skysight-inc/HackerNews huggingface dataset:
> Intel has developed and is rapidly issuing updates for all types of Intel-based computer systems — including personal computers and servers — that render those systems immune from both exploits (referred to as “Spectre” and “Meltdown”) reported by Google Project Zero.

Now I really wonder how they managed to patch both? Does someone know how you could patch something like that from Intel's side of things?
Shame on Motel 6 for not being transparent.

But as a counter-point to how much hotels will cooprate with agencies, most hotels will also cooprate with their guests. You would be surprised what you can "get away with" if you're polite to front-desk staff.

I've never given my license plate to hotels despite it being on many forms - I always just ask if I can leave it blank - sometimes they say it's their policy to ask for it, and I always ask if I can leave it blank, and a smile later and it's still blank.

(Similarly, you can almost always get a suite upgrade by being nice to the front desk agent checking you in and by slipping a $20 when you first walk up. This also works for rental cars - I got a $30/day mustang once by giving the guy a $20. Saved like $1,000.)

People with questionable immigration status may not be quite so daring or wish to raise suspicion by asking for exceptions, but it also kinda goes without saying that leaving any sort of paper-trail if you're proverbially on the lam is probably best avoided.

edit: I realize this isn't about license-plates and neglecting to give an ID to a hotel may be harder, but my point is that you may be surprised at how lenient most policies are.
> No, even with the second sentence it is still borderline.

I'm afraid I don't understand what you mean. In your previous post, you said the two sentences were not fine (i.e. they did qualify as Volksverhetzung). But now I understand you're saying the opposite? Or did you want to say "... even without..."?

> Twitter has nonetheless removed a very similarly worded tweet by a member of parliament.

This is what I was getting at; for anyone else reading, an AfD parliamentarian is under investigation after 100 odd denunciations for a tweet very similar to the first sentence, i.e. she said something like "Gang-raping immigrants are roaming our streets". She did not -- at least as far as I'm aware -- call for any violence towards, instead, she was opposed to official tweets from the police being communicated in Arabic.
I might be misreading this, but it seems like most of SVM is not under Classpath exception (most of the files are missing the magic words), which implies SubstrateVM binaries must be GPL 2. Is this intentional?
If ICE agents suspect criminal activity, they can get a damned warrant like they're supposed to.
Because they just bought it from you at that guaranteed price. They could go and sell it on the market for more/less, but the price you sold it to CB for remains the same.
The so-called "civilization" which taxes buy is a system of forced participation and oppression, devoid of civility, destructive to society, and morally indefensible.

All the things that taxes pay for can be purchased by private individuals and organizations working together of their own free will, and not because they are forced to do so. That is true civilization: civilized people cooperating to build a society where civilized, voluntary interaction, not force, is the norm.
The C3 does seem to be from Centaur: https://en.wikipedia.org/wiki/VIA_C3
Nobody forces you to develop iOS apps either. This is the point I think people are missing. Access to Apple's walled garden is valuable enough to people that Apple can charge for it and people will pay it.
I don’t think I’ve ever been in that situation but if I was, I would just go someplace else. Life is extremely brief and there are lots of other companies that aren’t messed up. If you are a developer, and you aren’t looking forward to going to work in the morning, think strongly about changing your employer.
IMO, the "best" way to learn this stuff is to try and pick some specific synth, usually a subtractive synth with normal tools/controls and then try and create a bunch of "real"-ish sounds on it.

For instance, the Roland Gaia is a good example... almost all its controls are knobs or sliders and there isn't a whole lot hidden in it. But there are similar software versions. And a synth like that is just a bunch of modules more or less hard-wired together.

If you reset it and turn as much off as you can, it is much easier to get some insight into how these things work.

When I was learning how to program a synth, I did a little of research on how to create a snare drum sound with a subtractive synth, and when I had that, I worked on creating a tom-tom, a bass drum, etc. Then I tried the same with a "horn" sound or a "string sound".

