skysight-inc/HackerNews huggingface dataset:
Well, I agree with you about the one-way transmission. My point about listening is that I expect that a lot of their technical capability is initially developed through individual/team interest and not top-down direction so in the interest of advancing the organization's operational capabilities management should support two-way communication.
Totally anecdotal, but I'm a 17 year old in the Bay Area, and teens are partying more than they were when my older siblings (early and late 20's) grew up in the same area.

My point is that my experience isn't true for all, and I can't prove that it isn't true for the majority. This article is the same way - not enough statistical evidence to support it.

Like yes, teens get together with friends less often on a day-to-day basis. But what teens party on a day to day basis?
Nice work, and thanks for sharing! I think your repo serves as a great example of how simple a Chrome extension can be, so it has value as reference material.
Electricity was deregulated almost everywhere around the same time (not just in the U.S. but in Europe too), and situations like Enron were the exception. By contrast, decaying public infrastructure is the rule. The NYC subway (and Amtrak and Metro North) runs slower in many cases today than a century ago, because of deteriorating track, bridges, etc. See: http://www.slate.com/articles/life/transport/2009/05/stop_th.... There is a multi-hundred billion backlog in maintenance and upgrades of water and sewer pipes. Roads and bridges are crumbling.

When the public owns the infrastructure, there is enormous political pressure to price service too cheaply, which can work in the short term but has led to the infrastructure disaster we're seeing in the U.S. now: https://www.infrastructurereportcard.org.
BA DUM TSCHH!!!
Reading the Twitter responses PCID was introduced with Westmere and INVPCID with Haswell.
The register has the tweet with actual code for spectre, and more details from the manufacturers and potential fixes. Seriosuly? They're both worth a read.
Apple sold iPhones at the rate of three per second when the first iPhone launched on time, on June 29th 2007, having been announced to launch on that date in January of 2007. I guess it's possible that they "struggled" to do so, but Apple launched the iPhone on time and in the quantities promised.
Geely is also Volvo´s parent company.

https://en.wikipedia.org/wiki/Geely
If you can't be successful as a rapacious money changer then you don't deserve to be in business. The real question is why the leadership of a massively profitable business is unwilling to just do their job and run an independent company.
Isn't possible for the kernel to patch all clflush instructions when the software is loaded to keep a circular list of all evicted addresses that would be evicted again on the interrupt that happens when the protected address is read? This way the the timing attack would not be possible.
Wow so intel comes and says what is all the panic about there is nothing wrong (despite knowing this) and then amazon drops the we are updating everything right now bomb and then google drops the mother of all cpu bugs. In a previous thread someone was asking if it really is all that bad and at this point I think it’s safe to say that yea, it is.
Announcing Diesel 1.0 – A Safe, Extensible Query Builder and ORM
Only on Intel. Others restrict prefetches on permissions.

I think this might even be fixed by microcode patches on Intel, at least os specific, looking at the first address bit.
Cool. Since when?

Honestly, this has been kind of a bummer for me when I've thought about trying mobile development.
Same here, though that is conditional on a friendly environment for financing to reach the longer term.

And it also assumes that skill in the (relatively) low volume production of rockets can be transferred to mass production of cars.
Tesla's bet with Model 3 has no room for long term if it fails.

If Model 3 is not a success money runs out. There will be large changes in the ownership. Musk might sell Tesla to some other manufacturer etc.
Since we're being semantic about things, lets be clear that when someone says it's all "semantics" they mean that the person is engaging in a semantic dispute. This is a type of argument that has a specific meaning-

> A semantic dispute is a disagreement that arises if the parties involved disagree about the definition of a word or phrase, not because they disagree on material facts, but rather because they disagree on the definitions of a word (or several words) essential to formulating the claim at issue.

When someone is "arguing semantics" they are often trying to obfuscate the original issue being discussed.

In this specific case the argument is being made that Intel is trying to use a different meaning for the word "bug" that favors them. redcalx is then stating the general definition of "bug" in an attempt to point out how limiting and nonstandard their definition is.
Mind if I ask how old you are? What are your thoughts on the merits of this philosophy? I'm genuinely curious.
From the article it seems that is not 100% sure AMD and ARM are not affected by metldown, only that they could not trigger the issue, but authors mention this

"However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed."
I think the chip designers never thought of security much:

https://news.ycombinator.com/item?id=16062223

It's a similar situation to other timing attacks, which have been around practically as long as caches.
Might, maybe etc lots of unknowns where each mistake is costly and can threaten to bring down the project.

We have no idea so actually establishing a base on the moon isn't yet cheap enough that we can do it for the hell of it and we don't learn enough we aren't already learning with the space station.

Let's solve getting people and material cheap into space, lets solve better AI, lets have some optimal automated building processes on earth then we can talk about moving people and material up on a base on the moon just for the fun of it.
It's clear from your comment history that you have some idea of what science is about, so I don't know why you are asking this question.

