skysight-inc/HackerNews huggingface dataset:
It seems that the nudge from each individual can either contribute to the resonance or detract (constructive vs destructive interference).

There are many ways this can unfold. For example, groups of people with similar values, mindsets, or skills can much more easily manifest significant constructive interference.

As you note, the speed/frequency of the wave seems much faster now with our new communication technologies. These changes, along with the increased scale of human population, introduce new patterns for both constructive and destructive interference that we need to understand and handle.

Of course, if we try to solidify the metaphor further... this wave is likely to have enormous dimensionality and be composed of components that would absurdly difficult to even begin measuring. But it's a great metaphor and certainly got me thinking.
I had a friend who believed the moon landings were fake because of the Earth rise. He rightfully explained it could not happen. I told him the Earth rise happened while they were in orbit (or sub-orbit, whatever), and so he looked it up, realized he was wrong, and gave up on the idea that the moon landings were fake just like that. He had mistakenly believed the Earth rise footage was taken from the surface of the moon. It's always nice to see someone willing to change their mind in the face of new evidence.
Yet in 2017 we only have application level permissions widespread on mobile OSs, and we still bother the user to click "Yes" or run through a sudo prompt to do trivial OS configuration tasks.

Not to mention that this entire discussion takes place in the context of a MacOS "feature" that literally makes it impossible for the user to change the OS configuration.
This comment and others showing similar concern about the recent appointment of the leader of the rust community team were removed from internals.rust-lang.org and the rust subreddit:

https://i.imgur.com/g3cVtxm.png

https://internals.rust-lang.org/t/6453/12

https://www.reddit.com/r/rust/comments/7nx3cm/

For reference, this is the same person (https://www.reddit.com/r/node/comments/6whs2e/).

Apologies for posting in this thread, but it seems unhealthy to not be able to question community leaders and other discussion has been stifled. Do rust developers have any comments on this?
I've always enjoyed the thought that there are multiple universes, and there are two opposing forces at play. Chaos causes the universes to drift over time. Another stabilizing force tends to bring them back together in the most efficient way possible. This stabilizing force is felt by us as experiences of fate, or a sense (or lack) of belonging. It's not that there's a preordained destiny, but a consensus among universes that you are either in or out of.
VIA's CPUs were from their purchase of Centaur Technology, not fro Cyrix, right? (IIRC there is a HNer that worked at Centuar for a while, perhaps they can expand).
You are right, sorry for that, but this would really long comment.

We could point out socialist/communist countries, they are/were not better off trying to implant cosmic justice, they ended up worse.

The difference now seems to be that rich countries can afford it, which is weird, since they can afford by using a capitalist system to begin with.
Congrats on the launch Jeremy! This is a feature I've been wanting for ages. I subscribed.

- Michael from fman
People started figuring out some details about the vulnerability from various public sources (Linux kernel development, previously published security research), and it was getting a lot of media/internet attention.

The Google blog post from yesterday (https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...) says:

> We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation.
Inching to Parking Sanity
I make 290k total comp as a SWE III at Google.

I would make around 240k if my initial stock grants hadn’t nearly doubled in value since I joined. I will probably actually make less money once my 4 year grant runs out, all things being equal.

5 years total experience.
See how quickly life appeared once the earth had cooled down?

https://en.wikipedia.org/wiki/Panspermia

I find this a compelling possibility.
I would agree, most data scientists are not required to deploy their own models, probably only for those in startups or small companies. I also introduce how Docker can be used for development. I think it is a big enough trend in CS that any data scientist should know some basics, similar to data science from the command line.
That is provably false--plenty of non-aristocratic farm families had lots of kids. This is hokum of the worst order, also, there's no way people of other ethnicities have any relationship to European nobility.
Cool! I had never heard of that. Starred...
That's what I use. The issue is in some builds of emacs on different OS' it cannot hit the HTTPS servers themselves for whatever reason.
The conversion dex2oat that is performed when an application is installed on an Android device generates machine code that’s very specific to its CPU. High level optimization is performed in previous passes. AFAIK this approach is successful.
I have a 2017 Thinkpad X1 Carbon running arch--I can't seem to change my trackpoint sensitivity, but that's about the only issue I've had.
I think its well worth the investment IF you already have worked with and understand Node/Mongo/Express/React.

Meteor for me atleast increased my productivity by large magnitude. The framework itself is a much different beast than what it was several years ago and it continues to grow. I've built several large scale products with the framework and its an absolute pleasure working with it. Getting ramped up is straight forward and offers a lot of shortcuts you normally wouldn't have right off the bat.

With all great things however there are downsides. Scaling can be tricky if you dont understand the internals of the framework. The atmosphere package ecosystem isn't as strong as it use to be.
Sonar | San Francisco, CA | Full-Time, Onsite | https://www.sendsonar.com

Sonar is a SaaS platform that companies use to mobile message (think SMS + FB Messenger) their customers. When companies communicate on the channels their customers prefer (especially while on the go), they get happier customers who engage more with them!

