skysight-inc/HackerNews huggingface dataset:
I agree, and taking into account objections / observations raised by other commentors, the most practical method is to stop enforcing outdated laws.

BUT, in the last ten years, we have seen same-sex marriage go from "cops looking the other way" to legitimate laws in many states (37) to a SCOTUS ruling which overturned the ban.

http://www.governing.com/gov-data/same-sex-marriage-civil-un...

And thanks to Obama and the State of Colorado, we have evidence - albeit subject to interpretation - instead of Summer of Love / Reefer Madness conjectures.

At the very least, the Congress should consider amending the meaning of Schedule I to distinguish marijuana from heroin -- a phrase similar to "toxic in large doses." IOW, the danger posed by a drug should have weight in its scheduling.

Schedule I - drugs with no currently accepted medical use and a high potential for abuse.

https://www.dea.gov/druginfo/ds.shtml
How the Chan Zuckerberg Science Initiative plans to solve disease by 2100
So let me get this straight.
With Truffle i can get whatever prog lang abd compile it with Graal and either use with Graal VM or Substrate VM.

And i get what ? an executable which includes only what the program needs / uses ?
I should have been more specific. I find it hard to believe many would use Linux software raid (i.e. md) for Postgres in production.
Care to share the URL of the video? It sounds pretty fun.
Some people really are seeing those slowdowns though, it all depends on your workload. If you’re one of the people slowed down by 50%, i imagine the fact that you’re an outlier is cold comfort.
It's a subroutine. It has access to the entire program. There is no security boundary there. If you link against code, it's inside your security boundary. This is not something that can be secured.
I think a lot of people think of inventions but don't have the motivation or resources to execute - and someone else creates the thing, possibly with roots deep in the past. I remember reading a magazine article (maybe in Popular Science) about the Peltier effect when I was in high school and thinking it could/should be used for cooling CPUs. In practically no time, the Power Macintosh 8100/110 came out, using such a cooler. It may not have been the first, but it was the first I was aware of, and it made me irrationally feel like someone stole my idea. A year or two later, my boss at my first job asked me to create, essentially, eBay. I read some academic articles on computerized auctions and gave it up as too complicated.

One thing that made a great impression on me was reading an old Dr. Dobbs journal (I think from the 70s) in which someone was angrily responding to Bill Gates. Gates had said that hobbyists generally steal their software, and of course that pissed people off. The letter writer said if you want to be paid for your software you should bundle it with hardware. So with hindsight, Gates became a billionaire not because he had a unique idea, but because he recognized the value of something lots of people knew and executed it.

Thinking of things is infinitely easier than sifting through all the noise and then committing 100% to making something specific a reality.
I should mention that I didn't want to leak someone's actual password (even if it's 40 years old), so I perturbed the passwords slightly. The real password doesn't exactly end in AKAY, so it's not Alan Kay. (Apologies for throwing cold water on your clever idea.)
I have a question (actually two) for you...

I'm thinking about comp for a company. I'm looking to make it (I think they call it) "remote-first", because there are some fabulous people on planet earth that don't live in the Bay Area. Also, I have no intention of living in the Bay Area, so it's selfish too.

Question 1: IF I had a goal to pay every new employee 10% above market rate - should I peg that to their locale or to the highest rate market (e.g. the Bay Area)

Question 2: SINCE I intend to grow 2x~3x YoY w/ no VC investment, the VCs are not going to pressure me to have a liquidity event at any particular time. That "uncertainty" means that stock-options are a highly speculative bet on the part of of the employee(s). Would you consider 30% of your base to be adequate to make up for the lack of options that would-or-would-not make in any particular time-frame? If not - what would be a nice kicker (for you)?
The Return on Education (ROEd): Salary Trajectory by Degree
It's easy to fix Meltdown with a microcode update. Do we know if Intel (or AMD or ARM for that matter) are also attempting to fix Spectre? Spectre seems much more difficult.
Not sure it's different enough to warrant a new letter, but Spanish O and Scandinavian Å has the same sound so I guess it's all very muddled.
when in tight vehicles (or even lying on a bed/couch), the spacebar is highly inconvenient (and often requires changing your grip of the laptop). I have used pg up and pg dn on laptop keyboards that put them in their proper place (top right by hinge). I agree with parent that touch screen is particularly nice for this (and I also never thought I'd appreciate it)
Yes. The timeline mentioned is the timeline for others, not Google.
thinking about it more a patch that masks out (or sets) the N LSBs of the value returned to user space accesses to rdtsc might do the trick, it wouldn't break anything, and time would still be monotonic

