skysight-inc/HackerNews huggingface dataset:
Even this PoC was limited to 2000 bytes a second; even a little noise may well render the attack largely theoretical - or at least make the attack so slow as to make it feasible to use other (expensive) mitigations only very rarely.

But yeah, it's not a brilliant solution. But it would help.
Internet is generally slow, whats going on?
I get cloudflare error on HN sometimes. Reddit gives errors and then. All crypto exchanges are loading very slowly (and values are crashing suddenly).

Twitter is full of complains of slow internet. Is there an attack ongoing?
I am totally with you. For me JWT is the idea to store encrypted values client-side which you can use to authenticate the client and is different to the old way of just storing a random 'dumb' session id with the linked values somewhere on the server.

So yes, I appreciate secure and easy-to-use implementations of that idea, but always going for how insecure JWTs are, just because there are easy ways to do it wrong, is like telling everybody that password logins are bad because some people implemented them in flash.

> Why do we need a whole new implementation?

I think the problem which many people have with JWT is that is not strict enough and does not define certain things. PAST uses the same idea, but does not allow that wide variety of different algorithms we could use with JWT. In my eyes it makes it easier to use, because you do not have to search for implementations with compatible and secure algorithms but just for implementations using the latest version of PAST.
A favorite from Jack Handy: "I think somebody should come up with a way to breed a very large shrimp. That way, you could ride him, then after you camped at night, you could eat him. How about it, science?"

While today saying "how about it, science?" has become our second nature, it wasn't the obvious way to think about the world 50K years ago.
Astatine: Halogen or Metal?
If your agreement with your customer says "we do X with your data", and you actually do Y, then at the very least you may be civilly liable, and it may also be some form of consumer fraud.
All sorts. It could be a Python file with a dictionary of datetimes to targets for that week, it could be a file containing an enum of our suppliers, or (less a data file) it could be a template for a page on the site.

The point is that they are code, or a file directly loaded in, stored in source control, rather than dynamic data stored in a database that needs an editing interface.
I guess we now know who they were really leaving the light on for.
AIUI the fundamental difference between Meltdown and Spectre is Meltdown involves speculating execution that loads memory across privilege domains and Spectre doesn't. If both AMD and ARM won't speculate memory loads across privilege domains, then it sounds like they're strictly immune to Meltdown.
the iOS 11 'bugs' to me read like a testimony of how very stable the system is.
I apologize for self posting on HN, but I haven't been doing much PR for intercooler lately and I'm hoping some new people find it an interesting alternative.
They say in the post that the updates are distributed by system makers.
The only system I trust is mutual distrust. Where competing beligerents beat the tar out of each other.

The US Govt’s Constitutional balance of powers (executive vs legislature vs courts) is based on this principle. It seems to be the best available solution found thus far.

Note: I am an Apple fan boy.

Source: Am also an election integrity activist, which greatly informs my views on trust, privacy, security, transparency, accountability.
My mental hospital experience part I
Cost-effectiveness guidelines somewhat arbitrarily state that an expense of $50,000 per year of life is reasonable, since this is the estimated average annual cost of dialysis therapy. This gene therapy is sight-saving, but not lifesaving, so cost-effectiveness analysis must consider QALYs -- quality-adjusted life-years. How much is a year of blind life worth relative to a sighted year? There can be no definitive answer to this, but one guesstimate I found was 80%. Using this and the $850,000 total cost, one finds that the treatment would have to provide on average 85 sighted years to be considered cost-effective. Insurance companies could use this kind of analysis to restrict the treatment to infants.
Someone smarter than me noted that most science fiction has badly missed the mark of what the present and near future will look like b/c the assumption was that power sources would trend towards zero cost ("too cheap to meter") and that this would enable all sorts of interesting world altering gizmos's like jetpacks, flying cars, physics defying spacecraft etc.

What actually happened is that communication density exploded upward (pony express, telegraph, radios, phones, industrial printing, computers, etc.) at the same time that communication cost plummeted (aka I'm paying a flat rate for internet access and video chatting with people all over the globe).

And I think this is still the case, that we generally still look down on communications as a kind of lesser technology compared to power gizmos. When if anything it should be the opposite, that the ability to communicate so much more effectively across all of humanity has smeared the ideas and inventions around much faster and more thoroughly than anyone really considers.

Why did things take so long? Because everything had to be individually re-invented, we had no shoulders of giants.
I guess aren't all files "data files"? When I think data files I think of a file that contains data points (CSV, tabular, etc).
An easy way of lower multiples of nine is to hold your hands in front of you, and if you want to work out, say, 4 times 9 put down your forth finger and look at the number of fingers on each side of that finger...
No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
If you take a pragmatic stance and consider only what you can measure, then the observable universe is certainly limited. And the rest is, as you pointed out, a matter of semantics.

