skysight-inc/HackerNews huggingface dataset:
Christianity, at least as far as I have been taught it, seems to implicitly conflict with intelligent extraterrestrial life, as at the very least it would lead to questions whether the aliens also are in sin, whether Christ's sacrifice applies to them or did they have their own equivalent of Jesus, and generally how special humans are in God's grand cosmic plan.

> Religion tends to be very careful to stay in the area of not providing a testable hypothesis which means that new alien knowledge won't prove it wrong.

That's true, but until very recently, the idea of life elsewhere wasn't really considered seriously.
No, they mention 32/64 on the specs pages.
> replays are rare

Tell that to my wife who has seen every Office episode at least 20 times.
First five minutes of criminology 101 "Law Enforcement vs Policing"

Law Enforcement means replacing that cop with a very small shell script hooked up to a red light camera style radar gun and a ticket printer. Policing is a somewhat more nuanced human task.

With a side dish of the Peelian Principles that define the difference between an occupying military light infantry force and a police force

https://en.wikipedia.org/wiki/Peelian_principles

So Peelian interpretation #2 its a speed trap intentional or unintentional

Peelian principle #4 if the cop was in anyway legitimately disrespectful the ticket should not be written.

Peelian principle #6 there is a diversity in humanity such that the law (aside from mandatory minimums) has always specified "up to". Its a very medical doctor Hippocratic oath like outlook of first do no harm, do the minimum necessary act to get the result.

Peelian principle #9 realistically there is no way to prevent speeding while driving the pregnant wife in labor to the ER, so why bother with a retributive ticket? Turn on the lights and escort them to make it safer, maybe. On the other hand business as usual idiot woke up late trying to speed to work to catch up, that can be permanently cured by a retributive ticket. Principle 9 is the logic behind how we treat medically impaired driving ; intentionally getting drunk equals ticket, having a heart attack means no ticket, although in an authoritarian law enforcement philosophy both are equally hazardous driving situation for the general public.

To some extent pot legalization is a classic law enforcement vs policing argument. By Peelian principles individual use while not endangering the public should never, ever, be enforced anyway regardless of law. By definition MJ can't be a hazard to yourself or the public as long as you're not driving or operating heavy machinery, so its simply not a police issue. Kinda like how some people argue immigration law enforcement is not a Peelian police issue.
The link goes to a site with a spammy-looking domain, and there's no reason to assume a URL with .pdf at the end is actually a PDF. There's nothing stopping the server from serving a malicious JavaScript file instead.

Assuming it's safe based on available information is very bad. Even your comment isn't enough because you could be working with someone to drive people to a malicious link.
> In general, I think that this is the wrong approach, because that means adding a database round-trip (which in a large system is almost certainly a network round-trip) for each and every API call.

In general, asking a database for set membership is not close to the slowest thing applications do.

> Notably, if the entire system is secured in depth (which large systems should be), it means adding a network round-trip for every layer of the API (e.g. one for the frontend server to validate the user, then another for a backend server to validate the frontend server). Using a stateful token[0] replaces that network round trip with a public-key or hash verification, which is much faster.

A handful of those set membership checks: still not the slowest thing applications do. (Also, I don't think it's a given that internal auth has to work the same way external auth does, for a bunch of reasons.)

> I think that generally revocation concerns are a bit overblown.

Without revocation, you can't log out of things, and you can't invalidate sessions after credential rotation. So unless you're saying tokens should be valid for some tiny number of seconds... in which case, it's questionable that you're buying a lot of performance for your drastically more complicated token scheme.

> Even with a database lookup on every request, there is a (small) amount of time that one is willing to act on out-of-date information (after all, the user's access could be disabled immediately after the lookup, before the action is performed). Almost every business has some window in which it is willing to act on old information: better to make it explicit than to leave it implicit.

