skysight-inc/HackerNews huggingface dataset:
Besides the LWN article Notes from the Intelpocalypse [1] this is the best high level overview I've seen for now. Here is are a few quotes (emphasis mine):

Am I affected by the bug?

Most certainly, yes.

Can I detect if someone has exploited Meltdown or Spectre against me?

Probably not. The exploitation does not leave any traces in traditional log files.

What can be leaked?

If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system.

Which systems are affected by Meltdown?

Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?

Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Which cloud providers are affected by Meltdown?

Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

Why is it called Meltdown?

The bug basically melts security boundaries which are normally enforced by the hardware.

Why is it called Spectre?

The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time.

[1] https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/
It is not possible to get these numbers. Each group is autonomous. Of the many groups I am familiar with none has ever tracked this type of information (over the last 30 some years). If you had 20 or so very dedicated researchers who wanted to attend the meetings of 20 different groups once a week for 5 years,it might be possible to get some good numbers.
It looks like Alex Jones, Glenn Beck, Tomi Lahren, RT, etc.
We use a heat-resistant ABS, 20 years ago it would have yellowed, now it doesn't.
Keep in mind this is based on two anonymous sources. The track record for those has been less than stellar since Trump began his administration.
3 Types of mixed commerce applications for brick-and-mortar retailers
Yeah, same thing happened to me... slow as hell but I guess it's common due the severity of the issue. All people wants to see this at the same time.
Could you explain why it shouldn’t be?
This would be more interesting if the attack that the compiler mitigations was designed for wasn't cross-vendor, cross-architecture.
http://www.onlinecourses.store/the-complete-ios-10-developer... is an excellent course, it is very complete.
> legitimate content

Having seen the tweet in question i'm not sure it is legitimate content.

As for the rest: Eh, can't be arsed to try and argue more.
Any indication of what they were (Homo ergaster? Homo erectus?)?

Do we know if they had a propensity to eat kale and avocado :P ?

If Homo erectus made it to east Asia(‡), and given that as far as we know it was possible to walk from Asia to America back then, it's not difficult to imagine that some of then did make it to the Americas, but raises the question of why they didn't survive.

(‡): https://australianmuseum.net.au/the-first-modern-humans-in-s...
What coding bootcamp should I apply to in 2018?
Sorry to hear that. Is openaddresses.io, one of their backed projects dying too? I've been using their data on geocode.xyz, but it seems like there has not been any new data in the past 6 months.
I've been thinking about doing a writeup, the thing that's holding me back is that there are some pretty good ones out there already, like this one (https://blog.lateral.io/2016/04/create-chrome-extension-modi...)

I'm glad you like foureyes! It was a few years before Warby Parker started doing this: (https://www.engadget.com/2017/11/07/warby-parker-recommends-...)
Seems like the ultimate end-game here is to have mini-vms for every process using CPU-level ring protection. If you can't speculate across privilege levels, only inside them, it isn't a security problem anymore.
True. Got a friend who basically works as a contractor CTO. His day rate is around 2k. Which is insane.
SumUp | Software Engineer, Android Developer, Test Engineer, Frontend Engineer, Integrations Engineer, Quality Assurance Engineer | Berlin | ONSITE, VISA https://sumup.com

SumUp's mission is to empower small businesses to grow by accepting card payments in their stores, online, and mobile. We ship more than 2,000 card terminals every day, and our business is growing rapidly. Headquartered in London, our major offices are in Berlin, Sofia and São Paulo. The Berlin office alone comprises more than 130 people from over 30 countries. Our office is very social, and if you're worried about learning German to move to Berlin -- don't be! We're here to support you in coming to Berlin and getting adapted.

We offer an education budget, language classes, the opportunity to travel abroad, and dedicated time for side projects and open source. Here are our open positions!

- Software Engineer - Qt: https://sumup.workable.com/j/D2ECF320DF (Qt, C/C++)

- Android Developer: https://sumup.workable.com/j/BF2411A781

- Test Engineer - Hardware: https://sumup.workable.com/j/C31F329203

- Frontend Engineer (all levels): https://sumup.com/careers/frontend-engineer (React, Jest, Webpack, Node)

- Integrations Engineer: https://sumup.workable.com/j/1A48B8C48C (Ruby, Node, Javascript, iOS, Android)

- Quality Assurance Engineer - Data Warehouse and ETL: https://sumup.workable.com/j/16233019B0 (Postgres, Python/Java)

(If you're interested in working in São Paulo or Sofia, we also have some positions open in multiple locations, just send in your application and indicate the office)

Learn more about SumUp here: https://sumup.com/careers
If Google could make a phone as beautiful as my iPhone X in both construction and software I'd switch immediately because the google assistant is miles ahead of Siri.
Actually they do have incentives to care about local and state laws because they need cooperation from local and state governments to enforce the law.
The biggest issue I've seen personally was when a vendor we were using would append query strings to filter data. On the second filter add, it would just break in Internet Explorer, but Chrome and I think Firefox would work fine. Come to find out, their code didn't check the existing query string and was either adding extra # items or ? items, I can't remember which. Looking it up, though, the standard was that there is only one, so shockingly IE10 was the only one honoring it.

