skysight-inc/HackerNews huggingface dataset:
Good to see it, been running tf-nightly, cuda 9.1 nvidia gpu drivers with cuda 8. The entire dependency issues between drivers/apps/libraries have been incredibly annoying.
Somewhat dated, but good:

https://www.orange-papers.info/orange-secrets.html
My odds there are much better than they are trying to do a similar audit on MacOS.

Based on what metrics? Someone skilled in Assembly can and has found many vulnerabilities in closed source software. The chance of you as an individual being able to audit the entire Linux codebase and finding a new vulnerability are nil unless you have some special skills that you haven't mentioned that make you better than some of the top hackers and researchers.

There are people out there who are extraordinarily skilled at this sort of thing. Security flaws in, say, iOS are found regularly.

Despite the fact that is closed. How does that support your point that "open" software is easier to find vulnerabilities. You said that you could hire someone to audit the code, could you afford them?

That's how jailbreaks work

Without the code being open...

(And, BTW, the fact that Apple doesn't give me the option of opening up the jail on my own phone means that if I want this freedom I have no choice but to run some black-box binary from some unknown Chinese hackers. That is by far the biggest security risk I face when using Apple products and it is a direct result of their policies.)

Apple has the source code for all of the chips they use and they had a hand in designing most of them. As opposed to the random Android manufacturer who outsources their chips and the manufacturers give the OEMs binary blob drivers.

Even Google said they couldn't upgrade one of their devices because they couldn't get drivers for one of their chips.

Do you really run your Android phone with all open source software that you compiled and installed yourself? Including the various drivers? Have you audited all of it?

They did find it, and I didn't even have to pay them. If I had paid someone to look, they might have found it sooner.

And they've also found bugs in close Software and if you pay someone enough they could find stuff too.

No system will ever be perfect. But I like my odds on Linux much better than on Apple.

Based on what objective metrics?
Designing for offline on Android
Personal data of a billion Indians sold online for $8
You can sub via ical/webcal using this link:
https://calendar.google.com/calendar/ical/nytimes.com_89ai4i...
Their privacy policy, in this case, literally states they may disclose your information with law enforcement agencies.

Compliance with Law

This is a United States Site and is subject to the laws of the United States.
We may disclose Guest Information to law enforcement agencies, or may be
required to disclose it during the discovery process in litigation, pursuant to a
court order, or in compliance with any applicable law, regulation, rule or ordinance.

https://www.motel6.com/en/faq.html
If some fixes can be applied via microcode, then the distros will have to be provided the updated microcode. The kernel (mostly) does not handle CPU microcode distribution.
AKA; not us-central1-c
This sounds like it would make mucking about with TensorFlow in the REPL far easier.
> (Similarly, you can almost always get a suite upgrade by being nice to the front desk agent checking you in and by slipping a $20 when you first walk up. This also works for rental cars - I got a $30/day mustang once by giving the guy a $20. Saved like $1,000.)

Apologies if this comes across as apoplectic, but isn't that straight-up corruption? It's not as bad as similar behavior by a government official, of course, but it's still a principle-agent problem when an employee uses their position to enrich themselves instead of doing the job they're paid to do. It's one thing when a clerk upgrades you as a nice gesture, but by involving cash I feel like you're crossing a line.
TouchID is part of the Secure Enclave along with Apple Pay and the keychain. I’d expect the FaceTime camera is wired up to it for security, to prevent access from malicious programs. Is the ambient light sensor used for controlling the brightness of the Touch Bar?
Pretty sure Ubuntu are the largest Linux vendor right now, and have their distro on the largest number of servers worldwide.
Report: Peter Thiel mulled creating conservative cable network – Axios
My experience in this realm:

Out of curiosity, in June or July I ran some Ethereum mining stuff on Azure's GPU instances.

The ROI was around -90% (negative 90%, to be clear: for $1 spent, I mined ~$0.10). Even with the higher price of Ethereum now, you'd probably be around that same ROI since the difficulty has also increased a fair amount.
They are saying this to protect future products that are too late to update. A flaw must be fixed. This thing will exist in near-future chips for years until they redesign. So lomg as they can call it a software issue they need not stop production.
Good question, currently, no. I will see what options mailgun gives me.
> it's not unfairly biased against blacks

You may be interested in "Fairness in Machine Learning" (https://fairmlclass.github.io/)

From what little I know - In the same way that vision systems pick out edge and feature detection without being explicitly told what those things are, the kind of algos you're talking about could pick up on biases... and just like DeepDream shows how you can then investigate the features encoded in the system, maybe you could then investigate the biases.

In other words, if these kinds of models encode the existing social biases, it also means those biases are now somewhere very, very examinable.
> There is nothing contentious to debate about.

