are locked down and secure around 1.6B of loans from Goldman Sachs and Morgan Stanley.

Not sure if Musk will be actually making any decisions here when things go south.
Simplepack: Make pack more simple than ever, base on Webpack
What have the Romans ever done for us?

https://www.youtube.com/watch?v=p-fRo5-p9hE

http://peterburk.github.io/pliny/ChaptersHtml/0/1.%20PlinyPe...
Cortex-M has an MPU, not MMU to provide protection for memory regions.

But as said above, the MPU/MMU has no effect on this bug, this is ab out speculative execution and determining information from a cache side channel attack.
Didi Chuxing acquires 99, Brazil's ride-hailing leader
> Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code.

It seems like keeping untrusted code in a separate address space would be a suitable workaround? A lot of comments here seem to be implying that meltdown-style reading of separate address spaces is possible via Spectre, and my read is that it wouldn't.
If nothing else, this article's example of inventing rope caused me to seek to learn how to make it, which I now know how to do.
In-order CPUs (e.g. Pentium 1, older Atom and ARM chips, POWER 6) perform branch prediction and speculative execution. They'll predict the branch and start speculatively decoding and executing instructions from the predicted target, then flush the pipeline if there was a misprediction. What they won't do is execute past an instruction that has an unresolved data dependency.
146%
I imagine that hunters that could carry large heavy loads of meat that they killed back to the cave/tribe would have been positively selected for since a least the invention of the spear. Spears are older than the human species at around a million years ago. Plenty of time to evolve very strong hominids.
Note, TX electricity is "deregulated" and the deregulation attempt learned a lot from the follies of CA's approach. They took the single company (TXU, so not really privatized per se) and broke it into the actual ones managing the infrastructure (e.g. Oncor) and limited TXUs ability to change pricing during an incubation period while other private companies sprang up.

So now TX electrical companies are just a bunch of middle men. They only compete on price and customer service, and price IIUC is basically a margin game of futures and size, not actual electricity innovation. By law, only one company can setup the lines, fix the lines, etc. Not sure how privatized that is if it's the state by another name.

I'd say the privatization or lack of between TX and CA has little to do with costs or quality. In this case, CA just had a bad company and TX a better one (or ones).
Wtf? Have I said that? No.
It seems to be (forget which studies) that we need 40-60g of fat/day for dietary needs and for good digestion (keeping bile/gallbladder running). If that's <20% of your calories, you're either eating a lot, and depending on activity that is fine, or you aren't getting enough fat.

Personally, following a vegan, or even doctor recommended diet for diabetes I gained weight on both... on keto, I'm down 63# last year, and feeling much better and mostly off medication. I've also got a dysfunctional metabolism, so YMMV.
IMHO I don't believe GM is serious about electric cars yet. They may be, but they haven't demonstrated it sufficiently for me to depend on it. Until they show large commitments and demonstrate that they are betting the company's future on being able to do electric cars well and to continue doing so, I'm more interested in an electric car from a company that I know does have that commitment.

Where are the billions of dollars in contracts for batteries? Until I see that or a gigafactory of their own the Bolt will be a compliance car in my eyes. Albeit perhaps the best compliance car on the market at the moment.
Dadi – The New Internet
What alerted people that something may be up were discussions on LWN and the patch commentaries in Linux kernel code commits.

* http://pythonsweetness.tumblr.com/post/169166980422/the-myst...

* https://news.ycombinator.com/item?id=16046636
I expect this is more of a positive for AMD than a negative for Intel. Perversely, this incentivizes people to get newer chips more quickly. If trust in Intel is not lost completely, and Intel puts out new chips that do not have this vulnerability, Intel could actually get more sales out of it.

If the new chips were going to have a 30% performance boost, now it looks like they will have a 50% performance boost. Much more compelling.
Hard to find a good spot for this, but: Thanks to anyone involved! From grasping the magnitude of this vulnerability to coordinating it with all major OS vendors, including Open Source ones that do all of their stuff more or less „in the open“, it was almost a miracle that the flaw was leaked „only“ a few days before the embargo - and we‘ll all have patches to protect our infrastructure just in time.