In popular use, the phrase "That's what <X> is about" often refers to the emotional enjoyment of doing X or being involved with X:

For example, I did a search for "that's what basketball is about":

"He has so much emotion and swagger and confidence. He's talking and there's emotion. I love him for that. That's special. That's what basketball is about. That's what big moments are about." - http://www.news-gazette.com/sports/illini-sports/mens-basket...

“She loves LeBron. She’s been a big LeBron fan for a long time. Everywhere he went, she’s just a big fan. I don’t even think she really watches basketball,” he said with a laugh. “That’s what basketball is about, attaching yourself to players.” - https://www.washingtonpost.com/news/early-lead/wp/2017/06/14...

“I like to mix it up,” Mills said. “I block out and shoot jump hooks. That’s what basketball is about for me.” - http://www.courierpress.com/story/sports/high-school/2017/01...

“That means we have everybody going out there and playing hard, playing together, sharing the ball. If a guy is open, he makes a shot. If a guy is not open, he passes to another guy and he makes the shot. To me, that’s what basketball is about. It’s not about a franchise player. - http://www.slamonline.com/nba/lionel-hollins-on-deron-willia...

It is not meant as a literal description of what the topic is about.
Reminds me of ExcelNet (deep learning with Excel):

http://www.deepexcel.net/
The ARM whitepaper is also worth a read in terms of how it affects them and mitigations on that platform: https://developer.arm.com/support/security-update
My keyboard auto correct automatically adds periods at the end of sentences. My keyboard makes me seem angry all the time I guess.
I know they've gotten really desperate on the licensing front too, sending out license verification/enforcement ninja squads to customers - acting like Oracle or worse.
The problem is a reliable electric motor in notoriously unreliable German cars.
Apple had years of experience manufacturing high quality consumer electronics at large scale with the iPod, years of experience managing power consumption on the OS level with Mac OS X, and decades of experience in user experience design and industrial design. At the peak of iPod sales, Apple managed to corner the market on NAND flash memory, to the point where they preordered entire years of production. And the iPhone was the biggest leap in user experience for a portable device ever.
Database of Lost Crypto Assets
This is a really good point. There isn’t really a “free” backbone that connnects all these separate networks. There are private backbones who could filter at their interfaces if they chose to.
The question becomes: does Apple need to compensate customers? If Ford sold a car with a certain amount of torque advertised, and then an ECU patch (due to emission problems) slashed that torque by 30%, you bet they’d have to compensate either monetarily or with a buyback. MacBooks go for as much as secondhand cars too.
But on the other hand a user who is already interested in overriding the styling for one site is a likely candidate for wanting to install more.

Furthermore, having one extension to trust for security's sake is much nicer than having one for each and every site you want to custom theme. Especially since the general theme is going to want to build up a library of themes and requires user trust to do so, phoning home secret information would eventually destroy that trust. But an extension that only themes Google.com is a more likely candidate for harvesting credentials, for instance.

Creating an extension is also a browser specific process. If there's one browser extension for all sites backed by a repository of plain CSS themes, then users on multiple browsers can benefit from theming with minimal porting effort on the part of the theme author.
Not against Spectre, which can extract any memory via javascript or user applications. Eg your secret keys or passwords
> Looks like a blacklist extension to their ad blocker

In the blog post comments section they say they're using this block list:

https://github.com/hoshsadiq/adblock-nocoin-list

The list is compatible with other blockers like uBlock Origin and Adblock Plus so you can add it to your blocker if you want to.

By default uBlock Origin already includes a Resource Abuse block list which has many of the same entries as this list. I'm not sure how much the two lists overlap, but if uBlock Origin's Resource Abuse list already has all of the entries from this list then obviously there's no gain in adding it.
With Apple's tax, a developer needs to sell that much a year to break even on the membership fee.
XVG (Verge) Discord Channel for those who trust and hold XVG
That sounds pretty damning. Do you have any sources to share?
I'm getting a 404 from that URL now.
Recommended reading on this? Asking for a friend. (EJC, not the hookers.)
Can you expand on the algorithm trading system you developed? How did you go from zero to that?
Incredible that in this day and age that chip designers do not prioritize performance over security.
A Simple Explanation of the Difference Between Meltdown and Spectre
After skimming the articles it sounds like a lot hinges on just how hard Spectre is to pull off in practice/in the wild. Anyone have any insights on that?
> Lamar, who worked at Google for four years before quitting in 2017, alleged that the technology company employed roughly 147 women and three men as pre-school teachers

Sounds like affirmative action is drastically needed. Hire some men to increase diversity in the workforce. It's especially important to ensure men are equally represented in the more senior roles at level 2 and above...right?
> Depending on how you parse the 2nd amendment's text you can reach different conclusions. That one comma could make a world of difference (historical details about gun ownership notwithstanding).