This part of the Hitchhikers' Guide might not have aged well, but because it contributed to that effect.
> difficult [...] competitors

I once saw a video interview with leadership from Hoover, the vacuum bag company. They lamented not accepting a long-ago acquisition offer from Dyson... so they could use his patents to shut down the whole bagless vacuum idea.
The wording looks a little ambiguous to me (not a lawyer; I'm sure there are rules about how to parse this sort of odd sentence structure), but I would take that to mean that they'll provide data if there's a court order or law forcing them to. Not if the law enforcement agency just asks for it without a warrant.
Nobody ever said multithreading was easy. :-)
> I have my doubts that they'd throw away all pre-acquisition IP just to be able to make this claim

China doesn't seem to be above claiming that they "domestically developed" technology that they really acquired from foreigners. An example I'm aware if is China's "home grown" 3G cellular protocol called TD-SCDMA. It was really a failed European standards proposal from Siemens, but passed off as an indigenous Chinese development for prestige reasons.

See https://www.samizdata.net/2012/06/here-is-the-rac/
Probably. Smaller actors are less known quantities. Intel probably wanted to control the leak as long as possible.
Sounds like it to me.

For those that are unfamiliar:

https://en.wikipedia.org/wiki/Southbridge_(computing)
I use a binary distro and definitely don't want to be running massively slowed-down software mitigations on a corrected CPU.

Although actually, we already are - binary distros already don't take into account per-microarchitecture scheduling, nor any ISA extensions above a common baseline (e.g. just SSE2, no autovectorising to AVX2 etc).

This might provide enough impetus to restructure how binary distros work and get the whole distro compiled with some newer CPU flags (march={first corrected architecture}?) but in the short term i assume every package will take the hit.

Great time to learn about source-based distros!
If your workload does not branch, no performance impact AND Average user's computer is mostly idle = Above intentionally misleading PR statement.
In the same spirit, I had a temp drivers license while traveling. It was just paper. With that temp driver's license I was able to:

1. Fly to New York
2. Cross international boundaries.

However a temp paper was not enough to get into a casino in Canada.
I don't see the scales to be tipped as heavily as you're suggesting. Spotify alone can make or break an artist, even a "Big 3" one. If you want listenership, you absolutely need to be on Youtube, Apple or Spotify (or a platform like Soundcloud). There are zero relevant distribution channels for today's young listeners that are not streaming services.

Chance The Rapper is one of the biggest names in hip hop, and a relatively big personality in pop culture as a whole. He's fully independent. He signed an "exclusive" 2-week-long distribution deal with Apple for his last album, Coloring Book. Apple got exclusive streaming rights (for 2 weeks), and the artist got $500,000 cash – not an advance – as well as free marketing via Apple. This is the type of deal and the type of artist that will start changing things for the better.

There is a great report published by stat trackers BuzzAngle Music[0] from the past year. Here are some important numbers:

• Song Consumption for 2017 YTD was up 29.5% over 2016 YTD (1.5 billion song project units in 2017 YTD vs. 1.2 billion song project units in 2016 YTD).

• Audio streams reached 179.8 billion, up 58.5% over 2016 YTD.

• Subscription streams grew 69.3% and accounted for 78.6% of total audio streams in 2017 YTD, up from 73.6% in 2016 YTD.

• Overall album sales were down 13.9% compared to 2016 YTD (74.0 million in 2017 YTD vs. 86.0 million in 2016 YTD).

• Digital album sales in 2017 YTD were down 24.3% over the previous year (34.5 million in 2017 YTD vs. 45.6 million in 2016 YTD).

• Song sales (downloads) in 2017 YTD were down 23.8% compared to 2016 YTD (313.3 million in 2017 YTD vs. 410.9 million in 2016 YTD).

So now say you're a Sony exec and you're looking at these numbers. Can you afford to have ANY of your top talent pulled from Spotify? Consumption and streaming are rising and pure sales are falling. Megastars like Taylor Swift and Ed Sheeran are immune from these trends, basically, but if you want to stay culturally significant you will soon need streaming more than streaming needs you. That's my opinion.

0. http://www.buzzanglemusic.com/us-2017-ytd-report/
Post updated #6
I really found AppCanary useful for linux packages. They had nice rollup emails for your servers' packages installed with fixes/patches and those with public vulnerabilities without patches. Is there a similar service that does that on the cheap? I'd rather not run/install my own.
2006: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190...