Interestingly, it also put the LKML developers into an ethical grey zone, as they had to deceive the public the patch was actually fixing something else (they did a good and right thing there IMHO).

Despite all the slight problems along the way, kudos to any of the White Hats dealing with this mess over the last months and handling it super graceful!
Freedom is a strange thing. It's not really tangible or measurable in an easy way.

I would feel more free in New Zealand than in the USA, even though New Zealand has hate speech laws. However, in New Zealand, the police don't carry guns, I'm not at risk of getting shot because of a blown tail light.

Personally, I don't measure freedom by what tweets Twitter is required to remove.
If nothing else, it sends a clear message of “I wouldn’t trust our product”.
>"Once Spotify achieves a critical mass of listeners that trust their algorithms, and rely on their tastemakers to deliver fresh music, Spotify could easily slot in musicians that they themselves hold the contracts for."

You mean become a competitor to the 3 labels for whom they depend on for their business? Not a chance. If the labels see them as competitors instead of customers they will pull their card and not renew their licenses.
Just because it runs in a C PoC does not mean it only runs in C.
Stupid title. It would also let you create 2018 Electronic Music.

Been using VCV rack for a bit and its fairly awesome (Usually over MIDI sequenced via BitWig).
> an AI actor totally dedicated with either the infinite and immediate improvement or replacement of itself makes no sense to me.

If I decide that a problem is so hard that the best solution is to invent a superhuman AI to solve it, then this is an approach that human-level intelligence can come up with, so a superhuman intelligence can too.

Self-improvement and self-replacement are probably not an AI's actual goal, they're just things that are useful to most potential goals that an AI can have. (And they're easier for the potential AI because the prerequisite research has already been done at that point.)

(If you knew I was trying to either cure cancer or colonize mars, you could predict that I'll start raising money, even though those goals don't have much in common.)
RSA SecurID
Tovala (YC W16) is hiring a React engineer and first product manager
JS code or containerized code running on shared hardware are one thing. But crippling all userspace applications seems like going too far. Especially considering this is just papering over the problem instead of fixing it.

Also note that if you reduce precision you might still be able to tease out the data simply by gathering more samples. An exploit that gets you 1000bytes per minute might take an hour instead, but that could be enough to find cryptographic keys.
Top 5 Android Wear Library in 2018
I think I leave him out on purpose.
Previous discussion on HN:

https://news.ycombinator.com/item?id=15766543
I interviewed in Eugene at a game company once many years ago. Was raining the whole time, their building was covered with moss, people were crammed in cubes in the hall, and the president handed me a written programming test. I handed it back and said no thanks and left.
Is there data on how effective this is, and how the vision of those treated compares?

I can’t imagine the price I’d put on a sense; nice to know you can literally get half of the price for a single eye treated.
> Comcast, for example, doesn't need, or particularly care about, my vote, whereas local government does.

Not always your individual vote. A vote with your ballot often has little difference with a vote with your wallet when you can't easily/quickly switch.
Location: Lahore,Pakistan

Remote: Yes

Willing to relocate: yes

Technologies: angular,angularJs,nodeJs,html,css,js,jquery,bootstrap,python,django/Flask,monogo and other related technologies.

I am full stack web developer having 4 years of experience in developing web applications.I have experience both in front-end and
backend technologies as well as i have dev ops experience in digital ocean,microsoft azure etc

Résumé/CV:https://www.dropbox.com/s/tzdxe1stfbbjw7f/Resume.pdf?dl=0

Email:abdurleo91@gmail.com
Clearly the point is not the comparison between the impact of both experiences on the receiving end.
Want to use my wifi?
8/10

Improved my code quality by becoming more aware of code style and becoming more nuanced in the approaches I take when solving problems. Enjoyed getting back into Python work, but async programming in python is still somewhat awkward.