That won't get you very far, but it's a lot more solid of an approach than just noodling. I like to mess around with stuff too, but it's easier to learn when I'm trying to do something intentional.
A recurrent neural network for classification of unevenly sampled variable stars
Here:

https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web...

https://news.ycombinator.com/item?id=13866883

https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/

or go with the flow:

https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=...

He has countless comments preaching against JWT and DNSSEC.

Mind you, I know the nickname, I know he is good with sec (I'd hire him to vet an app) and all but I don't know him IRL or ever heard of him before joining HN ... that's to say that he spent a lot of digital ink discussing these two topics here. The subset he's talking about, should amount for more than 50% of the regulars I guess.
Is this basically an integrated south bridge?
Sending ICE a list of people with "Latino sounding" names is a much bigger problem than just a lack of transparency
https://en.wiktionary.org/wiki/chicken_bit

The first example usage given there is very illustrative:

As an example, modules such as branch predictors and speculative execution units can be turned off with a variant of the “chicken bits”, control bits common to many design developments to control the activation of specific features.
What is your plan to access storage if your phone's motherboard gets fried?
Well, if nothing else, the design of the Mill has a much smaller "attack surface". There's not nearly as much in the way of interesting activities going on behind the scenes as compared to a modern OoOE CPU. That logic is pushed out of the hardware and into the software development toolchain.

The Mill has many other aspects that improve the security story. All protection is based on memory address, for example. And pointers are not integers. There are reserved portions of the address space that programs are completely not allowed to touch.
Not entirely true. The T1 also controls the FaceTime camera, TouchID and probably parts of SMC functionality (ambient light sensor), although that last one still has to be confirmed.
Why is the server stateless? I thought you said you end up calling up the db all the time for authz decisions anyway. That sounds like you're still managing a bunch of state server-side.

Unless you're saying "my server process itself is stateful, all the state lives in the database": in which case, yes, but the tokens bought you nothing. If you have random tokens and you store them in the database you have the same situation with no crypto to mess up.
> Are illegal immigrants illegal per se?

Sure. So how do we determine who is an illegal immigrant? By looking at an illegally-obtained list of names and picking out the Hispanic ones for background checks?
I don't like string-based queries, functional approach suits me better.
Anyone who is reporting appreciated stock compensation is ruining the thread with inflated numbers. People who join today don't get a retroactive stock grant.
"transit hubs" may have been the wrong term to use... I think he's proposing these new rules anywhere within 1/4-1/2 mile of any transit stop with 15 min frequency or better. So it's probably a larger area than you think.
Great explanation - thank you. One thing I don’t understand is how this can be exploited from javascript. Does it have timing primitives so fine it can tell the difference between a memory lookup served from memory va from cache?
>Is it bad to use 4 transactions for 1 transaction when it makes your transaction througput 100000x higher?

Not really. It'll increase latency on commit confirmation and that might suck, though.

>Aren't there already altcoins that have solved the transaction scalability problem?

Nope. There's ones that can scale better than bitcoin, but in the end there's only so many parameters you can tune and an actual solution requires more than just tuning block size / block rate.
Reinterpreting “interstate commerce” to mean “commerce that actually involves money, goods, or services crossing state lines” would be a huge deal. It would essentially overturn Wickard v Filburn and put the brakes on a huge number of federal laws that exist to compel the states to do things. It seems very, very unlikely that the SC would make such a move, but it would be spectacularly welcome for us strict-constructionists.
Not if the attacker knows the password (which is probably just listed on the wall in the hostel)
I met Max just before his YC interview. The fun fact there was that we both have the same firstname, came from the same region (Europe), and work on the same product family (Vulnerability Management).

AppCanary went to YC, and Cyberwatch went back to France.

However, for us that was for the best! Most of our customers indeed really liked the fact that we are a 100% French company.

We are now profitable and provide a complete Server Vulnerability Management + Patch Management solution.