The vendor, who works heavily in Chrome, was gobsmacked and their response was basically "well, yeah, but who uses Internet Explorer anymore?" to which we had to say that's fine, well, and good, but we must support IE10+/Edge.
It seemed to me that Microsoft hinder IE purposely.
They felt they were stronger in the desktop and tried to keep computing there. They perceived the internet as a treat.

Meanwhile. Google tried to break that by funding Firefox. Eventually they decided they needed to do it themselves. They probably felt that Firefox was not moving fast enough.
This doesn't affect branches, only indirect jumps (and calls). The performance impact will still be considerable. It will make PGO more crucial (or smarter JITting, for VM languages) since the penalty can be avoided by prefixing an indirect call with a direct call to the most likely target - this is a well-known technique, useful on machines with weaker jump predictors than branch predictors.

Quite possibly, the worst affected code will be OO code that is dynamically (open) polymorphic.
Itanium and the VLIW Architecture
One request here, can people include a rough estimate of how many hours they work weekly to add some perspective?
I guess I see it as a Spacemacs user or Frontmacs user decided that was the way to make Emacs “their own”, less in an emotional sense and more of a utilitarian “this will do the job nicely for me”.

I got into Linux with Mandrake. A year later I was running Slack.

Not everyone sticks with their first tool when starting out
Three Web apps and 12 tabs might not be the equivalent of that one app in Electron, if it's a heavy one. If a Chrome browser instance running Slack uses less RAM than the Slack Electron app does, __then__ we can say Electron uses more RAM than it should.

I'm not saying it does or doesn't, and I'm not defending it, I just think we need to be a little more fair with our comparisons

I did a comparison a while back (though I'd hardly call it scientific). I built a basic "hello world" Electron app, which consumed 69MB of RAM on Windows 10. When I opened the html file of that app in Chrome it took 82MB.
That's nice in theory, but there are so many laws on the books and limited resources, any executive branch has to choose what laws to go after.
> The price is artificial.

Isn't this a given?. Which product are you buying that costs the same as cost " to create and deliver"
https://www.theroot.com/7-reasons-black-america-should-fight...

Just because something seems unbelievable doesn't mean it is made up.

EDIT: backup for Sessions being a racist:

http://www.cnn.com/2016/11/18/politics/jeff-sessions-racism-...
Launch feels like just yesterday! https://news.ycombinator.com/item?id=9935458
It's still effectively possible for someone to only have 1 kid that had a child that had a child etc. Each link could have multiple children as long as none of those descendants had children that survived to the present day.

This becomes more likely if you include genocides that may have quipped out large swaths of someones descendants.

You also have rather insular groups where a few thousand people may be largely segregated from the rest the world. That's not going to be particularly stable over hundreds of years, but you only need 1.
Gangs will always be in business even with legal pot. Just look at cigarettes and alcohol. Both those things are legal and both those things have massive black markets to bypass the heavy regulations and taxes imposed on them.
principal engineer is when you want to give someone more salary but they dont wanna be a manager
There's a huge difference between pushing new standards and Microsoft's lock-in strategy. Chrome pushes features that developers are eager to use, so they end up building things (perhaps unwisely) for Chrome's draft implementations. In my experience it's just the case that other browsers are usually behind, but eventually get there. This is different from Microsoft's proprietary technologies baked into IE6.
Introducing Hyperapp 1.0
Who serves whom?
>> “QUESTION: Look at the two photos below and see if you can figure out which person is real.”

>> “ANSWER: Sorry! This was a trick question. Both images were generated by computers.”

Not really a trick question when even if you know they’re both fake that the only way to be right (confirm you are right) is to be wrong.
Red Hat: Intel, AMD, POWER 8, POWER 9, IBM System Z, and ARM Chips Are Affected
Never forget: Trump did not even want to be president, as revealed yesterday. So this is the alt-rights way of exacting revenge for 8 years of Obama, by punishing the 52% of voters who didn't vote for Trump. The right is getting their licks in while they can.

Edited for clarity
Yay for asynchronous :D

It's honestly criminal how little attention async gets.

But absolutely disagree on massively parallel processors. What do you think your GPUs, TPUs/DPUs not to mention Tilera types are?
You can export the list of albums you saved through the api. A while ago I wrote this using jq: https://gist.github.com/ergl/ae7c56d2a754558bb7b2cf9e98979fa...