I'm alarmingly bittersweet about living in the Bay Area and not living closer to home. On one hand, I miss seeing my large and wonderfully close family and friends at home; on the other, the Bay Area weather is wonderfully mild and always sunny, and of course, salaries are better here. So I've wrestled with re-calculating the costs of where to live.
Fara titluri I
Project Zero AKA Google is probably a better choice than "Tailored Access" guys at the NSA or their Russian or Chinese equivalents.
There's no particular reason any random company's stock should have gains over time, aside from inflation. Especially if it doesn't give dividends, you may never gain anything.
ISRAEL ORDERS AFRICAN ASYLUM SEEKERS TO LEAVE OR FACE IMPRISONMENT
> If I decide that a problem is so hard that the best solution is to invent a superhuman AI to solve it, then this is an approach that human-level intelligence can come up with, so a superhuman intelligence can too.

It can try, but it doesn't mean that it would success at it.
You try to talk Swedish rather than just speaking Norwegian? My experience is that Scandinavians just speak their native language and expect that other Scandinavians should understand them. Any attempts to speak the other language end up sounding like parodies rather than serious attempts.
He's talking about revenue for Apple. Apple takes a 30% cut. 30% of $330 = $99.
About not having invented anything: it's harder to invent something novel today simply because so much has already been invented and knowledge of it is available.

Centuries ago, it was easier to think of things to invent (we should be able to fly, to stay under water longer, to copy books faster, to notate music… ). It still took a lot of work to actually realize the invention (which only could be done by people wealthy enough to dedicate the time or get patronage from a wealthy source).

Today, we've run low on the scope of reasonably easy to invent things that are actually valuable. All the obvious "wish we could X" things have been done or are nigh impossible for any one person or small team to figure out (or flat out impossible). Innovation in areas like AI or medicine or battery tech — that stuff is all being actively worked on and requires massive funding of teams of advanced specialists. We're not going to see some person just invent something around these things the way multiple people independently invented forms of rope in prehistory.
Thanks so much! I'm glad you decided to install it, feel free to let me know if you see anything that could be improved. I was inspired by the color scheme from Bubblesort's "Git it Gurl" shirts (https://shop.bubblesort.io/products/git-it-gurl-shirt?varian...), with the nice splash of blue-purple on the pink background.
AI currently evolve under a human environment. Its success to next gen all based on human selection even if it is self breeding ( the guy just lost funding whilst it ...)

Hence we are still in AI-human coevolve stage. When some AI leaks to internet and survive there as Like bots and evolve (not necessarily self aware) it would be a different. When it start to find a way to get enemy and declare independence it would be even more different.

Alphago takes years to do CO-human-game-player-evolution but 3 days for go and a couple of hours for chess. May be it could be shorter than we thought.

The Egyptian Slave will go to the promise land leaving their master behind.
From what I have read, there are quite a few people (including Woz) that recognize that Steve Jobs was still a great man, despite the way how he treated people sometimes.

Steve Jobs was very charismatic and often it’s charismatic people that lead the charge.

One can be an agent of change and a tech god, while also being a piece of work. The one doesn’t exclude the other.

Einstein treated his wife quite horrible as well, but despite this, he was still a genious.
They do not have a aristocratic caste holding back- lots of innovation in ancient greek for example happened, because entrapeneurs escaped with boats to different shores and founded colonys.

Look at the valley today, its a Hacker culture gone sour.
Hacking today means, ripping a preexisting value cycle from the old elite, and with the lowest possible effort turn it into - the same cycle with you in control. Those "Making the world a better place" (for themselves) laugh about those actually contributing by obsessing over tech (the usefool toolfools).

The true motto of this party is "noblesse oblige" and you can hear it in every subtle comment on how the commoners chose your app, your system and would have opted out if it was that horrible. Those people of different neuronal colour - they need our help and guidance.

Its stagnation at the worst possible moment, and the best you can do against that is disrupt the taking over of old value cycles with laws.