Different paths to glory, but the world is small and I'm sure we'll meet again someday :)

=> I wish you the best at GitHub!
This is essentially factually untrue at this point.

[wrong-link]
I wish desktop chips would trade a little performance for more simplicity and robustness. Even at half-speed, they are still pretty damn fast, and a lot of the bleeding-edge stuff was pushed over to the GPU a long time ago.

The economics are also a little off. If this were something like ARM64, the eventual replacement chip would be a few bucks instead of a few hundred. In that situation, I wouldn't get too upset about it. It would be like, "Oh well, I guess I have an excuse to upgrade my CPU now."
I don't agree with the presuppositions. I also think his views were not fairly summarized, which is critical to the story since his expression of his thoughts are what got him fired. If you mess up that reporting, the story becomes "Google fired a crypto-sexist guy and sexist people are grumpy about it", which is pretty close to how the NPR story reads to me.

Grading on a curve, maybe NPR did fine (I've ready Fox News accounts that read similarly), but on topic, some people (Thiel) think there's some monoculture in the media that needs disrupted.
MS: Guidance to mitigate speculative execution side-channel vulnerabilities
You're right - shame on Motel 6 for being dirtbags and for not being transparent about being dirtbags.
I hope that Mac Pro would be good old case with standard components without extra price. I really like macOS but all Apple's computers are just terrible for me. Mac Pro is my last hope to stay in Apple ecosystem.
Leave it to Ubuntu to invent their own Transport Layer Security standard
i'm not a data scientist, but i have several on my team. In my experience,(as your question suggests) the interest is quite low, particularly given how much knowledge is required to do so that would otherwise be out of scope

building the model and packaging it for deployment are two completely different sets of tasks, are they not?

much more useful, again in my experience, is a tool like vagrant, which allows a production environment to be provisioned onto a VM; said VM is then run from the data scientist's desktop (eg, so they can do their work with the same versions of the same tools available in prod)
what kind of projects will one want to write in rust? I am going through rust right now , and I find it very difficult, simple stuff like doubly linked list or graph is not very intuitive, especially when you want to update inside rc using refcell.

Any tips for newbie like me on motivation and learning?
A dead-simple algorithm reveals the true toll of voter ID laws
I think one of the issues is a very practical one. When everything is called JWT, it's hard for users to figure out whether it's a secure or insecure implementation.

It's completely possible to do secure things with JWT, especially if you control every producer and consumer, but it's not guaranteed.
Thanks for the solid information. I just looked up the laws that the AG is suing on:

- [1] RCW 19.86.02 = Unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce are hereby declared unlawful.

- [2] RCW 49.60.030(1)(b) = The right to the full enjoyment of any of the accommodations, advantages, facilities, or privileges of any place of public resort, accommodation, assemblage, or amusement [without discrimination against race/creed/color/...]

- [3] RCW 49.60.215 = It shall be an unfair practice for any person or the person's agent or employee to commit an act which directly or indirectly results in any distinction, restriction, or discrimination, or the requiring of any person to pay a larger sum than the uniform rates charged other persons, or the refusing or withholding from any person the admission, patronage, custom, presence, frequenting, dwelling, staying, or lodging in any place of public resort, accommodation, assemblage, or amusement, except for conditions and limitations established by law and applicable to all persons ... PROVIDED, That behavior or actions constituting a risk to property or other persons can be grounds for refusal and shall not constitute an unfair practice.

I am still unclear on what the violation is supposed to have been. The first two charges are about unfair commercial practices and refusing service based on race - neither of which seem to really apply here. The third makes a specific exception for conditions that apply to all customers - and in their terms they specifically state, to all customers, that they may give their information to law enforcement.

