skysight-inc/HackerNews huggingface dataset:
Code for the solution and then code for performance. Direct performance coding is a bad return on investment.

First prove it works and then prove it can be made better and faster ...
A $29 Battery Could Cost Apple Over $10B
Come on, Mailgun.

Let's Encrypt is free and takes less than 5 minutes to set up (using certbot).
It's ridiculously easy to apply a method which is not applicable if you are not at least a little aware of the theory behind it. You will get wrong results and you will never know why. The wrong results might never be found out because the impact is so complicated that you cannot even point out the source. I have sadly seen this happen too often in various places. But because our other systems are robust enough, this issue (even though it affects things) is not really heeded to until something really catastrophic happens (like 2008 crash).
Sooner than it would have if Spectre hadn't happened. Spectre, in my view, really changes the cost/benefit considerations here.

Wish I had a better timeline to share, but with stuff like printing not working properly, it's not an easy decision to just flip it on for everyone.
You're arguing that this article does not cover Spectre.

It does ... it just doesn't have to fully describe spectre to show why the raspi is not affected.
But since when a VM is used as a workstation?. AFAIK we know that this vulnerability could be executed via javascript. If the browser is safe then we are safe about it without patch-hacking the kernel.
I never thought about it this way. Thanks for putting that in a different perspective. I notice I'm becoming more and more conscious of time as I age. My thoughts have focused on being more efficient with time and spending it wisely, but I didn't make the connection to my energy.
There is almost certainly a branch predictor even in these simple ARM cores.
This might be a controversial opinion on HN, but it's not controversial in crypto engineering circles. Consumer TRNGs are silly.
I agree, OP was simply illustrating how much of this seemingly scary "debt" is really fancy financial maneuvering rather than something with a strong basis in physical reality/resources.

Like when the stock market crashed in 1929 and suddenly (most) everyone lost everything, even though no real disaster had occurred, and all the factories and farms were still in the same condition they were before.
> the cost of properly arranging and organizing vast amounts of information is frequently underestimated.

There are a lot of jobs to be had here. But not in tweets. Think cancer research, molecular biology, taxonomy, behavioral and experimental psychology. The data
> I don't understand, what are lisp/scheme/racket/haskell being used for?

You won't use a language unless other people are using it for the same thing??

> I mean how are those languages good from a software engineering point of view?

Easier and faster to write code that has less bugs and is easier to maintain. It's not like you can't find these things if you bother using Google for 5 mins.

> Is it possible to hear bad things about those languages?

They aren't as popular so there's always people complaining that it'd be too hard to hire those people or there might not be enough libraries to do what you want. Again, Google is you friend here, if you use it.

> Why aren't they used?

Because of, "Nobody ever got fired for choosing IBM". Doing something new = risk, risk is anathema to managers. (1) Also, most programmers first learn a single language and then second learn all the excuses to not use or learn any other language ever.

> Is it because they are too hard to use, or to difficult to approach for a beginner?

They should be significantly easier, but see point (1) above.
Postmark is really nice indeed, even though a bit on the pricey side.

Still, I can recommend their free tool to monitor DMARC:
https://dmarc.postmarkapp.com/
> USSR had "civil law" system, which, unlike "common law" in the US does not depend on the interpretation. "Civil law" is direct and is not up for interpretation by judges.

That's not a accurate at all; language of law always requires interpretation and application to the facts, that doesn't change in a civil law system. Moreover, the different role of the judiciary isn't germane to what GP referenced, which was different approach to executive enforcement practices and priorities.
Ask HN: How to deal with a clique of experienced engineers?
In the startup I work at there are few software engineers who are experienced and have been working together at this company for quite some time. It's usually this group of people who are involved in taking important decisions, work on interesting and more technical problems, and determine what the team should work on. The thing is there are other experienced people in the team, but still those engineers and other less experienced engineers are "left out". As a result these other engineers work on less interesting stuff (operational work, bug fixing, minor features, etc.) and they feel like they are not part of the team as they don't have much effect on the direction the team is going. In the past several months this has led to a few engineers leaving the company. Any advice about how to deal with this sort of situation as an engineer?
When's the last time a kernel CSPRNG in a mainstream operating system had an exploitable vulnerability?

We hear about "good" CSPRNGs going "bad" all the time, but invariably these are instances of people adding new userland CSPRNGs to their systems as rubber chicken security measures that later blow up.
For current tools, I was looking into online Graphviz renderers a few months ago. My take on things:

http://viz-js.com/ - Almost live updating. Quite fast, looks good, has lots of flexibility in output format.

http://www.webgraphviz.com/ - If you don't want any chance of data going to an external server, this can be saved locally and works fine.
His specialty is manufacturing/supply chain. These appear to be design/development issues.
> In the good old days*, the speed of processors was well matched with the speed of memory access...Over the ensuing 35 years, processors have become very much faster, but memory only modestly so: a single Cortex-A53 in a Raspberry Pi 3 can execute an instruction roughly every 0.5ns (nanoseconds), but can take up to 100ns to access main memory.