Which is again problematic, because another, older Tinkerculture gone sour (called lawyers) hijacked the legislative process. The extrem inequality of aristocratic societys usually comes down when natures limits are reached- and cant be breached due to a lack of innovative tools and methods.

If you do not invest in chemistry - the castle will burn- if you do the castle will be blown to smitherens with fertilizer- so you dont until the hunger games start.
A Breakthrough Blindness Treatment Will Cost $425,000 per Eye, If It Works
> Only 1,000 to 2,000 people in the United States are thought to have deteriorating vision caused by this errant gene

This drug will only work on, let's say 1500 people. Of those, let's optimistically say that 1/3 have insurance that will cover expensive treatment. So 500 patients can be expected to be treated by this drug per generation.

So this drug will optimistically get a revenue of $500 million per 2 decades or so, or $25 million per year.

The number generally thrown around for getting a new drug researched and onto the market is $200 million. So it will take 8 years just to break even (although likely front-loaded once it becomes known that this drug exists), and total revenue for this drug for the forseeable future is about 500 million.

Does this seem spectacularly unreasonable ?
whereas slaves are stuck with you no matter how you treat them.

I'm pretty sure I had to read about a few slave revolts for history class when I was a kid. And the underground railroad.

It really is just a difference of degree. But there's that saying, sufficient quantity has a quality all it's own.
This is the best comment
The post touches on the idea that the number of human beings that exist today far exceeds those in the past. Interesting thought. We are now like a cpu (collectively speaking) with 7 billion cores vs 50,000 years ago would only be about 10-100k in numbers.
The holding requirements are contractual, not criminal - there's no law requiring him to hold stock.

The minimum he's required to hold is still more than $10M tied up in a single stock. Wanting to diversify one's assets past that level is understandable.
Not sure if this was a serious comment, but if it was: due to operator precedence in mathematics, the expressions (2^77,232,917)-1, 2^(77,232,917)-1, and 2^77,232,917-1 are identically evaluated, with the parentheses only used to aid the human eye. This in contrast to 2^(77,232,917-1), which is 2^77,232,916 and is a very different number indeed.
Thank you for this. Would you say this applies to both Spectre and Meltdown, or one and not the other?
Those hundreds of cycles of speculative execution can't include more than a handful of cache modifications though, because a change to the caching state implies a miss in the speculated execution itself. So you can't have more than a small number of those before the original stall is over and the misprediction resolved.
I thought about this and wound up changing the wording, the changes should be live with the next update within the next hour
Seems like virtualization is the way to go for JavaScript. Hypervisors such as XEN in HVM mode with modern processors don’t result in a large performance penalty, so I imagine Chrome will gravitate towards it for running untrusted code.
How does endless amount of listener history and preference data give them the upper hand? That data wouldn't exist if they weren't able to license content.
> In fact, JVM doesn't start slow. The fact is most Java web apps start slow. The more libraries a Java web app depends, the slower it starts.

Depending on what definition for "slow" you are using it absolutely starts slow.

As mentioned in a cousin comment, the JVM takes ~100ms to get to user code. This makes it impractical for small applications where the user's code takes less than a second to complete. It certainly gets slower with more libraries, but for some applications ~100ms added to startup makes using Java not viable.

Just some hard data to support Java being slow. I ran Hello Worlds in Java, C, Node, Python, and Ruby. Java is the slowest out of all the languages I tested.

time java HelloWorld
Hello, World
real	0m0.170s
user	0m0.148s
sys	0m0.012s

time helloWorld
Hello, World!
real	0m0.028s
user	0m0.004s
sys	0m0.008s

time nodejs hello.js
hello world
real	0m0.136s
user	0m0.104s
sys	0m0.012s

time python hello.py
Hello World
real	0m0.050s
user	0m0.016s
sys	0m0.020s

time ruby hello.rb
Hello World
real	0m0.111s
user	0m0.064s
sys	0m0.028s
"Learning how to make rope" != "Watching a 10 min YouTube video"