The FDP, CSU, AfD and indeed large parts of the CDU want to have a debate about immigration. The CSU represents around half of Bayern, some 6 million people. The FDP, CDU, and AfD together represent 56% of the votes in the last election.

Even prominent voices on the left want a debate: Sigmar Gabriel, who until recently was head of the SPD, wants to have a debate. Sahra Wagenknecht of die Linke also wants to have a debate. Heck, there's even a prominent green politician, Boris Palmer, who wants to have debate.

So: what planet are you living on?

> Additionally, there is no debate if you call for violence against minorities.

On this we agree :)
A minor correction, ARM's upcoming A75 core looks like it will be vulnerable to Meltdown too. But since it isn't intended for use on server workloads the performance impact of the fix shouldn't be very significant.
Front-End Performance Checklist 2018
Has anyone written anything on how process affinity would help with Spectre/Meltdown?
A bug is a bug regardless of what the original specification mentioned.
Maybe separate BTBs. Or maybe disable branch target prediction when in kernel mode (but then some VM process may still observe some other process running inside a different VM via a side channel).
This is a deeply naive view of how government works. The exclusive domain of the purse string rests with the legislature, that is in the constitution. If the legislature makes something illegal, but they do not fund enforcement, and the president signs that into law, there is nothing the executive can do to get more money for enforcement, they simply can't enforce it. And there are all kinds of examples of this.

Enforce every law is just nonsense talk. Absolutely they pick and choose what to enforce and what not to enforce. It's all a resource allocation, and ideology and politics determines a lot of how it gets allocated, which is why elections matter.
The camera isn't a vector of attack, it's a thing to be attacked. The camera right now on desktop computers is wildly insecure, giving authority of it over to a secure enclave seems like a great way to finally start securing that path.
Yes and no.. my point still stands. I would also exclude "bonus" in these comparisons because they are too variable as well.
It's an interesting debate. But it's clear in the statement they provided, that they are laser focused on design above all else.

Literally, prioritize proper design over security and maybe even performance in some cases. Which is interesting because you'd figure at some point, the customer would be considered in the design.

Like are Intel chips designed by robots or something?
Python library to interact with 28K public DNS servers around the world
I've heard the argument before that you are better off reviewing a disassembled binary than the original source code because you are going to be influenced by layout, variable names, and comments which could mislead you.
Forgive my ignorance, but if you are going to all the trouble of storing the JWT id in a server side database for verification why don't you just store the JWTs' claims as well and just hand the client an opaque random id? Your gateway could do the lookup and supply the claims to your backend without the client knowing anything about it. You wouldn't even have to validate the claims, since they never leave your servers.

The best part of using JWTs is that you can validate without a central database. If you need a central database for sessions anyway you might as well store the claims in it.
This is a very good piece of advice! I do have to configure my emacs every time I take on a new type of task albeit not very often. I'll give it try next time. Thanks!
I remember meeting you that day, it was a very surreal start to our summer in Silicon Valley.

I'm really happy to hear you're doing well in the space!

Building a profitable company is really hard, I should know :)
Even so, I somehow doubt that 15 years of iOS devices equals 30+ years of x86 devices.
My bet is: People who steal other people's reservations.

This would be especially problematic at times when all the hotels in the area are full because of a convention or sports game.

But for walking off the street? Just general idiocy. What if you stain the carpets and break the walls, then disappear? They'd need some way to know who to send the cops after.
I'm sure the T2 doesn't verify the OS against the network at boot time, but rather when you're installing the OS update. Once it's been installed, it's trusted.

The trivial proof here is if it did anything else, ignoring an OS update would brick your device, which is obviously not desired behavior.
I think what Intel is trying to say that this feature makes the chips insecure by design. It’s kind of like in Python where can get around the week protection for classes, methods, and variable to make them pseudo private by putting underscores in front of them.
For the second year in a row, CES won’t feature any female keynote speakers
> Intel products are uniquely vulnerable to the meltdown attack

More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not be vulnerable. Some ARM processors _are_ believed to be vulnerable.

> for most CPUs you can attack userspace processes with these techniques

Spectre can attack the kernel as well, at least according to http://www.tomshardware.com/news/meltdown-spectre-exploits-i... . It's just harder to use than meltdown.
Congratulations, you’ve just invented session tokens. Don’t get me wrong: stateless tokens (like JWT) are terrible in part because they’re irrevocable, but then why bother reimplementing session tokens with JWT? Just use plain old session tokens instead.
Ubuntu Updates for the Meltdown / Spectre Vulnerabilities
> What is your plan to access data on a drive if the SSD controller chip gets fried?