[1] - http://app.leg.wa.gov/RCW/default.aspx?cite=19.86.020

[2] - http://app.leg.wa.gov/RCW/default.aspx?cite=49.60.030

[3] - http://app.leg.wa.gov/RCW/default.aspx?cite=49.60.215
Introduction to Serverless Microservices
Continuous deployment tool DeployHub now certified by Red Hat
Is € 4.700 gross per month a good salary in Amsterdam?
I friend have received a proposal from a company there and I would like to help him. We are already aware that company hold 30% until it check if you has a degree and stuff and can hold it forever if it concludes your degree is not enough. But what about cost of living and taxes? What would be the net salary after taxes? Any advice?
You're plain reading of the terms skipped over the first part:

"We may disclose Guest Information to law enforcement agencies, ..."

They are saying right there that they may disclose such information. Whether they are breaking state law is a matter for the courts to decide. Apparently the Supreme Court already decided such a matter. I disagree with that decision, if such information should be kept private then it should be illegal for a hotel to require such data. They should only require the information to charge for the room or accept cash with little or no information. Why does the hotel require such information in the first place?

But all this does is create yet another bump in the road for law enforcement to do one of the easiest parts of their job, asking a third-party for information.
You can't in conventional software, this is almost certainly a microcode update. It remaining to see at what cost. This change may well just totally disable features that normally are heavily used in pipelining.
I don’t know for sure but you can still be pcie and nvme with a different connector probably.
One interesting piece of information from this post is that Intel notified Ubuntu about the issue on November 9. Project Zero notified Intel on June 1, so it took over 5 months before they passed it on to Ubuntu (and even longer for the other vendors).

That seems like an extremely long time to me, when it (I assume) was pretty obvious that it was going to require OS changes to mitigate.
Might I suggest that Apple has a sealed off part of the system because they need something they can trust completely and they don't feel like they can trust Intel?
Public keys solve the key management problem. If you have just one or two tiers it's not a problem.

If you have thousands, you end up spending a lot of time on key distribution if you need individually distributed secret keys.
Regarding .XYZ TLD:

Please don't use XYZ.

Reason:

It's 99.9% full of crap (SEO spam, malware, etc.)
And how do I get these firmware updates and microcode updates on Windows?

Checking AsRock, there aren't any Bios updates.

Also:

> Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer. Surface customers will receive a microcode update via Windows update.

From:

https://support.microsoft.com/en-gb/help/4073119/windows-cli...

(There is also a powershell script to check if you are protected fully or not)
Won't modern browsers block this anyway?
A popular sugar additive may have fueled the spread of not one but two superbugs
> What problem are we trying to solve?

Cheaper clean energy. Cures for diseases. Social stability.

In some cases, we aren't talking about 1000 people. It could be 1000 cities or 1000 countries or 1000 bills of rights.
This is common in many countries; whether official or not.
Not just Spain. If you’ve ever traveled you’ll know that the first question you’re asked at a hotel upon checkin is “Can I see your passport?”

I knew Estonia did, so I used that as a basis for a search. Apparently they requested basically an RFC from other EU countries on whether they do [1].

Of the respondents, the following require registration: Belgium, Estonia, Finland, France, Germany, Hungary, Latvia, Lithuania, Luxembourg, Portugal, Spain, Sweden, and Norway.

That’s non-exhaustive, I know from other sources that at least within the EU Italy does as well, not to mention countless other countries around the world.

1: http://emn.ee/wp-content/uploads/2016/02/466_emn_ad-hoc_quer...
The problem is that it's not idiot-proof. If someone doesn't understand why the algorithm is important, they might choose none. It's easy to say "they shouldn't be using JWTs if they don't know how to use them", but everyone starts somewhere, and everyone puts stupid bugs into production.

JWT is safe, as long as it's setup correctly, but safe-by-default is a better option.

That being said, I'm not going to swap out my JWTs with PASTs. I know what algorithm I'm using, why I'm using it, it is safe, and I'm verifying them properly.
> can we even consider the possibility that this is the only planet with life?

Yes, we can. I don't personally think life is all that rare in the universe- we agree there. But I think it's perfectly fair that it's possible we're alone.