Median response time is not comparable to usual token expiry times. If you do make them comparable, then you're making that DB check every time anyway. The entire point of the token is to do that less. You're right that it's implicit, but it's also "the fastest that it possibly ever could be", so that's not a bad kind of implicit.

If you really desperately want to make the check faster, why is JWT better than a local token cache?
Some of the examples on the page don't seem to be working right (in FF 52.2.0 ESR, work machine). For instance, all of the h1, h2, etc headings appear the same size for me.

Tried in IE11 (not that one should expect anything to work there, haha) and it looks even more odd (no orange coloring, etc)
>It's intellectually lazy (read: dumb) to apply an anecdote to everything

>State level agencies are obviously going to be low-level dreck.

LOL
The dev build support specifically blocking web workers, typically used by cryptominers. So at this point I think it will be a good idea to block web workers by default everywhere, and enable only if a trusted site needs them.
Isn't it the case that the Itanium architecture would not be vulnerable to Spectre because it moves the onus of branch prediction from the CPU to the compiler?
“Believe nothing you hear, and only one half that you see.”
― Edgar Allan Poe
Bare metal servers that run trusted code like a build not are not effected. Maybe this will be a bios setting or a kernel flag to set .
Should possession of 100 lbs of weapons grade uranium be a crime?
It's not really a dupe, yours was 12 hours ago and didn't gain much traction. HN allows for a limited number of resubmissions in this case, so that interesting content that was missed due to timing has a chance.
Well, fundamental dynamics are likely harder to counteract than some of the human factors which may be a bit more arbitrary and anachronistic. Not that this is a show stopper, just something to keep in mind.

Regardless, I like your suggested approach.
That was only the case until 2013 or so. Modern Atoms are vulnerable.
From what I recall, patches started showing up in the Linux Kernel, causing lots of buzz and speculation among the security community.

People noticed that one patch was only being applied to Intel processors, leading some tech blogs to speculate that only Intel processors were affected by the bug, and that triggered a PR response from Intel. Then someone reverse-engineered an exploit and posted about it on Twitter, and the cat was out of the bag at that point, so they moved up the disclosure timeline.
> it's Really Hard to understate the difference between poor folks running cottage industries around moonshine and the sprawling violent criminal enterprises that flourished around the alcohol trade during prohibition.

Certainly. And it's some gargantuan scale different versus the illegal drug trade as a comparison (0.1% as large perhaps). My point was that it isn't particularly uncommon, the underground illegal alcohol trade (it's also not monetarily massive in size as you're noting, which is why it exists at all, local police mostly look the other way so long as it stays small'ish).
That would be hilariously awesome
Depends on the browser. Chrome has mitigations, but not solutions to this, which largely consist of degrading the quality of the timer required to pull off Spectre. WebWorkers give you a more accurate timing method that can pull it off. Basically, any website can now theoretically read your encryption key in RAM and something like noscript will be required, not optional for maximum safety.
Don't worry, I was wondering this myself. There doesn't seem to be anything official or even any discussion on the forums yet.
As that excerpt says, they are merely analyzing the statements, which they obviously must do after receiving the complaints. Nowhere does it say they are planning on doing anything beyond that analysis.
@Tweetermeyer

TESLA TOTAL PRODUCTION BY QUARTER

Q32016: 25,185

Q42016: 24,882

Q12017: 25,418

Q22017: 25,708

Q32017: 25,336

Q42017: 24,565

Anyone else noticing a pattern here?

https://twitter.com/Tweetermeyer/status/948682235892264960
A new thing that's going to become a standard part of systems engineering: deciding whether any given system needs to run with or without these kinds of protections. Do you want the speed of speculative execution or do you want Meltdown/Spectre protection? In some cases lack of protection is fine. But figuring out the answer for any given system is often going to take expert-level security knowledge. Security is all about multiple layers of protection, and even a non-public facing machine might benefit from these layers depending on the context.
This seems wrong. Google's starting position for full time employees is SWE III.
> I also think Sessions should enforce every law, lest he pick and choose what is illegal and what is not, thus becoming the most powerful law-maker ( or unmaker ) in the land.