In real-world terms, what's the fastest processor we could build today whose execution speed is reasonably matched to it's main memory access speed (so it doesn't need caches, etc)?

I could imagine that a processor, with a simple design that closely matches a naive model of how CPUs work, would be very useful for high-security applications. It would be much easier to reason about up-front.
My understanding: bank credit isn't fiat currency. It can be paid back with other credit effectively. But at the end of the day, it's possible, of course, to have absurd debts and credits from banks that will be impossible to ever repay.

If I loan you $1 at 1000% interest daily, then after a short time, you are just going to default on the loan, period. There's no way you'll pay it back. So, yeah… at some point, even if you got another loan to pay the loan and etc etc. the whole house of cards will crash at some point if it's too much credit based on nothing. That house of cards could be just me never getting paid back, oh well. But if I convinced tons of other people to give me products and services that I then had debt for based on the idea that I have this expectation of your payback… then the house of cards could reach through the whole economy eventually.
Look I'm not an expert, but maybe if they stopped adding useless features and they end "The War on Ports" they'd be doing better. Right now their sales are driven by hype (and I guess an iMessage monopoly), not quality or value.
February 31
Not with a USB HWRNG.
People had been waiting on more details of the Intel microcode update, for example from kernel mailing list yesterday mid-day:

https://lkml.org/lkml/2018/1/4/696
In fact, european central bank buys corporate bonds. To the tune of 110bln atm. (Have no link on mobile, but it is easy to google)
A Voracious Starfish Is Destroying the Great Barrier Reef
How do you know if someone likes Rust/is a vegan/does Crossfit?
Similarly, now that cannabis is legal (for both recreational and medical use) in Nevada, companies that already handle large amounts of cash are well placed to take advantage of this. As it turns out, there's already a large industry that deals with large amounts of cash, which means there's a whole ecosystem out there that supports cash.

That industry?

Las Vegas Casinos.
Probably all rng-related vulnerabilities in modern crypto are caused by unnecessary complexity added in order to prevent "running out of entropy" and not by not having enough entropy in the first place.
I'd like to piggyback on this question and ask specifically for a good textbook on distributed systems
No, this is exactly the misconception Hanno is talking about. You don't need a "scalable source" of entropy. Entropy doesn't (practically) deplete. Spool off as many uncorrelated bits as you need for each guest, from your standard kernel RNG, as and when needed.
Do you expect privilege isolation between users and kernel in your virtualized environment? If so, you have to enable PTI. If your virtualized environment just has a single root user, there's no need.
It's both ingenious and slimy if you ask me.
It’s a different medium, and Kubrick didn’t want to spoon feed a resolution to his audience, he wanted them to think. I think Clarke got that in Rendesvous with Rams.
Most of the life-threatening problems we face today both individually and as a species are the result of our science/medicine/engineering.
Yeah, Apple taking so long to update their Macs (for instance) isn't a manufacturing issue, it's their own development issues (all of which were brought on themselves).
i think you could fairly easily encode the layout/constraint solving portion of that as an SMT problem in nonlinear real arithmetic. which dReal should be able to solve https://dreal.github.io/
We've Entered a New Era of Quantum Computing
> Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected.

There is plenty of open-source malware, and most closed source software is not malware.

You seem to be conflating "is in a trusted open source distribution, listed as non-malware" with mere "open source". Code that is openly malicious, or has never been peer-reviewed, is still perfectly capable of being open source.

> I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user.

That's cool but the workstation use case is not why people are freaking out. The workstation is the place where you don't even need this bug to take over and ruin everything, because it's all under one account anyway.

Saying it's a "way to not be affected by these bugs" is pretty myopic.
This is a feature of basically every modern CSPRNG and a basic consequence of the crypto primitives we use to design CSPRNGs.
Actually, thanks to the messy uncoördinated premature disclosure, the MSRs became publicly known yesterday through code comments, commit messages, Google Docs, and linux-kernel mailing list discussions.

* https://news.ycombinator.com/item?id=16072009

* https://lkml.org/lkml/2018/1/4/432

* https://news.ycombinator.com/item?id=16072775

* https://lkml.org/lkml/2018/1/4/615

* https://news.ycombinator.com/item?id=16072806

* https://news.ycombinator.com/item?id=16075082

A more pertinent observation is that this is the sort of technical paper that Intel should have published before the press releases that yielded such a backlash.

* https://news.ycombinator.com/item?id=16076601

* https://medium.com/@frankycaron/this-week-in-words-the-langu... (https://news.ycombinator.com/item?id=16075588)
It's a big mistake for engineers to think that their jobs and the tools they use are significantly harder than in other fields.