And herein lies the crux. We are staking up to 30k lives a year on a comma. Also, historical context is important in that when the second amendment was written, a group of people with muskets could take on a government force. That's not the case anymore. Police now drive tanks and come at you wearing body armor. I agree that if there was a full scale uprising, with say all the liberals arming themselves to the teeth and going up against Trump's administration in a rebellion, the police and military might be at best divided on the issue. But still, there is no well regulated militia that currently exists.

So my point is that why not re-write the damn thing, taking into account modern tech and modern way of life? The second amendment is held as nearly holy by some, but at one point it was just written down on paper by a few people. It's not exactly a stellar piece of legislature that is above all scrutiny and reproach.
One of your products / prototypes must really take off to put your lab into a different light (and league) imho. What kind of digital product were you thinking of? A Youtube channel is more than enough and the most direct way these days but you still need a clear hook aka hit to emerge from the unknown maybe?
I think the point is that your quoted section of the reg article is not correct according to the new information from Google.
I've thrown the C code in the Spectre paper up if anyone wants to feel the magic: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9...
(Ex)-Googlers, do you know if the daycare center employees are contractors or are hired directly by Google?
The spectre attack is exploitable via javascript and there's no software patch that can fix it. IoW, it is not possible to safely run untrusted code in the same computer that has sentitive information.
Interesting to hear someone having problems welding steel instead of aluminum. Generally Al welding is much more difficult than steel.
That's what I thought but wouldn't that be $165?
Come on, Google completely "forgets" to mention the others, whilst the others do mention Google who detected it independently. And then look who wrote the papers, exploits and patches.
> Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh.

Here's the synchronized announcement from Chrome/Chromium: https://sites.google.com/a/chromium.org/dev/Home/chromium-se...

"Chrome's JavaScript engine, V8, will include mitigations starting with Chrome 64, which will be released on or around January 23rd 2018. Future Chrome releases will include additional mitigations and hardening measures which will further reduce the impact of this class of attack. The mitigations may incur a performance penalty."

Chrome 64 will be hitting stable this month, which means that it ought to be possible to benchmark the performance penalty via testing in Chrome beta. Anybody tried yet?
I'm not dismissing that, I'm just stating that we were literally here 5 days ago talking about another alternative. One that already has an entire team backing it and keeping security in mind. There are probably 10s to 100s of different android builds with and without google. There are definitely a few that will outshine others: Cyanogen, Oxygen, Lineage, AOKP, TWRP to name a few that stick out in my mind. It's just funny that not even 5 days later we're back again with another android fork that google-less.
No, they ignored a law the government made generally without stating penalties. Now the govt was forced to spell out penalties.
The $1,000/day figure comes directly from the NYT article quoting the head of construction at the MTA. This is the paragraph after the one I quoted previously:

Nobody knew what those people were doing, if they were doing anything,” said Michael Horodniceanu, who was then the head of construction at the Metropolitan Transportation Authority, which runs transit in New York. The workers were laid off, Mr. Horodniceanu said, but no one figured out how long they had been employed. “All we knew is they were each being paid about $1,000 every day.
I know it was scheduled but the information on the links are public and prior to the scheduled disclosure. A hacker could figure out the problem by reading the available information before the Google Project Zero.
> This is attributing emotion to things that have none

Ummm, fair enough. But then you say...

> My genes want to beat your genes

Your genes don't want anything. They have no desires. No emotions. They're just molecules. Long, complex polymers, granted, but just molecules, nonetheless.
The yearly fee also includes 2 developer tech support incidents where Apple developers can help debug a serious problem in your code that prevents your app from shipping.
And now you know.
>Disassociation

Interesting. Do you mean like depersonalization and/or derealization?
OK. And with that you are saying that you are basing this on 95% speculation and 5% pattern recognition with no direct evidence, and yet it's the most likely outcome.

And I am saying that the confidence interval on that calculation is just orders of magnitude not tight enough. I am not denying that you could be right. It's just that I am giving that possibility something like a 1% chance of being true, while something like 85% chance of this being pure incompetence by Intel management and engineers (the rest being some other explanation that's neither malice nor direct incompetence). I don't think you and I can find a common ground on this estimation.

Again though, ME is a bad thing because it's not open source, it can't be turned of, and it's buggy. Regardless of who ordered its creation, it sucks.
From the Spectre paper-

We have empirically verified the vulnerability of several Intel processors to Spectre attacks, including Ivy Bridge, aswell and Skylake based processors. We have also verified the attack’s applicability to AMD Ryzen CPUs. Finally, we have also successfully mounted Spectre attacks on several Samsung and Qualcomm processors (which use an ARM architecture) found in popular mobile phones.