Setting prosecutorial priorities is an important executive branch function, both in terms of resource management and in terms of avoiding injustice; criminal laws are not designed to be applied by automatons, and executive officials are not doing he job they are paid to do if they act like blind automatons in applying them.
I read something while researching my DNA results that made me realize how little my ancestors have to do with me. Maybe somebody here can tell me if it's actually true.

You share about 0.5^n percent of your DNA with each member of generation n, where n = 1 are your parents, n = 2 your grandparents, and so on. The explanation that was given to me is that each of your parents contributes 50% to your genes. Depending on which of their parents' genes they gave you, you share anywhere from 0 to 50% of your DNA with each of your grandparents, but for simplicity's sake let's call it 25%.

The point is, most of the people we're trying to find out more about through ancestry websites and DNA tests are barely related to you. Searching for your great, great, great grandfather from the old country? Fine, you only share about 3% of your DNA with him.
How about not running untrusted code? That seems to be much easier to do and won't kill performance. Kill js on the web. Run only apps signed by Microsoft. Develop ML based malware fingerprinting that can recognise timing attack patterns. Throwing OO execution away shouldn't be an option in the long term.
How many years should we think back?

I have some old laptops at home and they work quite well with a proper Linux setup.

Should we think in terms of slowing everything down by some factor, or just slowing tasks that need an un-throttled CPU?
I don't really know what should be done about salaries. I don't really believe that "fairness" can be defined, or even if it could be, that you could get a global workforce to agree on a definition.

On the other hand, I'd take the opposition position of yours and say that we should be incentivizing people to live in big cities for [many reasons](https://www.city-journal.org/html/why-big-cities-matter-more...). It is not perfect or tradeoff-free, but nothing ever is.
Unexpected lessons learned from running 1390 kilometers in an year
And these nations even have strong debates about even allowing people the right to choose when to die. Morality is a big part of adopting universal healthcare.

Also, I don't see how the current private and public insurance systems in the US would prevent insurers or government to decide, in the future, that certain groups of people do not deserve treatments or covereage anymore.
Okay, I think I totally missed the point you were complaining about. In my day to day I see a lot of people doing large tasks in things like AWS lambda (5 minute timeout) that really should be decomposed into workflows, decoupled with SQS, done with a batch processor or the like to make them more resilient, debuggable, and parallelizable.

Sounds like you're doing something totally different and the heroku-ness is failing you.
The next step in the Helpmonks email platform journey
Oops I basically wrote an identical reply before reading yours.
If this were 15 years ago, I'd say the site was SlashDotted.
Simpler is almost always better.
I am very curious about Yehuda Katz's question on CSRF attacks and GET requests: https://twitter.com/wycats/status/948812652997885952
And you still have to slow down from 0.9999999c
If I understand it correctly (not entirely sure), an adversary needs to have code running on a system to exploit either attack - would Javascript running in a browser be in principle sufficient to be able to exploit this, or are there some mitigations (sandboxes?) in place to prevent this from happening?

Edit: Okay, found this post from yesterday: https://blog.mozilla.org/security/2018/01/03/mitigations-lan...

Thanks for the reply!
How I made $1934.66 in two days of tech consulting (with no network)
Speculative Execution Exploit Performance Impacts
Responding to Suicidal Content Online – best practice guidance [pdf]
Or you carefully ensure all of the threads are in a safe state before you fork().
When I say "minting a token", I mean taking some data (e.g. your user name), adding some metadata (audience, expiry), and performing some operation on it (signing, encryption, authenticating) such that a different party will accept it as-is. (This is like "minting" because if you have a plausible-looking coin people would just accept it without having to go ask the issuer if it's a real coin via serial number or whatever.)

When you generate a random key, you have to go ask a trusted third party what the data associated with that key is (and, therefore, if it's still valid).