The recent CCC paper on how to write your own microcode (for AMD CPUs) means that AMD owners can actually experiment with a fix of this on their own CPUs ... now if only Intel would let us hack the microcode on our own CPUs too ....
This is a touchy subject. Throwaway for obvious reasons.

Criminalization makes little sense, but the reality is that we’ve legalized weed in an era of refined, highly potent strains with legitimate medical uses. Those medical strains, far too potent for responsible regular use for most people, lead to abuse. Yes, such pot does contribute to wrecking lives.

I’d suggest a more mature future involving a cultural shift towards appreciation of strains with content akin to fine wines, not 100 proof liquor. I’ve personally found low thc content plants produced naturally to be far better for typical toking. It might be worthwhile to research “clean” strains and growth techniques focused on producing a mellow high. I’d suspect such strains would be better overall for most marijuana users.
Thoughts on what is the best reverse image search engine?
If you wake up from deep sleep in the morning your consciousness from yesterday is resumed?

What makes it the same consciousness as the yesterday one, if not all your memories, and past experiences? If my pure consciousness wakes up tomorrow in your body, with all your memories, will it be your consciousness then?
Now i'm looking at ableton live wondering: where's an instrument/vst as simple as that thing? There are endless "instruments" with weird knobs and then there's effects and whatever. Is Live the wrong tool if i just want to create a nice sound and then record something and then put some tracks together?
As far as I understand it, the JavaScript PoC only allows you to read memory from the same process. Meaning if all processes are isolated, you can't read anything other than your own tab's memory. However many browsers don't do process isolation, and just about none of them do it completely (Even Chrome won't have mitigations to this that prevent iframes from other origins doing this attack for a week or 2).

And while that alone might seem pretty innocuous, think of things that are kept in memory for a specific tab. This could make XSS attacks able to grab HTTP-Only cookies, or be able to read some autofill data or potentially password autofill information. I don't know enough about the architecture of those things to know if they are kept in the same process, but if they are it's possible.

That being said, I didn't read any specific reason why that JavaScript PoC couldn't be expanded to work on other processes just like the rest of the Spectre attack. And personally I'm assuming it's only a matter of time before it is figured out.
No it gets you the contents.

The crux is:

array[value_of_kernel_memory_byte] = 1;

So it speculatively indexes into the array by the value stored at that memory address and writes the byte. Then to figure out what the value is you just have to see which element in the array is cached.
We did exactly this and it's been great.
We started with our content editors just using WordPress and on one project we transitioned them to using Kramdown inside WordPress to build a Jekyll site. Once they were familiar with both, the next project we gave them Jekyll and they can enter content and meta info via Forestry.

Forestry has been a big help to us with support and quick turnaround for feature requests and it's been pretty smooth-sailing for our content team.

For internal documentation/knowledge-sharing, we started a MediaWiki.
We actually have various CMSs for content like blog posts and human readable text.

We use the solution in the article for things like the current delivery estimate, which changes twice a year and is a Python timedelta object (example, but more complex than that) or adding new tags to our support ticket system (not user facing). For those, we don’t want or need to spend the overhead of making an editing interface.