I have yet to see a failed controller chip - motherboard or PSU failures due to coffee, cats, dogs or any combination of these three however I have seen multiple times in my social circle.
A few reasons to try intercooler.js this year
Syntorial, while not cheap, is an amazing tutorial.
Just this morning there was a discussion on HN about how the only way to deal with the mountain of laws that don't make sense anymore is to selectively stop enforcing them. I can guarantee you've inadvertently violated the letter of some law somewhere several times today, despite being (I assume) a generally good person.

So ask yourself: how much are you willing to piss off a three-lettered agency regardless of the legality of that specific action?
What I don't understand is how the branch predictor is even exploitable from JavaScript -- it doesn't have pointers. How can it "request" arbitrary memory locations and time the results?
Learn Go Programming – Yearly Recap – All Articles from 2017
For anybody that needs a replacement that is OSS and can monitor dependencies for updates, there is this:

https://libraries.io/

Disclosure: I have no interests (direct/indirect) of any sort in libraries.io
How I Coded Everyday for 365 Days
How does this mesh with the pop-fact that we share 98% of our DNA with chimps and 50% with bananas?

Is that a population level statistic?
I haven't worked in ML, but I've used Python extensively for scientific computing. Setting up the environment used to be a headache, but Anaconda solved that issue. Are ML tools not available in Anaconda?
The authors could have chosen a much more neutral title and opener, like "Trends toward inequality in human society can occur through processes akin to evolutionary dynamics" and then they wouldn't have had to dial back anything.
SB 827 creates density and height zoning minimums near transit.
Under SB 827, parcels within a half-mile of high-connectivity transit
hub — like BART, Muni, Caltrain, and LA Metro stations — will
be required to have no density maximums (such as single family
home mandates), no parking minimums, and a minimum height limit
of between 45 and 85 feet, depending on various factors, such
as whether the parcel is on a larger corridor and whether it is
immediately adjacent to the station. A local ordinance can increase
that height but not go below it. SB 827 allows for many more
smaller apartment buildings, described as the “missing middle”
between high-rise steel construction and single family homes.

I think this is overstepping a lot and I hope it fails. Muni is very much within san francisco where there is high density housing, but does this mean all stops? There's a million muni stops and some of them are in areas that don't need such high density. BART can travel very far outside the city to less dense areas. Some caltrain stations are very suburban. This says all parcels within half mile of those station need to be higher density, that is a LOT of homes. You are telling those people who live there that they can never rebuild? If they want to rebuild their house they need to make it into an apartment complex? Is their parcel even big enough for that?

There's hundreds and hundreds of 5,000sqft lots within a half mile of caltrain. Your house burns down in a fire, you cant build it back? A 45 foot house would be at least 3 stories. It's one thing to say we need more dense homes in this area. But if the area was designed and laid our for single family homes with small single family lots, how is putting a 3 story house on those small lots going to help? It's also saying there's no minimum parking requirements. Not that you could really get any underground parking on some of these lots but street parking is going to be trashed as well? It's the suburbs! You do need a car out there! Caltrain/Bart is not the only form of transportation you use!

This seems really shortsighted and ignores the problem that each city and community is a little different. Some cities along the Bart/Caltrain lines could handle this. Others could not. A top down approach saying everything is the same and must follow these rules is not going to work
Facebook's problems are Zuckerberg's 2018 challenge
Should we start to think seriously to adopt homomorphic encryption on virtualized environments?
I actually thought this was one of the more refreshingly candid "our incredible journey" announcements I've seen, complete with apology to inconvenienced customers and an admission the service was being sunsetted because it hadn't achieved its business goals as opposed to because $incompatiblenewservice was even better.
The potential harm was given in this article:

"In some cases, rigid interpretations of the 12 steps can even lead people to reject treatments or approaches that work for some people."

There's a huge for-profit, unregulated "rehab industry" in the US that charges insane amounts of money for all sorts of unproven "treatment." There's harm in getting fleeced to line someone else's pockets.
Makes sense. But man these attacks really do need lots and lots of CPU just to extract one bit of data.
... with sex dolls... with Intel Inside stickers on them?!

;)
The source may be biased but does that make them wrong? They are just reporting data from German statistics. Which I would have referenced directly but unfortunately it's in German. I wasn't able to find any data or claims that contradict this though.

>Some immigrants have higher fertility, but it's a distribution, not a monolith.

The distribution is irrelevant. On average they have 3 to 4 kids per coupe and natives have less than 2.

>immigrant fertility tends to revert to the local mean within a couple of generations

By then it will be far too late.

>immigrant fertility tends to revert to the local mean within a couple of generations as fertility is inversely correlated with economic stability

Religious minorities tend to have much higher fertility rates even within first world countries. Look at Mormons or Orthodox jews. Poverty is not sufficient to explain the high Muslim birth rate. And it's high even among the second generation.
The same can be said for many security vulnerabilities, but that doesn't make them any less faulty. Shellshock exploited a bug that had been in Bash for 25 years (!), but being non-obvious isn't a free pass.