Minting tokens is bad because it's drastically more complicated, has tons of failure modes, and most of the time you end up doing tons more database transactions anyway that are way more complicated than set membership (i.e. is this still a valid token?).
Kernel flag at compile time? - Yes

Kernel flag at boot time? - No (the fix is a to compile instructions differently).

Bare metal servers that only run trusted code are only unaffected so long as they explicitly opt out of the new security model, and I'm not sure how easy that'll be...
wstat is of course how the MS-DOS, OS/2, and Win32 world has been doing this stuff all along. DosQueryFileInfo() is symmetrical with DosSetFileInfo(). The Windows NT Native API also has symmetric system calls.

Similarly, clonefile is akin (but not identical) to the old DosCopy() system call on OS/2, which likewise made file copying available as a system API call. DosCopy() had the semantics of sending the copy operation over to the file server for actual enactment on (LAN Manager/LAN Server/Netware) remote volumes.

And of course Win32 programmers will recognize the result of pdfork that one can give to kqueue, as a process handle that one can give to WaitForMultipleObjects(), although they will be unhappy about the default semantics of closing the process handle. The process descriptor also lacks the ability to poll/select/kevent for stop/continue events in the child process, unlike waitpid/wait6.

The point about implementations of fexecve() and execveat() is a good one. For example:

If one passes a close-on-exec file descriptor to fexecve() on Linux or FreeBSD, and the executable is actually a script with a #! line, the script interpreter is passed a /dev/fd/N argument for the script that has of course been closed. But if the executable is a binary, the call works fine. Of course, if one reads the first few bytes of the file to find out whether there is a #! line and thus whether the executable is a script or a binary, one needs to open it as O_RDONLY rather than as O_EXEC, thus preventing the execution of files where one does not have read access but does have execute access. One thus ends up opening the executable twice, first with O_RDONLY to check whether it is a script or a binary, and then with O_EXEC to allow a non-readable binary to be executed with fexecve().

kqueue() is good but not ideal. For one example: It has problems if one wants to combine NOTE_TRACK, NOTE_FORK, and NOTE_EXIT, because it returns one event for both a forked child and an exited child, which both try to store different things in the "data" field of the event.
Then you can just drop "imitate human" part. We don't need that anyway, except for some niche applications.
I once got curious about that myself, so I downloaded some of the full size black and white TIFFs from the NASA site. (I'd link them, but I'm not sure where the archive is today.)

Anyway, if you bring up the shadows a long way in Photoshop in some of the pictures you'll find some little dots that look a whole lot like stars.

If you'd like to test this for yourself, take some photos of the full moon with a telephoto lens. The moon is extremely bright, as nighttime objects go, and the amount of exposure needed by the camera to capture a photo is short. Edit: The moon will be properly exposed, the sky dark.

There's something called the Looney 11 rule, https://en.wikipedia.org/wiki/Looney_11_rule. Basically, you can set the camera to these settings and obtain a reliably exposed photo of the moon. There's a similar rule for objects on earth which are in full sunlight called the Sunny 16 rule. The important thing to note is that there is one camera stop difference between these settings. Objects in full sunlight on earth reflect twice as much light as the sunlight reflected from the moon. And in terms of photography, that is a trivial difference.

Try those Looney 11 camera settings indoors sometime. There's not even enough light in your house for those settings to work. You'll see the lightbulbs, some reflections, light coming in through windows, etc, but not much else.

The important point to take away is the difference in the amount of light between the stars in the sky and the surface of the moon, is significant. It's large enough that it doesn't fit into the exposure latitude of color transparency film used (see https://en.wikipedia.org/wiki/Exposure_latitude), and is very deep in the shadows of negative film if it registers at all.

But rather than take anyone's word, this is something anyone who has a camera can try for themselves.
"Can I use the logo?
Both the Meltdown and Spectre logo are free to use, rights waived via CC0. Logos are designed by Natascha Eibl."