To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/sonar

Here are our open roles:

- Senior Software Engineer: https://angel.co/sonar-5/jobs/135488-senior-software-enginee...

Tech Stack: RoR, ReactJS, Redux, Heroku/AWS, Rspec, Redis, Sidekiq
Sorting Real Numbers in O(n √log N) Time and Linear Space
Hey, just FYI - on both Firefox/Chrome with uBlock the main content is hidden, because of ##.newsletter-subscribe (part of Fanboy’s Annoyance List, not enabled by default, but still)
Even better would be if I just left this hellhole I think. The only difference between this place and the cesspool of reddit seems to be that people here think they're better than redditors while behaving exactly the same way.
Do you not use Chrome because IE6 was insecure? This attitude doesn't seem like it leads anywhere other than not using computers.
Yet another case where running an Anti-Virus makes your system less secure.
https://github.com/Raab70/Raab70.github.io/commit/d69addbf12...
I second this. Forget fancy bells and whistles, this website is missing some very core and useful functionalities that aren't so hard to implement.
Or, as a compromise, no third-party javascript. Google can easily code up the 100 most common javascript ad formats and let advertisers pick from a menu.
I was about to correct you when you edited your own comment !! :)
Thank you for this very detailed reply. Re: Meltdown - It would still take quite some effort to craft a series of events that would result in significant access to say, a banking or government system (the crux being the code execution)?
Doubtful. The privacy policy clearly states they may give info to LEO's.
They are generally welcome to do so in almost all states.

It's also pretty much not deceptive by law (happy to point you at the law of deceptive practices if you like).

The most likely outcome is a loss by Washington.
If the state wins, the most likely outcome is congress will immunize corporations from suit in these situations, which imho, would be worse than losing the lawsuit (and probably done in a way with significant collateral damage to consumer protection)
They don't explicitly say. Is part of this a microcode update?
I think they are jumping on the bandwagon. The trend already started with bitcoin.
Gotcha, thanks! That makes more sense now.

I agree that they're worth examining separately, but the more general point still stands that there is a lot more that can go wrong with sign than with aead. The arguments for broken RSA-encrypted cookies apply similarly to broken signed cookies. It's not clear to me for example that an invalid curve attack against seal is intrinsically worse than a nonce (ab|re)use bug against ECDSA.
Wouldn't adhering to the privacy policy potentially make them guilty of conspiracy (in harboring people in the U.S. illegally), in cases where they suspected it was happening?

(I'm a bit sketchy regarding what aspects of being in the U.S. without a valid visa are considered violations of criminal law, and if/when that distinction even matters.)
Might be the time to move on? Sometimes waiting pays off, but not if it takes long time and makes you so unhappy.
You, and ideally everyone else commenting on this stuff on HN, should just have a very quick read of Turing's original paper before criticizing. It is very well thought-out:

Alan Turing, 1950:
"The game may perhaps be criticised on the ground that the odds are weighted too heavily against the machine. If the man were to try and pretend to be the machine he would clearly make a very poor showing. He would be given away at once by slowness and inaccuracy in arithmetic. May not machines carry out something which ought to be described as thinking but which is very different from what a man does? This objection is a very strong one, but at least we can say that if, nevertheless, a machine can be constructed to play the imitation game satisfactorily, we need not be troubled by this objection."

The Turing test is a proposed test of sufficiency for thinking; not a test of necessity; its really framed pretty well in his original paper.
> ... or a washing machine at most.

The Orion project was designed for sending a city-sized space ship to Alpha Centaury in ~100 years.

The hard part seems to be how to build a city-sized ship, not how to move it.
"That man that hath a tongue, I say is no man,

If with his tongue he cannot win a woman."
Too bad arbitrary real numbers cannot be represented in finite memory.
If it is, that'll change in 2 weeks when the difficulty factors in that everybody moved to preemptible GPU deals.
> So you can do a code review on the entire Linux codebase and you are skilled enough to find any security vulnerability?

My odds there are much better than they are trying to do a similar audit on MacOS.

> Can the person you hire do it?

There are people out there who are extraordinarily skilled at this sort of thing. Security flaws in, say, iOS are found regularly. That's how jailbreaks work. (And, BTW, the fact that Apple doesn't give me the option of opening up the jail on my own phone means that if I want this freedom I have no choice but to run some black-box binary from some unknown Chinese hackers. That is by far the biggest security risk I face when using Apple products and it is a direct result of their policies.)

> Would they have found the Heartbleed issue that was in open source code for at least two years?

They did find it, and I didn't even have to pay them. If I had paid someone to look, they might have found it sooner.

