skysight-inc/HackerNews huggingface dataset:
IBM, Austin, TX, band 10 (Senior Technical Staff Member)

Base salary: 190k / yr base salary, ~6k / yr performance bonus

Equity Grant: ~$125k stock grant, vesting twice in four years, so ~$31k/yr stock presuming I stay for all four years

So - total annual compensation (excluding healthcare benefits and our 6% 401k match) is about $216k annually.
My eyes saw "Obama's Phone", and thought it might be a reminiscence about his Blackberry.
Which part of blazing a trail excuses having execs go to India to try and obtain medical records to discredit a woman accusing a driver of Rape?
Not sure why you're being downvoted. Running any kind of financial service I would expect a corp to run their own hardware.
What does "fruit-fly code" mean? Short programs?
I like Shen too. I'd like to do a "basic proofs" Shen article comparing it to ATS.
People were mocking them for it on Twitter, and one of the researchers (Anders Fog [0]) called it "funny". It could just be that people were misled into believing that such hardware currently exists, and that CERT decided there would be less confusion to stick to currently-possible mitigation techniques. :)

In any case, I doubt Intel would pressure anyone to remove the generic imperative "buy a new CPU".

[0] https://twitter.com/anders_fogh/status/948904282568392704
>Where we do run on shared hardware, we make it more difficult to accurately target one of our systems by rapidly cycling through instances in AWS.

Wait, doesn't that just spray their sensitive information over more and more machines that may or may not be sufficiently wiped before it's reassigned to someone else? Or increase the chance they encounter someone running one of these exploits panning for digital gold in the other users RAM?
>> Fully removing the vulnerability requires replacing vulnerable CPU hardware.

Imho intel would much rather them keep this language, which is why they removed it. There is no drop-in non-intel replacement for an intel CPU. Telling everyone that they need to replace CPUs is basically a mandate for them to by whatever replacement intel can cobble together. Having to replace all those chips would see intel's stock price skyrocket. The reality is that chips don't need to be replaced asap and customers have time to perhaps choose non-intel chips.
Sure, and now we’re asking the state to consider whether maintaining what you like about your neighborhood is sufficient justification to write public policy that denies opportunity to others.
Friendly reminder to disable Javascript, at the very least, by default.

Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function.

https://github.com/gorhill/uMatrix/
How being smart can make your life harder
Narender Modi and people gets shocked after hearing this meditation commentry
Hideously clever full paper https://arxiv.org/abs/1705.08361
If only snark were sufficient for encapsulating the degree to which this is disgusting.

At least they've still got their cash.
Thought it was interesting that plans for the Clipper Chip were canceled around the time the recently discovered CPU vulnerabilities were introduced. Extremely unlikely that there was some conspiracy given the number of vendors affected, but a possibility given the magnitude of the military budget and the value of being able to decrypt enemy communications via side-channel attacks.
Yeah... It seems like some search engine for some decentralized video might work.

Some search engine indexing, videos hosted on independent sites(regular http), favorites/playlists can be stored in something like Dropbox privately or shared.

Probably could be just a video tag with additional elements and builtin functionality.

Some advertising spec too... Sites can either implement third party ads or host their own ads for example. So instead of being told your content isn't advertiser friendly. You could run your own ad server that's in the video metadata or use a external one agreeing to their terms for video content. So total freedom to go out and get your own advertisers or signup for a service and plugin a URL and they get to handle that part.

So say you just want to make videos, not doing controversial or political stuff and not really into being a sales person just use this ad network... or maybe you are a very political channel, point to this other ad network that targets that audience. Maybe you are a non-profit, run your own ad server with your own in-house fundraising ads.

Not sure how you'd go about handling sensitive stuff some people might not want to see, maybe at the search engine part using AI/machine learning but also allow sites to indicate certain things within the spec itself... Decentralizing the search part even better.

But ideally you'd have a consistent UI sorta like YouTube but all content is fetched from servers like a web browser, you'd have subscriptions, sorta like RSS, etc...

But I guess subscribers counts and commenting/liking would need to be apart of it too. Maybe use somthing like OpenID. but sites that want to host videos apart of it would provide certain metadata and some callback urls to post to for like comments, getting commentings, likes, etc.

Just thinking out loud... One of the benefits of YouTube is discovery and organizing your watch later, subscribers, etc. So some sort of formal spec for a video app would make sense.