It's really a question of how many unlikely events lead to us existing and how improbable those events are. People always start with "Let's imagine only 0.1% of planets have conditions for life! How rare that must be!". But is 0.1% a fair estimate? What if the true number is 1E-20? Or 1E-40? 0.1% is easy for humans to understand and think about so we always start there. Then apply the same reasoning to the jump from single-cell life to multi-cell life, to the odds of become larger animals, the odds of becoming intelligent.

We don't know what the odds are, so we always use odds that sound low but are actually quite large.

Just like humans are biased towards not seeing how big the universe is, you (like everyone else) are biased towards using probabilities in the realm of human understanding. That is just as wrong.

The question isn't how big the universe is, it's the comparison of how-big to how-unlikely.
If it's a timing attack, they probably don't need to fully turn it off, but turn it off and on randomly every now and then..
Indeed, with dark skin no less (c.f. https://en.wikipedia.org/wiki/Before_the_Dawn_(book))
(Hi I'm not 'tptacek, I work with him but don't speak for him)

If you just want a few examples of stuff that can go wrong that doesn't go wrong if you just use a stored token instead of crypto, or doesn't go wrong if at least you use symmetric crypto instead of asymmetric crypto:

- Some bugs are about negotiation, e.g. key material misuse between RSA and HMAC schemes in JWT.

- Some bugs are about cryptographic implementation, such as not reusing nonces for ECDSA or RSA padding oracles or RSA keygen vulns (see Infineon bugs a few months ago). These are almost exclusively in the asymmetric crypto camp.

- Some bugs are about specification issues, such as non-mandatory aud (audience) and exp (expiry). You don't have specification issues if your tokens are opaque random numbers. You have significantly less bad/fewer specification issues if your tokens are versioned and you don't allow negotiation.
One of the links in the post was also a really great read, for those who skipped it.

"Reality has a surprising amount of detail": http://johnsalvatier.org/blog/2017/reality-has-a-surprising-...
I actually would be fine as long as the SIM card is not fried - yeah I would lose some game progress data but that's it. My calendar, phonebook and mails are in the cloud, Whatsapp has regular backups to the SD card, as are the images.
Google does not have a degree requirement. Neither do most (all?) other tech companies. If you pass the Google interview, it doesn't matter one bit what school you went to, or if you went to school at all.
I'd rather just be rid of them altogether. No compromise.
My project to learn rust was a camera RAW format loader[1]. Compared to the good modern C++ codebase it's based on the end result supports the same formats, has the same performance, is only 20% of the lines of code, and is much safer to use (binary formats are rife for exploits). Doing all that took me less time than I had already spent previously fuzzing the C++ codebase and doing whack-a-mole on extremely scary exploitable bugs. For that use case it was extremely successful.

The next step is to build an image pipeline and editor around it[2][3]. For that the graphics ecosystem isn't as mature as the equivalent C/C++ ones but the possibilities are also amazing. The expressiveness of the language combined with the great LLVM backend means some things like very clean ways to do SIMD/threading become just a joy to use

If only I had the chance to work on this full time for a year... Help would be very much appreciated!

The kinds of things that become possible and even pleasent once you remove the mental overhead of dealing with the fundamental warts of C/C++ are amazing. After this experience with rust I don't see any reason to ever write C/C++ again.

[1] https://github.com/pedrocr/rawloader

[2] https://github.com/pedrocr/rawloader/tree/master/src/imageop... (to be spun out into its own crate)

[3] https://github.com/pedrocr/chimper
FWIW, if I were in that position, I wouldn't blame you for stealing that drug from me, and myself I would do my damnest to make it as widely available as possible.

But ultimately, it doesn't generalize well. Society will forgive you a lot in emergencies, but if a behaviour like this becomes common, it really would threaten the ability to provide drugs at all, and it would end up condemning to death much more people in the near future.