Hmmm... ok, I'd agree it's a mistake to simply assume this. But I'm not going to dismiss the possibility, either. Consider this thesis: there is a constant degree of churn in software development that adds significant complexity to the task of software development relative to many other fields.

Is keeping up with javascript framework churn par for the course in other fields? It's very difficult to make that call, since few of us have worked in a wide variety of fields in a meaningful way (I worked in a law firm right after college, but I wouldn't say I can meaningfully comment on the practice of law). But I have a sneaking suspicion that our jobs actually are pretty difficult. We deal with what I feel comfortable calling a hellacious degree of technical complexity at times.
In the good old days, the speed of processors was well matched with the speed of memory access...

In fact on the Beeb, spiritual ancestor of the RPi, memory ran at 4Mhz and the CPU at only 2Mhz...
Do you have a source for that because:

a) The article above doesn't mention it (specifically says 10.13), and

b) There are no updates available for my mac.
Spoken by someone with no experience with things like ISO and SOC2 certification. Go ahead and try to explain to your auditors this year how all your internal controls around privilege escalation and separation of duties are known to be exploitable (and thus rendered useless) due to multiple widely-publicized attacks but it's not important. See how they like your answer.
That is actually a really nice question, essentially it boils down to the same trouble as he described with the taking each coordinate between -1 and 1 and normalizing, in that you get certain preferred directions and not the uniform distribution on the sphere. In your case you get that each of the circles described by your first angle are equally probable. But when you look at a sphere and trace them out, they have different lengths, hence they should have different probabilities. The most extreme case is that the pole (a single direction) has just as high a probability as the entire equator combined.

Just for prudence sake; one way of seeing why the normalization of n independent gaussian draws works. Is that the multivariate normal distribution in n-dimensions with independent coordinates is rotationally symmetric. One can visualize this in 2 dimensions by making a graph of the probability density and seeing it is invariant under rotations of the plane. This generalizes to higher dimensions. This is exactly the property that any direction is equally likely.
Just like nearly all parts of human society.
Apparently, near-100% of politicians and voters believe that "National Debt" is actually something like personal debt and actually can or should be paid off…

https://modernmoneybasics.com/ (simplistic but largely accurate intro)
It isn't funny or witty to point out that an Opel Corsa gets better gas mileage than a 747, even if it is factually correct.

I didn't downvote you (can't even do it), but I suspect you are getting downvoted because your analogy is so off the mark that it can't even be called "Apples vs Oranges".

edit: replying to the "why the downvotes" which has since been edited away
Max, while I appreciate your comment, I think you are the only one who saw it, because it is a showdead post. Do you have any tips to make this more gratifying to one's intellectual curiosity, so that it becomes unflagged?
Data Engineer 3.0 Remote Opportunity
Time of purchase product to time of knowledge of flaw allows for time-frame to file lawsuit(s).

Example. Intel worked on rushed product to compete against AMD threadripper. That time was after the time of the known issue. Thus Intel was investing in continual bad practices and selling known bad products instead of investing in fixing the hardware flaw.

Major flaw in a car prevent selling a card until the flaw is fixed. Why shouldn't this also applying to computers that run the cars and other products?
Yes, modulo the fact that you want to update the CSPRNG with new entropy continuously to re-key it. Not to improve the cryptographic strength of the output or (for God's sake) to avoid "depletion", but to create forward secrecy. For instance: if the interval between reseedings is short enough, because updates are super cheap, you can make your RNG state churn too fast to be a useful target for something like Meltdown.
Oh sure, inflation can happen with gold too, like when we find more gold…
Please do not do this. Here is my reasoning:

You reasonably would want, for your 10k, to work at / learn from a respectable, successful company. But my guess is that 10k for any such company would not represent a huge amount of money, and they'd be unlikely to take you up on your offer.

On the other hand, there will be plenty of less respectable, less successful companies who would bite your hand off. But from your point of view this would not be a good return on investment.

Of course there will be exceptions, but in general I'd be suspicious of any company who would take your 10k. And since 10k is a large amount of money (to me at least!) I'd personally not want to gamble on finding one of the exceptions.

There is other advice in this thread on what to do instead - I'd think more along those lines. Just my 2c.
Home-brewed context managers are new to me: I had only encountered using them in the standard "with open(...) as f:" case. Can someone who has used them before point out a use case for writing your own?
I fight against medium density development in my city because they are assessed by a different standard and my property tax burden is like 10x the developer. The development drives costs for school services and I get to pay.
I don't know how it can help train whatever 'CNN' stands for (i'm guessing not the news network, but something Neural Network?) Yet there are vast sources of various ("pictures") representations of small molecules all over the internet; from line-drawings, 2d stick models[1] to those providing rotation to space filling models[2]. As a very personal aside, neural networks are just a means of doing curve fitting without necessary learning anything.