As for integrating another CMS, the whole point is that it’s just Python files in the repo, zero effort for developers, very little effort for everyone else, when editing is infrequent.
can confirm. I'm at work.
whats wrong about it? im gonna buy new laptop and it will be intel powered (dont kill me noob at intel cpus)
You don't "think infosec". If I'm an attacker and I notice both amazon and azure rebooting all their systems I know something is up. When I see that both Microsoft and Redhat employees are working overtime it gives away more information. All I have to do is crack on of their patched systems and I can bin diff it and figure out what is up.

Then I sell it off to blackhats before the rest of the world is aware.
Microkernels mean more insulation and standardization.

Yes, it's a form of complexity; just not what tend to relate to problems.
I think there is good reason to be concerned about moving into a future where the wealthy get to live forever (or at least for a very long time) while the poor live short lives of labor.

That really isn't going to happen. For good or for bad.

Either practical immortality will be widely available and low-cost, or it won't. And if it isn't, then robots will be doing the work instead of people. The poor masses will just be killed off, because there won't be a benefit to the wealthy to keep them around.

I'm hoping we will (as a society) address issues of infinite expansion (which doesn't work in the long run), but are able to extend practical immortality and high quality of life to everyone currently alive at the time. But there are a number of obstacles in our path.
This is why it's important to always use a VPN when connecting to an untrusted wifi, such as a coffee shop or airport wifi. Either pay $3 /month to a provider or setup your own with something like pivpn.
Depends on the target audience.

For example, Haiku most probably won't get around to implement KPTI any time soon. But then again, most people consider it more of a fun/hobby OS[0] anyway, so it wouldn't matter that much.

[0] And that isn't meant negatively at all, I actually think the computing landscape would be way more fun again if there were many more projects like it again. Not every OS needs to try and be an everything-OS, and not every OS needs to follow the "always online, everything through the internet" paradigm. If the most interesting use-cases are entirely offline, most of today's popular attack vectors cease to exist.
do it!

the good people need money to keep up!

I just started political donations this year!

Any amount, however small, helps.
If we are talking about C++ then the problem is that there a too many build systems and all of them are incompatible.

CMake is quite popular (and maybe most popular) but it's a complete horror in comparison to other build systems, especially for other languages (like Cargo for Rust).

If you need some specific example: try to add a git-based dependency with a specific branch in CMake.
ICOs in general will see a big correction once the SEC decides to bear down on insider information and compliance amongst the larger investors in these fundraises.

The case, in greater detail, is made here:

https://medium.com/@seiso_matt/investor-liability-for-icos-c...
if you're interested in this check out the coalescent theory, a very elegant mathematical model of population genetics: https://en.wikipedia.org/wiki/Coalescent_theory

The Coalescent, from a book by John Wakeley: http://www.faculty.biol.ttu.edu/olson/Molecular_Ecology_and_...

a good intro to population genetics by Hartl & Clark: https://www.amazon.com/Principles-Population-Genetics-Daniel...
A good report would be what websites/apps are common among the least productive and what websites/apps are common among the most productive.

BTW, I love RescueTime! It has helped me wean myself off of my news addiction, especially during business hours. I wish the trending view would show longer time spans though! Can't they build cubes for different time spans to make the reports go fast over longer timescales?
Woah! If that is true... wait. I see that they've shrunk the square-mile definition of "Manila" proper in this table.

That makes sense. Thank you for the reference.

You know - it's funny. Paris rates above Hong Kong (which does not even appear in the table), and Paris never felt (to me) as dense as HK. Even Manila never felt (to me, subjectively) as dense as HK.
Yes, all of those later i-series processors are based on improvements to the original core cpus.
Hey there. I can see that we're going to disagree about this, but thanks for your reply and acknowledging my point re: disliking Islam not being racist. I see your point about history, but to me religion is separate because it's not an intrinsic value, whereas the others are. Re: the Philipines I think the people should give up conservative Catholicism much like people should give up Islam.

But it's cool, I think we have a pretty clear idea of where the other person stands.

Thanks for the polite response and have a lovely evening.
Read a bit further on. The algorithm has a flaw where some of the first bits from the password are unused. "AAJMAKAY" was a working password that the author's brute force script found, but the "real" password probably had different characters at the beginning.
Like the Mill. Why don't they release the Mill already?