So in other word, the researcher haven't tried it on AMD processors, but they think the attack would work. AMD, on the other hand, is saying the attack won't work.

Frankly, I believe in PoC||GTFO, so AMD is safe in my book for now.
Bolt and Model S occupy two very different areas of the car market.

The base trim Model 3 and the Bolt are competitors.
http://www.Bitcointalk.org for the huff & puff + http://www.coinmarketcap.com for the money talk + http://www.icodrops.com for entering at the penny stage
Very entertaining and well delivered talk; it not only does what the title says, but also explains some of the math and magic behind making HDR images.
I'm not sure I see how to use the Spectre attack on AMD without running in kernel context. What am I missing?
This is a very interesting way to look at it. The question is how to make “average Joe” understand that logic.
I loved being my room playing legos it reading novels or the encyclopedia. I suppose there are lots of different types of people, but I liked being alone even when there weren’t screens.
Thanks for the link, this will prove useful given the amount of Arxiv links on HN.

Doesn't appear to work with this paper, though.
Canaries in Practice
this is my favorite observation :)
Hmm

Yes perfect
I'll look into it, thanks for the info!
Thanks for the heads up, I didn't know that.
Re-implement popular framework sample apps in vanilla JavaScript
> Twitter being forced to delete

It is not at all though. The law very clearly spells out that for unclear cases (and the satire tweet definitely falls under that) there are significant exceptions and leeway.
As I read through the meltdown paper, it looks really difficult to have the security we want and the performance we want at the same time. It's pretty crazy, but here's my limited understanding:

There's a huge shared buffer between two threads. 256 * 4K. One thread reads a byte of kernel memory, literally any byte it wants, and it then reads one of those 4K pages from that buffer in order to cache that one memory page that corresponds to the byte it just read. Then at some point the CPU determines that the thread shouldn't be permitted to access the kernel memory location, and rolls back all of that speculative execution, but the cached memory page isn't affected by the rollback.

The other thread iterates through those 256 pages, timing how long it takes to read from each page, and the one page that Thread A accessed will have a different (shorter?) timing because it's cached already. It now understands one byte of kernel memory that it shouldn't. That's just one byte but the whole process is so fast that it's easy to just go nuts on the whole kernel address space.

So what would the fixes be? Disable speculative execution? Only do it if the target memory location is within userspace, or within the same space as the executing address? Plug all of the sideband information leak mechanisms? I dunno.
250 views and no comments? I am happy to answer any questions you may have. -SP
I use zsh and there is an easy way to find your golang projects using cdpath:

# setup easy access to cd paths

setopt auto_cd
cdpath=($HOME/code/go/src/github.com \
$HOME/code/go/src/github.com/collinvandyck \
$HOME/code \
$HOME/code/go/src)
Someone correct me if I understood this wrong. The way they are exploiting speculative execution is to load values from memory regions which they don't have permission to a cache line, and when the speculation is found to be false, the processor does not undo the write to the cache line?

The question is, how is the speculative write going to the cache in the first place? Only retired instructions should be able to modify cache lines AFAIK. What am I missing?

Edit: Figured it out. The speculatively accessed memory value is used to compute the address of a load from a memory location which the attacker has access to. Once the mis-speculation is detected, the attacker will time accesses to the memory which was speculatively loaded and figure out what the secret key is. Brilliant!
In this case they're not the first. They're using this block list:

https://github.com/hoshsadiq/adblock-nocoin-list

Which was already being used by Brave. You can add the same list to your browser's blocker yourself.

If you're using uBlock Origin be aware that by default it includes a Resource Abuse block list which contains many of the same entries as the NoCoin list, so there may be no real advantage in adding the NoCoin list. You'd have to check all the entries in both lists to see if you're gaining anything by it.
They don’t always lose though. And winning a legislative victory banning muni competition seals their revenue stream for years.
Thanks so much! I'm planning to clean up the repo later tonight so it's better organized.
You're right, of course. Tesla has made electric cars sexy to people with money, the same way the Prius made hybrids sexy (okay, maybe 'popular' is a better word in this particular example) to the layperson.

Electric cars have mindshare now. But unless Tesla can do something Toyota can't for the mass market, another automaker will likely, eventually, eat their lunch. There's no reason Toyota can't bolt on some sexy electronics; the charging network can be accomplished ... somehow, some other way. That doesn't mean Tesla goes away but it means there's a finite market of people willing to pay the premium for a Tesla the same way there's a finite market for people who want the intangibles of (say) a BMW. Unless we presume that Tesla can get their efficiency and margins Toyota-low, which.. again, they can't simply bolt on.

I suppose it's still possibly Tesla can leverage their battery and charging infrastructure to their advantage for long enough to hold off the competition though. Or at least enough to make themselves an acquisition target, but of course, their value needs to be something affordable.