No system will ever be perfect. But I like my odds on Linux much better than on Apple.
> including personal computers and servers — that render those systems immune from both exploits (referred to as “Spectre” and “Meltdown”) reported by Google Project Zero.

I thought you couldn't patch out Spectre
DMVs are privately-owned franchise in a lot of states.

It pays about the same as a retail job ($12/hr & 30hr/wk starting in my state) but you get to deal with infinitely worse clientele -- that never follow simple directions, thus need to come back three times, more pissed each time. There's rarely any downtime, as the lines are 30+ people long and every terminal is full.

Additionally, due to bad pay, they have high turnover. And because the state is cheap, no sane person would open an new franchise because they don't make money unless the line is packed out the door.
>> Curing someone's blindness, or cancer, or HIV, won't pay one's bills
(unless the patient fronts you the $850k, that is).

Of course, people need to pay their bills. And I need to get the life-saving
drug that's too expensive for me to buy. So, if it's OK for you to price that
life-saving drug so high that I can't afford it, because you have bills to
pay, then it's certainly OK for me to steal it from you, because I have a life
to live.

If you don't help me to stay alive (or to cure my blindness etc), why should I
help you pay your bills?
"So my plain reading of their terms would suggest that data should only be shared "during the discovery process in litigation [or] pursuant to a court order""

Uh?
"We may disclose Guest Information to law enforcement agencies, or may be required to disclose it during the discovery process in litigation ..."

A court is going to say these are two different sentences talking about two different things. One where they voluntarily may do it whenever they want, and one where they may be required to do it anyway by court order.
Always with the taking of private property! There is no level of confiscation which can fix the problems that a functioning market could address if allowed to do so. If you need denser housing, might I suggest paying the owners for their property? Is that such an outmoded concept? Forcing people off their land is just so...Chinese.
Also the compiler had to be absolutely brilliant to rewrite the serial branching code most programmers wrote to work with the EPIC model. They had some good results optimized math-heavy code but the general purpose code ended up with too many nops waiting on results.
I've found one of the best ways to experiment with other text editors is to use them for one specific type of task or type of file. So when I started using vim I only used it edit config files. Makes it easier to lock into the mental mode of using a particular editor.
Why not when they know you'll pay it? You can make whatever ethical plea you like but not much will change the fact that entry into the Apple ecosystem is apparently so valuable that people will shell out a hundred bucks without thinking about it.

Hell people shell out $1000+ for a Mac for the sole purpose of developing iOS apps. If anything Apple is probably under-pricing this 'service'.
Keep up the side work and hope something works! Best of luck.
This mitigates spectre variant #2, branch target injection. We also have a mitigation for meltdown, namely KPTI. Is there a known mitigation for spectre variant #1, bounds check bypass?

Maybe I'm being naive, but would a simple modulo instruction work? Consider the example code from https://googleprojectzero.blogspot.com/2018/01/reading-privi...:

unsigned long untrusted_offset_from_caller = ...;
if (untrusted_offset_from_caller < arr1->length) {
unsigned char value = arr1->data[untrusted_offset_from_caller];
...
}

If instead we did:

unsigned char value = arr1->data[untrusted_offset_from_caller % arr1->length];

Would this produce a data dependency that prevents speculative execution from reading an out-of-bounds memory address? (Ignore for the moment that a sufficiently smart compiler might "optimize" out the modulo here.)
I think the branch predictor can be primed with well-crafted data? (start off with a long series of 0s for X)

For the other aspects like getting the cache timing, that does seem harder. I don't really know if it's feasible in practice.
I run Ubuntu out-of-the-box on a ThinkPad Yoga X1 and everything works pretty well, including the docking station, the digitizer, touch screen, hotkeys, battery life. Same was true with my older Thinkpad T420 (which had Nvidia Optimus). The good hardware combined with the good drivers is the reason why I did not yet switch to Mac.
This is what an IOMMU is for.
They say it has a new microarchitecture, pipeline reduced by 5 stages, new branch prediction, new support for multi-chip-modules, and new cache coherency protocol to support that.

It seems as much a ground up design as Zen.

http://www.eefocus.com/mcu-dsp/399906/r0
At least in my country, Spain, guest data must be sent to the police database within 24h of his/her check-in.
I really don't get the whole "the spec supports choosing of algorithm, therefore the whole implementation is bad"

If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks?

Why do we need a whole new implementation?
You may well have to.

A couple months ago I managed to lose my driver's license (but not my whole wallet) on the way to the airport. Somewhat to my surprise, I didn't have a real issue with TSA. They gave me a very thorough screening but it wasn't really an issue.