RISC-V is OoO, isn't it?
This happened to me earlier, `heroku restart` fixed it but of course I was assuming some change we deployed was monkeying things up.
People did discover it early on as it's inherent in the design of the chips, it just seemed unlikely at the time. Now Intel has to deal with a huge potential liability if something bad happens because of it. It was just bad business.

Also, appealing to common practice doesn't make logical sense.

Here: https://en.wikipedia.org/wiki/Appeal_to_tradition
“The biggest piece of advice we can pull from all this data is to be aware of the limited time you have each day for meaningful work, and spend it wisely.

Our days are filled with distractions, and it’s up to us to protect what time we have.”

To my mind it represents a failure of imagination to present this conclusion as if it might be an unavoidable reality.

I prefer to take it as a diagnosis of a solvable problem.
I'd like to know what he thinks is the problem. I suspect the issues are more like a wack a mole game, fix here but something else breaks. I'm sure he can get things fix. The real problem is figuring out what to fix.
Why can't the processor isolate those cache lines during speculative execution?
The question in this case is "what is a perfectly identical clone" and what is time.

If the thing works like a computer, that is clone is truly identical, and time is just a counter, then there is nothing to resume the clone won't know that it was cloned, and the whole thing won't be much different from the normal passage of time, (except for seeing yourself killed won't be pleasant).

But if there is something else that you can't clone, like quantum state being impossible to clone perfectly, or a soul, then the clone is not you but that's because the assumption of a `perfectly identical clone` is wrong
And the old Atoms were so slow that few people bothered with them.
This article is a nice reminder that RescueTime keeps all your computer usage history (including site URLs) on their servers and can access it at any time.

But there are Selfspy[0], ManicTime[1] (Windows), and Qbserve[2] (Mac, my app) for private productivity tracking.

[0] https://github.com/selfspy/selfspy

[1] https://www.manictime.com/

[2] https://qotoqot.com/qbserve/
I have an XPS 15 9560 and I _love_ it. Never had coil whine or any of those problems. I did spend a bit of time re-pasting the CPU* when I noticed CPU throttling during gaming. That fixed it.

I put 32GB of ram and (now) Fedora 27 on it. I love everything about it. LOVE!

The comment I get the most is "that screen is incredible" from mac users.

* https://www.ultrabookreview.com/14875-fix-throttling-xps-15/ (PS, unlike a mac this is something you can do. Which is part of the beauty).
To get the gpu dynamic switching working "right" with bumblebee you need to compile a custom kernel with CFG_ACPI_REV_OVERRIDE. See https://xps13.landweg.nl/
I think you completely missed what I said...you are again pointing at numbers that compare averages and I am saying that the averages are irrelevant. If half the people do great and half do terrible, the avergage will look merely ok but the people doing great aren't irrational to want to continue to do great. How is that in any way in conflict with WHO metrics?
Fair point. Currently we don’t encourage this across the whole company for copy changes. We mostly teach this to specific people who need to edit specific data.
They might have been burned out. At the stage before your body prevents you from getting physically to work your work output takes a very serious nose dive.
x86/doc: add PTI description
Not true. It turns out that Speculative evaluation has side-effects, it changes the contents of the cache. This is the big issue. The contents of the cache are then detectable with timing attacks (the Spectre variants, but perhaps more will be discovered). Meltdown combines this flaw with Intel's own "surprising design" of speculative evaluation, which omits security checks and pulls kernel memory into the cache.
This is the greatest thing!

Thanks to the author(s) for doing it.
I would not nothing less.
Apple joins AV1 consortium
From how they measure the productivity score: http://blog.rescuetime.com/breaking-down-the-rescuetime-prod...

"But the bottom line is that the productivity score doesn’t tell you anything about what you actually produce. It’s simply a number that can give you an interesting baseline of where your attention is, but doesn’t tell 100% of the story. It’s a way to understand your patterns, and not a prescription for how you should be spending your time."