From the abstract:

> Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels.
Trump Administration Proposes Massive Expansion of Oil Drilling
You can just watch the spot prices for g2.2xlarge and see them go up to 4 time the on-demand price in some regions.
Cancer Deaths Fall to Lowest Rate in Decades
Interesting:

> Note: IBRS is not required in order to isolate branch predictions for SMM or SGX enclaves

Perhaps this microcode update exposes a feature which was originally to protect these two modes? But that would mean that Intel did think about leaks through the branch predictor, only didn't make the logical leap that this could be an issue also for normal ring0/ring3...
Here's another potential PR spin: the major cloud vendors got out ahead of this so that they could point the finger at Intel, making customers not ask "Why did you sell me this fundamentally insecure server for so many years?"

Because this isn't really that new nor is it really a bug. Meltdown could be a bug because the asynchronous access of memory in other protection rings is unsafe, but the rest of it is just a normal side-channel attack, an abuse of otherwise-innocent data.

How much moral culpability should rest on the proprietors of software virtualization technologies that don't really safely encapsulate anything due to hardware incongruencies with the modern "sandboxed computing" model?

Surely there have been engineers over the years who've questioned the propriety of misleading users into seeing VMs as fully-encapsulated systems when the hardware just fundamentally doesn't support that type of native encapsulation. Such persons have probably spent the last several years being shunned for being old fogies overly attached to their rust buckets. It'd be interesting to hear some of their stories.
Can you name a system, even a theoretical one, which doesn't meet your anti-criteria of being "forced participation and oppression .. morally indefensible". I don't think you can, which renders your criticisms hollow.

Human beings purchasing things from each other with no legal system? With no property rights? Is this system global, and if not then how do you interact with other nations with their own systems. None of this can exist without someone with a big stick to keep people in line.
I don't agree. If a spec leaves out details, the impelmentors are free to make reasonable decisions on how to implement it. It's more likely the spec didn't really have much to say about promises on the visible effects of speculative execution (the specs are often highly detailed about what side effects can be visible, this is a consequence of modern complex processors, which have very subtle designs).

A bug would occur in the case where the specification specified that there were no visible side effects from these mispredicted speculative executions, and the processor implementor failed to implement that part of the specification. This is a big deal because if it's a bug, Intel is liable.

It's likely all processors with these kinds of features, the specs will get updated to be more specific about these kinds of side effects.
> That link no longer loads for me.

Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....
It’s interesting to see what companies choose to work on instead of security. With Intel it’s speed, with Apple it’s the animated poop icon.
It's a sad state of affairs. I use the new MBP with touchbar for work and it's a nice machine except the touchbar and dubious keyboard (I can live with it). I just wish it wasn't so user-hostile and objectively good features like magsafe hadn't disappeared. I've already had my work laptop yanked to the floor multiple times by people because the charging cable is much shorter than previous generations.

I've pretty much been looking at the same list as you but have concerns over build quality / trackpad / random design choices like a webcam pointing up your nose. Not sure what I will do yet, will likely hang on until next refresh and see if there's a new 15mbp without touchbar.
I'm not getting it. Do they want to sell a product or a service?

And instead of restricting our rights, shouldn't we get a discount when buying multiple GPU cards?
http://en.zhaoxin.com/ZXC.aspx?seriesid=3
51% of Republicans STILL believe Barack Obama was born in Kenya.
http://www.newsweek.com/trump-birther-obama-poll-republicans...

There are definitely principled conservatives that are highly informed.

But the strategy the Republican party and media uses to win elections, includes a lot of disinformation and caters to the uninformed.
Sounds like a similar strategy would work fine with the iMac Pro...
LabKey is hiring a Software Developer for a new product in Seattle (SLU area)
Does it still have that awful coil whine?
How Fox News contiunes to be the sole example of a mainstream right-leaning news network is beyond me.
I know, right?

Sam wanted to use Truth as in "Fact", a shared reality forced upon all of humanity, almost irrespective of humanity, the reality of the physical Universe itself. It makes sense that Sam wanted this definition given his atheist materialist world view.

JBP wanted to use Truth as in "Shared Values". God is real when you look at how 1.5 Muslims behave, or 1.2 Christians behave or 1 billion Hindus behave with respect to the idea of God. You have to work with the fact for close to 7 billion people God is real and then that itself becomes the fact that God exists, albeit as an idea in those people's mind but still an idea that has very concrete real world implications, hence you have to take it as a Truth. JBP wasn't opposed to Universal laws being heralded as Truth, but he wasn't open to limiting the definition of Truth to just that. I think his was a very reasonable position to take.

Sam appeared overly theoretical to me, JBP more practical "rubber meets the road" kind.