[1] https://en.wikipedia.org/wiki/Morphine

[2] https://www.cancerquest.org/patients/drug-reference/morphine
I was unaware of the SSDP component of that project, but it seems to require having the Physical Web app installed. Their BTLE beacons work on Android devices without anything special installed on the client. Maybe the SSDP does work on stock android but just takes a bit? This doesn't work if the client has to have a specific app installed to receive it.
Some issues tend to attract a lot of lookie loos. The patch probably won't be improved by a dozen replies about the incompetence of intel.
Swinging back on this, because I find this stuff interesting.

I don't necessarily disagree with anything you say here. But I'm still not sure it gets at the crux of my question.

If local control of land use systematically creates problems for people that don't have the privilege of living in the jurisdiction in question, maybe it's time to put control of land use or certain aspects of land use in the hands of regional counsels of government (much like Metropolitan Planning Organizations plan for transportation needs at a metro-area level, rather than a city level). I think that lets you start solving not only the problem in question in the article, but all sorts of other problems that you address. (Maybe this could work at the State level too, but I think that's too broad. People in San Jose certainly have some interest in San Francisco land use... but do people in Sacramento? Not much.)

But that's very different from leaving land use in the hands of city governments, then overriding them on individual issues when you don't like what they're doing. Right?

I think part of my thinking on this is shaped from living in NC, and watching the insanity that was HB2 (which you likely heard of, if you're up on the news). Basically, Charlotte raises minimum wage and adds some protections for LGBT folks, state legislatures doesn't like it, and so passes a law preventing local governments from being able to set the minimum wage in their area, or grant rights/protections beyond what's granted by the state. The fallout was absolute insanity for, like, a year.

All of that to say - if you want State government overriding local government rights, you have to be prepared for the day when the State legislature is doing something you don't like, and the local government is doing something you do. Right?

In the end, like I said before, I think this policy is good, but I think there's better ways to go about it. Regional counsels of government having more authority over land use seems like a great start to me. Actually, I'd be interested to know if somebody's proposed that.
I think that tends to produce a distribution clustered at the poles. At high latitudes, the impact of the longitude is much smaller than it would be around the equator. Mathworld has a nice write up that visualizes the effect and details more of the reasoning for the Gaussian method.

[0] http://mathworld.wolfram.com/SpherePointPicking.html
Ah, that's good to know ... a comment below mentioned a "BTAC" (branch target access cache).

Is it just used for getting instructions into the L1i cache then?
More than 1,000 pupils penalised for phones in GCSE and A-level exams
Additionally, and I'm not positive that they've actually done this, but the chip also has fully open toolchain. While the guts of the chip aren't open source, it's possible for the firmware to be 100% open source without any binary blobs.
Perhaps I misunderstand but are you implying governments being in perpetual debt is a good thing?
Fury Road felt like you unknowingly did a large amount of very potent crack cocaine.

I needed several minutes to cool down after that movie ended.
Hard to say, we don't know what your calc, diff EQ, LA, probability/stats etc classes were like. You could self study Pugh, Abbott or Spivak. At a bare minimum you can read Lara Alcock/s little red book on analysis. Or you might unfortunately be in the position that you don't quite have the support group, focus or prep for Pugh or Abbott's books.

The other question is, what are you giving up to study real analysis? If you don't have great software engineering skills, along with related skills (linux/network admin, database design/tuning) there's a good argument that you would be better off developing those skills instead.
Your "Consumer" modifier made me curious: what non-consumer situations make TRNGs not silly?
> Don't we already have "true" random number generators embedded on most modern processors? I was under the impression most motherboards have some sensors strictly for this purpose--to read data from static or thermal sensors in order to add entropy to the pool.

Paranoid people might fear that those have been compromised à la Dual_EC_DRBG.
Corporations are just an extra layer of taxes in the individuals who own it.
HempCoin has to be up there for me:

http://hempcoin.org

I submitted this as a slogan but haven't heard back:

HempCoin: Kicking the Can of Converting Cannabis to Spendable Dollars Down the Road Since 2014
Jeeves: A Programming Language for Automatically Enforcing Privacy [pdf] (2012)
(Asking for my own edification) What does the output of branch predictor get used for in a CPU without speculation?
read the internal temp and Vref ADCs over and over, and hash the result, the same way this widget works?
LessChurn
Reduce your churn by helping your users right before they delete their account. Replace your typical "Delete my Account" button by giving your users helpful options.
That may be the mainstream view but he was considered a Russian tool since 2012 when he started working with RT and had known Russian "friends" working with him at WikiLeaks.

I was never a fan of Assange, only the people who took on the personal risk to leak.