So, this is basically an indicator of how much time you spend on an activity and not how "productive" you are. Like they say, productivity is a charged word. I wish there was a way to tag productivity and efficiency together.
If Monday and Friday were days off, would Tuesday and Thursday become the new Monday and Friday?
I'd be surprised if Meltdown was worth less than $2B. And I wouldn't be surprised if it was worth over $100B.

Of course that is raw value, however in practice it would be EXTREMELY hard to launder such a large amount of money into and out of an online transaction.

The question then becomes, what kind of person is the hacker? Are they in a position where they can wait and find a good deal or would they rather wash their hands of it over $100M or so?
It's nice if you have a high resolution, large screen. But smaller screens with less resolution, 16:9 is not very usable.

Typically, a 16:9 screen doesn't have nearly as many vertical pixels as a 3:2 screen. Sure, a 27" screen fixes that (1440 pixels), but that just masks the problem.
The hardware is lovely but the available configurations make me sad. For compiling the projects I work on, I need an i7 and 16 GB of memory. But this configuration only comes with the touchscreen, which is not only useless but destroys battery life, has a far inferior viewing angle, and adds an obscene amount to the cost. Amusingly, the config that I want is available, but not to me, because I'm not in Europe. I would buy this in a heartbeat otherwise.
Also, alcoholics should try to moderate their consumption.
Also, appealing to common practice doesn't make logical sense.

It is hazardous to apply logical arguments blindly in illogical contexts, such as competitive markets.

Again: mitigating all possible bugs isn't free. Exactly how much effort and expense is worthwhile, and how do you know beforehand?
Could you elaborate on why you prefer pip as a package manager?
This list linked at the bottom is pretty insightful for Google products & relevant mitigations:

> You can learn more about mitigations that have been applied to Google’s infrastructure, products, and services here[1].

Confirms the `chrome://flags/#enable-site-per-process` flag is useful here & sure enough, the 2018-01-05 SPL was waiting for me on my Pixel when I looked.

1. https://support.google.com/faqs/answer/7622138
This comment only makes sense if you accept the premise that the working well with big data is more valuable than a secure experience.
My macbook's usb-c charger constantly loses connection, a slight tug and it falls out.
Besides that one forum post yesterday from someone whose m1.medium instance slowed down, what other cases do we know of? If it's just a single person who has observed a slowdown, I'd say this worked out quite well overall.
I would check out https://github.com/davidkpiano/xstate
It's the one I've been most tempted to try. Ryan Florence has a good video of it somewhere.

I haven't used explicit state machines in the past but there are a few apps that would have greatly benefited. I ended up using Redux reducers as a sort of pseudo state machine.
2017 was the best year ever for electric vehicle sales in the US
> "Do we really want to set a precedent where the state government comes in and overrides local regulations about things like zoning which are usually purely the responsibility of the local governments?"

Yes, yes we do. Local control of land use is the reason we are in this mess. Local control of land use is the reason why our neighborhoods are still de facto segregated by race even though de jure segregation ended 50 years ago. Local control constricts the policy influencers to a circle that is too small, because it exlcudes from the discourse people who: 1) work in the locale in question, but cannot afford to live there, 2) people who commute through the locale in question, 3) people who live in a community that is not in the locale, but is impacted by the locale's land use decisions (ex: brisbane building 8m square feet of office and expecting SF to build housing for the workers).
Did Intel promise in their docs that side channel attacks are not possible? If not, then OS writers are equally to blame for making incorrect assumptions. I don't think this is Intel's fault alone.

On a grander note, there are probably hundreds of even more esoteric side channel attacks all across the system since every process changes the system state. This is more like the beginning of a new style of attacks now that one is shown to be practical, rather than any particular entity's fault. Hardware designers will need to consider informational and physical isolation in a more rigorous way, and there may be theoretical limits that bound the performance-security tradeoff when you share resources.
I was kind of hoping for a Ryzen version...