However, when I got to the Travelodge at SFO, they REALLY didn't want to check me in even though I had a reservation in their system. The only way I could persuade them was to pay cash plus a security deposit and to let them make a copy of my work badge with photo. Had I not had that with me, I don't think they'd have let me check in.
I've been wondering for years now, what is the difference between hanging out irl, and a chat room, or Facebook, or whatever? Not trying to be rude, but I just don't get how talking to your friends in meat space is socializing, but talking to your friends on the phone is a distraction?

I agree with you on the sheltered thing.
There's this:

https://www.sifive.com/products/risc-v-core-ip/

Not quite ready for prime-time, but it's a big step in the right direction. At least there's hope for future.
> While trying to get a solution to address this vulnerability as fast as possible, we faced communication issues with Intel which was deliberately restricting & filtering the information about the bug.

and

> According to the latest update from Intel, a microcode is required to completely fix the bug. The microcode release date is, at this time, scheduled for an undisclosed confidential unacceptable late date

seems like intel is not much help.
The collection of useful sites. 3 links daily
I'm genuinely not sure. Mills certainly speculate instruction just like the next guy but they handle memory access faults differently. Instead of stopping the world on a bad read they just tag the data as bad. With speculative execution and stop the world you have to supress stopping the world until the speculation is resolved or risk interrupting good programs because your branch predictor made a mistake. But there's no reason for
a Mill to suppress tagging. Loading from invalid data should just short circuit to producing more invalid data instead of actually producing a load so I don't see why there should be data ex-filtration from arbitrary memory locations as in Spectre. And they're certainly not intensely optimizing everything for every last drop of performance in the way Intel did to suffer from Meltdown. I wouldn't be surprised if there was some sort of Spectre-esque speculative attack you could run against current Mill designs to get some data out but probably not from arbitrary memory locations?

But all the above is pure speculation.
> My gut feeling is that people who haven't looked up from emacs or vi for a decade or two have no idea what modern IDEs are capable of out of the box.

I use visual studio in my day-to-day job for .net and C# work. I know what it’s capable and it’s a very impressive piece of technology.

What it doesn’t do is allow me to shape it to fit my workflow. I always have to adapt to fit the tool as opposed to the other way around, and any level of customization and extensibility feels extremely shallow compared to Emacs.

With Emacs I get everything my way. And I don’t think that can be said about any other tool I know of.

Needless to say I use both editors side by side and use whatever tool is best for the job at the time.

Edit: IMO standardized technologies like LSP is now bridging the gap for many (but obviously not all) IDE features. I suspect the imminent death of the “plain editor” is vastly exxagerated :)
Right, my concern is more the event of them axing work 32 seconds in or something, which could be a problem for some data analytics tools I've seen, that need a good 70 seconds or so to reach a steady state.
In the article they talk about how this water appeals to those who are worried about prescription drug residues and fluoride in their drinking water.

It seems like the anti-vacc movement makes poor health decisions based on a flawed or limited understanding of science and a strong faith in pseudo-science.

Science says vaccines are good, pseudo-science says that scientists are wrong and vaccines cause autism. Science says fluoridated water is okay, the jury is on on prescription residue, and we have a pretty clear idea of what happens with contaminated water consumption, pseudo-science "look what sort of nasty things science put in your water! Lets go with natural water from dirty sources!"

Edit: It's not about keeping unknown things out of their body, it's about a small group of non-scientists making unfounded allegations that can undermine the efforts society has made to improve the health of humanity (small pox, cholera, etc.)
Why continuous feedback is the simplest hack to build great teams
The requirements and budget of Google, Amazon and Microsoft are very different from a median start-up.

A simple closely related field: OAuth 2 token replay attacks. I auth against A with Facebook, A uses token to impersonate me against B. ISTR Google had basically the same bug. A median startup will not find that bug. Storing a random token in a database? Very likely they won't mess that one up. Also, if you do (let's say your randomness generator is MT as opposed to a CSPRNG), it's easy to fix, because you control the validation endpoint.
I'm not sure that 900 days of labor resulting in an equity value of $0 and a job offer is worth skipping the whiteboard and other recruiting nonsense. (I have no idea if that's what did or didn't happen here, of course, and suspect it was better than that, but that scenario is not one of "success", IMO.)
If it is (very likely, because only Intel can issue them thus far), they probably figured out how to turn off the branch predictor.

The performance drop will still be there, but better than the "recompile everything to not use indirect jump and call instructions"[1][2], at any rate.

[1] https://news.ycombinator.com/item?id=16066968

[2] https://news.ycombinator.com/item?id=16070050
If your software does something that could be done just as well in a web-based product, customers would probably prefer to have a web-based product, since it can be centrally installed and managed (even if they run it on their own servers).

However, there are still some things that can't be done with web-based products, and for those things people still use desktop software, like Photoshop. A marketing tool doesn't sound like one of these applications.

Why Linux? I wouldn't expect lots of marketing people to be using Linux on the desktop.
I often wonder whether these basic features are missing intentionally for not so benign reasons