I'm sure she would love to hear your opinion personally.
Site - https://vividfox.me/
Email - mail@vividfox.me
The composition of the court has changed quite a bit since then as has public opinion.

Cannabis is now legal for medical use in 29 states. Many of these laws were passed through the referendum process. That is a lot of democracy to overrule from a bench in D.C.
Bicycles are 97% efficient. Society could be organized around the bicycle.

Many of the health issues would be corrected if our environment required people to exercise to get around.

People are just really lazy.
If you look at the fine print he's still leaving the decision to crack down to each stares attorney general but sessions is doing exactly what you would want to do is you want to see the opiate crisis get much worse. These people in DC are so stupid they don't even have the brain power of an earthworm but they want to treat us lower than dogs like we were born to be Jeff Sessions slaves. I'm so sick of these bullies.
The Year Climate Change Began to Spin Out of Control
There's a difference between the numerical levels and the job titles.
That won’t really be a problem for the cloud providers. That simply charge more because the customers will use more compute.
There's a big dose of ethnocentrism (species-centrism?) in that. Why do we even want an AI that has human foibles, to the point its apparently as fallible as a human? Why is that part of the definition of 'thinking'?
Yes, and one of the mitigations is to reduce the precision / accuracy of certain timer calls in Javascript.
Major Linux redesign in the works to deal with Intel security flaw
"As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs"

I am not sure what "the process in which it runs" means here ... do they mean private memory from within chrome ? Or within the child process spawned from chrome, or within the spawned JS sandbox or ... what ?

Practically speaking, I worry about a browser pageview that can read memory from my terminal process. Or from my 'screen' or 'sshd' process.

I think that is not a risk here, yes ?
I imagine BOOM and BOOM v2 may be vulnerable as they support OoO execution.
9 Essential Blogs for Product Managers
We don't all profit from it, it's a total distraction for most people.

I can't believe the amount of time I've wasted on Linux just trying to get my sound card to work, or a printer. Or I could just buy Windows.

FOSS has a lot of "me too" and "reinvent the wheel" as well, to the point of distraction. At this point I think it's borderline useless outside of compilers and scientific computing.

Also, I really wouldn't waste children's time on FOSS. "Here's how to spend a week on Stack Overflow fixing your printer" is not a core subject.
I'm pretty comfortable with the makeup of the subset of HN readers that take me seriously and/or understand where I'm coming from, and so I'm going to avoid litigating with strangers on this one.
A nice little gif from twitter: https://twitter.com/misc0110/status/948706387491786752

User typing into a "secure" Linux (edit: was MacOS - can we do strikethrough here?) password dialog while another process steals the data.

The first attack was incredibly difficult, but once there's a proof of concept, copies will proliferate.
I've been producing digital music since 2001. It took me three years of part-time tinkering to get something produced that remotely sounded like a song. It takes time to learn.

FruityLoops is a great start to learn the basics of audio sequencing such as: tracks, beats, bars, measures, tempo, basic mixing and effects.

Once you've mastered FruityLoops, I'd recommend switching to Cubase or Ableton Live. There are a lot of VST ( Virtual Instruments ) synths available for free which can offer a lot of unique tones ( not pre-sampled audio ).

There are a lot of YouTube tutorials available now for all these tools, which can really help. Reddit also has a few good sized subreddits for digital music production and is a good place to get help or advice.
> The states already lost

precisely. which is why we need the feds to try and enforce the law again in order to relitigate it.
Research has concluded that naming storms/hurricanes results in a much better public response. People is more likely to take preventive action against "Storm Eleanor", rather that against an unnamed bad weather report, plus a name allows people to differentiate simultaneous events.

In the same way, it is not far fetched to think that a name and logo are much more likely to convince users to quickly apply patches etc. than just CVE-2017-5753, CVE-2017-5715 & CVE-2017-5754. Plus, they are way easier to remember!
From the Spectre paper:

> As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2).

https://spectreattack.com/spectre.pdf