Just grab an auth token from https://developer.spotify.com/web-api/console/get-current-us... and call the above script with it. Very hacky, but it works.
Some buildings (hostels and shared accomodations) have shared internet (secured with WPA2). This type of attack might be particularly profitable in such situations.
I'm not more knowledgeable than you, but I think I agree.

side channels have always been some of the most insidious exploits. Many are basically un-solvable (timing attacks are always going to leak some information, and compression is basically completely at odds with secure information storage), many more are easily enough overlooked that it would be easy to maliciously include them without raising any eyebrows, and the "fixes" for them almost always murder performance.

I think the only real fully-encompassing solution to this is a redesign in how we use computers. Either a massive step backwards on performance and turning off most automatic "optimizations" until they can be proven through a much more rigorous process (both in compilers, and in hardware), or a significant change in how computers are architected adding more hardware level isolation for processes and systems running on the machine (just daydreaming now, but something like a cluster of isolated micro-CPUs that run one application only).
tptacek exploits computers for a living, so it's glorious for him :)
But it's fairly likely to be carbon-based, as carbon is the simplest existing element with the maximum amount of valence electrons. And generally, simpler (= lower ordinal number) means more stable, as well as more likely to arise (as less energy is required, e.g. in stars).
Memory-barriers.txt
FWIW, all branches will need to be followed by a memory load fence which seems to trip up speculative execution on Intel CPUs.
In pursuit of Otama's tone (2017)
London, 0 experience, have Phd.
Google Research Scientist:90k£ base, 100k£ bonus and stock
The Principal has a very distinguished and widely-recognized track record of achievement.
Cisco Meraki | Software Engineers & Managers | San Francisco | Full-Time ONSITE | https://meraki.cisco.com/jobs

Meraki is disrupting the world of traditional networking by bringing it to the cloud. Our mission is to make networking simple with ease of management through our web app called Dashboard, whether you have one local site or 500 worldwide. We make enterprise switches, firewalls, wireless access points, phones, and security cameras! Engineering at Cisco Meraki has the best of both worlds - job stability and benefits of a leading enterprise, but the Meraki magic of remaining like a SF startup in structure and culture.

About Meraki? https://www.youtube.com/watch?v=QvBFOLkQtJU

We're hiring across all departments!

- Software Team Lead, Network Switching: http://grnh.se/ejdb6v1

- Software Team Lead, Product Security: http://grnh.se/231oy61

- Senior Software Engineer, Backend: http://grnh.se/p8suke1

... and many more positions! Please apply directly on our website or email me at amy@meraki.com, thanks.
Sessions has clearly never had a session.
If in the US, it is illegal for them to have that in the employment contract and they could be sued for that. I'm not sure how it works if it's not operating in the US, but if it's a US company, might still apply. My company abides by all US laws because they're headquartered in US, but have offices worldwide.

According to this law: https://www.nlrb.gov/resources/national-labor-relations-act employees can talk about things that matter to them, salary being one of them. And the National Labor Relations Board (NLRB) includes pay secrecy language in contracts as illegal, and even if you sign an NDA, it is still your right to talk about your salary.

The consequences for violation aren't usually very serious, so companies aren't too worried about violating the law, unfortunately. They usually have to provide back pay to the employee and/or offer the employee their job back (if they were fired). Obama signed an executive order that increased penalties for companies contracting with the government: they can lose their contract.

This law doesn't include contractors, ag workers, employees of federal, state, or local gvmt, or those employed by interstate rail and airline companies.

It does cover you if you aren't in a union.

Violations should be reported to the NLRB and they'll investigate it.

Source: https://www.npr.org/2014/04/13/301989789/pay-secrecy-policie... and https://www.govdocs.com/can-employees-discuss-pay-salaries/
The article doesn't mention my biggest annoyance:

"Hangouts video and voice calls don't work in Firefox for now. Google is working to fix this as soon as possible. Until then, use a different supported browser."

It's been over a year! They can't really be "working to fix this as soon as possible", can they?

I think video might actually be working, but phone calls (via Google Voice or Google Fi) aren't and that is the message I get.
It (staff) is a level, one past senior engineer.

The difference is that senior engineers do something resembling engineering. When not attending meetings, I turn coffee into emails and Google docs.
Why just marijuana? Why not every drug? In fact, why is possession of anything a crime?

We already have laws about improper storage of hazardous materials. Possession of anything should be legal. Now distribution and sale is a trickier subject but pretty easy as well. As long as you don't misrepresent what you're selling, it should be legal as well.

If we are for a small government, we have to walk the walk.
In other news, Intel has found that by not using a computer at all, though performance overheads increase 100%, this counter-measure does secure any previously available attack vectors.
My gains on my 401k have been excellent.
What about users who only execute trusted code?