I am not angry at Intel and in general think they do a good job, but trying to dodge blame here comes off sounding pathetic.
Most likes I ever got on OKCupid was when I used a GAN-generated celebrity as my profile picture. Just one girl noticed something wasn't quite right.
As is reported down thread it might be reasonable or not but some of the assumptions are open to question. It's not unreasonable to suspect that Medicaid will cover the benefit. Also The number of people would just include the U.S. presumably the drug would be sold world wide.
From TFA

>To address the issue, updates to the Ubuntu kernel and processor microcode will be needed. These updates will be announced in future Ubuntu Security Notices once they are available.
Looking for COBOL or EDI work
Hi, I'M a 60 year old COBOL/CICS programmer. I coded for about 23 years. I also taught myself the EDI x12 language & used it for the last 7 years of my career. I left the field in 2002. My question is this: I worked a parttime bookkeeping job while my son was at home. He started college in the fall 2017. I would love to get back into the programming world & am not sure where to begin. I know it would be a short matter of time until I got the rust out, but I know I can still write code. I welcome any suggestions. I live in the Philadelphia area.
Does anyone see value in tool like michaelangelo from uber?

What if a data scientist could deploy models right from browser?
Differentially Private Dropout
spectre can read, not write.
Definitely possible. I am a windows developer by trade though, so I used a windows service that is always running looking for new content then queuing it up for the email notification.
Nothing is certain, but you can sort companies into "likely to gain" and "unlikely to gain." The P/E and P/CF ratios are commonly used for this, along with other valuation metrics. The basic theory of value investing is to find companies that are likely to give you a return.

Also, historically the stock market as a whole has outpaced inflation, so even just investing in randomly chosen companies should have gains over time (there is even evidence that a portfolio of randomly chosen companies performs about the same as a portfolio of companies chosen by analysts and advisers).
If I recall correctly, the original impetus for nylon was replacing the natural isoprene rubber in tires, to remove the necessity of rubber plantations as a strategic military asset. This resulted in neoprene. Then DuPont decided to expand the project to explore uses for other novel polymers.

The inventor actually committed suicide, partly because he thought he was a one-hit wonder.

Neoprene was invented in 1930. Nylon 6-6 was invented in 1935. Carothers killed himself in 1937. Nylon was first used in toothbrush bristles in 1938, and rolled out to nylon stockings in 1939. Nylon production was then diverted into war materiel until 1945, which was when people started rioting over shortages of nylon stockings.

Who knows what might have happened to polymers technology if antidepressant medications had been commercially available and known to physicians in the two year window between 1935 and 1937? That seems like an odd dependency, but the inventor of a notable technology failed to invent other notable things because he had severe and suicidal depression. So it isn't just as simple as roads needing chariots and chariots needing roads, like the article mentions. Sometimes the prerequisites are strange and unpredictable--like the inventor had to visit a zoo featuring a particular animal species during their childhood, or they had to drive a car in a climate with cold winters.

The more things we have, and know about, and the more people move around and collaborate, the easier it is to satisfy those prerequisites.
They were busting California medical marijuana dispensaries left and right as recently as 10 years ago, which is more than a decade after we passed Proposition 215. It seems a bit optimistic to think that now they'll bow to state law.
Focusing on ideas is necessary to deal with the problem. By ignoring it, you're missing the point.

You seem to think I'm focusing on people, but: a person who believes in the idea of Islam is a Muslim, is the same way a person who believes in communism is a communist and a person who believes in fascism is a fascist. There is little difference between saying a bad idea is bad versus saying supporters of a bad idea are bad for supporting it.

Surveying Muslims worldwide and asking them if, for example, they think being gay should be illegal, and reporting what they say, is not bias, it is fact.

You're promoting bias by suggesting we ignore those results.

And again, because you haven't responded: Islam isn't a race. If we can be racist aginst Islam, can we be racist against people who like stuffed crust pizza?
That is a nice website. Congrats on shipping it!
Wrong. The hardware wallet requires physical access to sign transactions with the private key (you have to press the button to acknowledge the transaction).
In order to be vulnerable, a system needs to run malicious code. This is an especially big deal in the context of virtual machines in shared hosting, because you have no idea what code is running in other virtual machines on the same host. It also impacts end-user systems because the web is basically 100% untrusted code.

Even if the cpu in your router is vulnerable, what untrusted code is it expected to run?

None of this is to say it's not something that should be fixed. But it's low priority, as it requires the ability to execute code remotely already.
On the other hand, the ability to compromise the T2 chip would lend attackers the ability to use the camera outside of OS control and thus outside of user control.

At least with OS updates, it's possible to patch potential security vulnerabilites. Of course it's much harder to patch silicon, as we're seeing now.
We've made good looking people obsolete.