It was funny that people found it waste of time. I actually liked it. They were both fighting over their world view, which one was more realistic or better. They ended up doing so over the definition of the world "Truth". It would have still been the same discussion over the two world views even if they didn't appear to get stuck on the definition of "Truth". I was happy with the way it went. They discussed their world views anyway.
I doubt that any court would consider a half-rack in someone's closet to be a "datacenter", nor would I expect Nvidia to enforce that EULA term against a hobbyist.
> Either switch off the feature

This does not help, as the modules are non-standard and can only be read in another iMac (if the encryption is actually disable-able in the first place).
Something like this exists with function multi-versioning: https://lwn.net/Articles/691932/

For example, glibc chooses optimised machine code for memcpy depending on the CPU it runs on.
Even one byte per minute would be enough to cause serious issues. Imagine if some add served up by a torrent site could read information from another tab rendered by the same process?
So what's the takeaway given we have the opposite occurring now?
> I had to update my Taichi to support my RAM at full speeds

Unsupported hardware is hardly a bug.
The problem is often you have to build "Your way" from the ground up. Some people just want "A way" that's working as soon as they open up the editor.
Presumably they take your driver's license mark-of-the-beast and submit it to the surveillance bureaus to check that you're not an undesirable, just as stores do with non-receipt returns for store credit.

It's not like it's the front line employee's or location manager's idea to informally record your identifiers "just in case" - at the very least it's a deep corporate policy. And the company didn't whimsically conjure up that requirement on its own, but was prompted to do so as part of implementing some kind of third party surveillance solution(s).
universe pull rebase
Optimize Middleware implementation in Express application – part 3
I’m personally not working on any of those problems.

I think you’re completely missing my point. 7 billion people on the planet. Most of are not working on research, ..., the important stuff.
You can then detect which addresses were loaded because they caused other cache lines to be evicted.

Even if speculative loads do not modify the cache, you could still have a side channel by analyzing the memory bus contention.

IMO there is no way to get rid of these timing attacks entirely without getting rid of SMT and speculation.
But if that hobbyist ends up creating a billion dollar business, that's leverage Nvidia has for a lawsuit.

Similar strategy of Adobe won't sue a single user for pirating Photoshop, but the second they have a successful business...that's a different story.
I've had so many problems with my XPS 13 that I bought in 2016 that I will never buy another one. Killer WiFi card was utter crap, laptop has issues going to sleep and waking up when closing the lid (sometimes it would hang on the the dell screen when trying to wake up and never recover), etc. Purely anecdotal, but a hard pass for me. Lenovo is my new laptop brand of choice.
Hey, there you go! I kind of doubt Intel really didn't know about this risk.

They were cutting corners; that deserves some opprobrium - especially given their market-dominating position over this timespan.
Go ahead, smash your computer, wait a few months, and buy a new one.
Truly disappointing they are behind on this.
This should be lighting a fire under all tech leaders.
Why LINQ syntax differs from SQL, list comprehensions, etc.
Fluid data reshaping with cdata
What an absolute shitter the legal system is over there. Share information requested by legal officials, get sued by the government. Don't share information requested by legal officials, get detained. Maybe it should be the officials asking for this information who should be getting prosecuted.

Edit: This is how it looks to an outsider, I guess its more nuanced than that - but it should be black and white.
It sure would be nice if someone like dell could at least insert Coreboot, or preferably Libreboot on these babies. They probably have enough heft to make such a change (I hope :).
This is France's first or second largest ISP, and they are also absolute datacentre owners (incl land).

https://en.wikipedia.org/wiki/Iliad_SA

Not quite a smaller actor.
Seems like it is assuming all of those ancestors had unique DNA when in fact they were probably all 99+% similar if you look at it from the perspective of the whole genome. I'm no biologist though, would be interesting to see a real explanation.
The idea is not to have a 3 story house, but to have 3 housing units on that 5,000 sq ft lot - which is not even remotely Manhattanization of the neighborhood. However, unless this bill prevents or limits the applicability of minimum size requirements per housing unit, you've got a loophole big enough to drive a very tall single family home through.
Ripple Co-Founder Now Richest Man in the World
It's ironic how two-faced the Aadhar system is. On one hand, this is the largest scale modern public identification system I can think of with more complex biometrics than just fingerprints. The Indian government made a concerted effort to create Aadhar IDs for even the most remote villages in India.

On the other hand, I wouldn't be surprised if the security of the Aadhar database is already outdated. Even if the database is secure, corruption in the Indian government is so widespread that it would be easy to bypass.
Redis as a dynamic interconnecting datastore
Excited to see them shipping this with a quad core processor (and with 8 MB cache!). My previous-gen XPS 13 9360 has a dual core w/ 3 MB cache (I don't think quad core was offered?) and it has painfully poor performance.