All of these attacks assume you are running something you don't trust on your CPU, whether it is another user's program, a non-root executable, or a JavaScript program from a website.

When do we stop hacking processors, kernels, and compilers and revisit our assumptions of what we can and can't do securely.
Taiwan insist it's Chinese. Its government claims to be the rightful government of the whole of China.
I wonder how the performance and size of apps compiled with Graal compares with traditional Java apps ?
I agree; I would like to see a move away from trying to cram everything into a browser app, and towards adding better connectivity and community features to native apps.
Intel CEO sold millions in stock after company was informed of vulnerability
The convergence at a later time sounds highly improbable. The total state of the universe is so large that this would only work if there was something forcing the timelines to converge and never by chance.
This is how:

https://www.forbes.com/sites/eriksherman/2016/03/23/nixons-d...

From John Ehrlichman, counsel and Assistant to the President for Domestic Affairs under Nixon:

"The Nixon campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar left and black people. You understand what I’m saying? We knew we couldn't make it illegal to be either against the war or black, but by getting the public to associate the hippies with marijuana and blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings, and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did."
> It's not universal. My friend started off his career in Denmark making pretty standard US tech salaries.

That's fair, and I'm aware there are always outliers. For added reference, starting tech salaries in Oslo, Norway are around $50k (cost of living comparable to Seattle or DC). Perhaps more importantly, there's much less upward potential - senior devs rarely earn 6 figures USD unless they're freelancing.
Roadmap: How to Learn Machine Learning in 6 Months
Technically, yes. But you might also technically be passed over for promotion, or getting a raise. :)
Well, one persistently active tab with a non-https site open.

I suppose you could configure the rogue AP to have one of those registration pages but the registration page tells them the WiFi will only work so long as they keep that tab open.
In most cases hair gave it away for me, especially at the contours. The picture you linked is an extreme example.

However, give it to a good Photoshop artist, like most celebrity pictures are, and I'm sure these issues will be fixed in no time.
Ask HN: Meteor vs. Express+React?
Over the past year I have been learning Node/Mongo/Express/React/Redux stack, and I'm pretty happy with it.

Is it worth investing my time in learning Meteor?

Does it have any advantages over the stack I have?
CPUs have been vulnerable to this attack since 1995. How did it collectively take us 22 years to figure this out? I know it's a highly esoteric complex attack, but there's no shortage of clever hackers in the world.
They have spectre, any CPU with speculative execution and caches of any sort (excluding some capability machines, no ROP exploit machines and PLB enforced SASOS machines), including branch prediction (!) is vulnerable to spectre. (For those of you not in comp arch, that roughly translates to "literally every single non embedded CPU, and then some")

That's what makes the flaw so deep and troublesome.
O&O DiskImage Professional Edition 11.1.165 Full Key Free Download [Latest]
I've been making modules for VCV Rack and it's super fun and pretty easy!

You can check them out here: https://github.com/Miserlou/RJModules
That's doesn't make much sense as a premise data wise.

The prison boom around the war on drugs overwhelmingly involved the government prison complex, from 1980 to 2010.

Clinton didn't have meaningful ties to the private prison industry (which barely existed at the time), and a frightening number of people were thrown into prison for drug crimes during his eight years.

About ~95% of all people put into prison over those 30 years from 1980 to 2010, went into government prisons.

Who benefitted? We spent over a trillion dollars on the government prison complex. Millions of government employees pocketed hundreds and hundreds of billions of dollars in cash from the scheme. It makes the private prison industry and its meager profits look hilariously tiny by comparison.

The US has about a million law enforcement related employees it doesn't need, used to prosecute the war on drugs in various ways. Those are government employees, they benefit from the government prison system, they were made possible by government laws that date back five decades or more. They cost $80-$100 billion per year. Now compare just that one section of the government prison complex, to the private prison complex money.

CoreCivic generates $200m in profit per year. That's equal to about the cost of just ~3,000 cops. The US has at least several hundred thousand more cops than it needs, due to the war on drugs. That's how truly massive the government side of this is by comparison.

Private prisons only began to meaningfully expand in the middle of George W Bush's Presidency. In the 1990s, when such an extraordinary number of people were put into prison, the private prison industry was miniscule.

Blaming any of this mess on the private prison complex, is pretty absurd given the facts of what happened in prisons and the war on drugs in the 30 to 40 years pre ~2005.

And this post is in no way arguing in favor of the private prison system, it shouldn't exist.
I don't get it. We used to use something like a pipe-delimited string, then JWT, now PAST. Isn't the encryption doing all the work regardless of how the data is structured?
Show HN: HNNotify – Get emailed when a users reply to your HN Posts and Comments
Awesome! I'll need to remember outline next time this happens.