Searching random sites, signup and comment and have like 10 sites to check for new videos would get annoying.
I'm pretty sure John Cage's works are under copyright, which is interesting since he made such a big show of erasing himself from the work and embracing the random. It never occured to me how obtuse that was. I'm thinking particularly of 4'33". So, I guess the 'him' part of that composition is the fact that someone sits at a piano in particular, rather than say... bagpipes or even pipe organ. I wonder if it would be considered satire or a derrivative work on ukelele choir...I wish he was alive to ask him his thoughts on this.
Horizontal means owning everything at the same level. So things like making mobile and server CPUs or acquiring competitors. Vertical is selling CPUs and computers.
GPU's don't have branch prediction, so that's nice.
It is not that simple. When a city builds offices without providing housing they are effectively forcing housing as well as infrastructure onto neighboring cities, while keeping the revenue from the office buildings. In my opinion this demonstrates that cities are too fine grained of a decision level for all regulation of housing supply.
When you reboot your EC2 instance, that VM is provisioned on a (patched) system.
> Our results provide a platform for the study of higher-dimensional topological physics.

... whoa!
A practical quantum computer would be capable of breaking almost all modern public key cryptography.

There's an entire field of research dedicated to figuring out what we'll replace those algorithms with if quantum computing does become practical on a significant scale: https://en.wikipedia.org/wiki/Post-quantum_cryptography
Losing some work in exchange for a large discount is still a good trade though. It's a non-goal to provide 100% efficiency :).
"Anything I don't understand is a threat."

Yes. Something you don't know about can and may well kill you. These are the lessons of geography, astronomy, and physics. Crypto and computer security may well have the same properties.
> it's just that people wanted to see Uber fail, and that's why he's become the sacred cow.

The sexual harassment did not come out because people wanted to see Uber fail. People want Uber to fail because it came out, and the extent of it.

Extent is a very important factor. This was not "a person was sexually harassed once at a company", which does indeed happen at many places. This was a larger pattern and intrinsic problem. You're downplaying that by insinuating that all of this is because there was a target on Uber's back. There are good reasons people want to see them fail.

> I'm saying a lot of the things Uber was accused of was something that EVERY other company does. You just aren't aware of it.

Um, no. There are some more common than others, sure, but few companies were as bad as Uber was. Every company does not steal IP from other companies. Every company does not create software to evade law enforcement. Every company does not pay hackers to delete data. Every company does not hire psychologists in an attempt to manipulate drivers. The list goes on.

You can argue that Kalanick deserves credit for his idea and perhaps even the overall effects in a utilitarian argument, but sweeping under the rug the bad reveals your bias very quickly. All of your posts on this thread are basically trying to defend him directly or indirectly while adding in a clause basically saying "well he wasn't perfect". Let's not erase the bad because he may have done something good, just as we shouldn't erase the good.
Maybe we could develop in more efficient languages with more efficient frameworks so that all the pressure to improve performance doesn't land on the hardware side? Or we could say developer time is more important and keep pumping out electron apps, leaving intel to continue pushing the boundaries of physics.
Mr. Stallman, is that you?

---

One more reason Google sucks:

Google recently deleted hundreds of videos of the war in Syria. Potential evidence of war crimes erased. Original uploaders may be dead.

I don't think some tech people realize the consequences of their decisions.
Much of modern crypto is based on the assumption that integer factorization and discrete logarithms are difficult problems. With quantum computers, this is known not to be the case.
Does anyone have experience developing packages for OpenWRT/LEDE... && is willing to offer some time (maybe an hour or two, whenever it's convenient) to a fellow HNer who's getting ready to attempt developing my first OpenWRT package?

I've got pretty entry level ambitions: I plan to created a utility that allow the user to configure a list of scheduled SSID names for automated SSID changes. I use to do a lot of tech support for the bar & restaurant scene, and always wanted to schedule the public WiFi SSID to change daily and broadcast marketing info. (Think restaurant daily specials, retail store popup/promo coupon codes, estimated wait times, deal of the day, etc.)

Or, is anyone aware of this feature existing in a commercially available device&firmware?
It's definitely a possibility (not sure how likely though).

"In the comments section of the Antonoupolos’s talk, reddit user @cfromknecht explains that there are flaws to the Elliptic Curve Digital Signature Algorithm (ECDSA), and it is very possible that quantum computers will be able to work faster than the transactions, therefore beating the encryption. “Whenever you spend bitcoins, you must include a signature that approves the spend, which is done using ECDSA” they explain, “If these signatures can be broken faster than transactions can be confirmed, an attacker could sign a different transaction that spends your coins before the original transaction is ever accepted.”

https://edgylabs.com/quantum-computing-hacking-blockchain
Please please please convince someone to invest in your documentation. Your services could be great but people will never know because the documentation is either poor, spread out across multiple seemingly unrelated pages, or non-existent.
The patch for Meltdown (CVE-2017-5754) for High Sierra, Sierra and El Capitan was contained in these security updates from December 6: https://support.apple.com/en-us/HT208331
On their specs page[1], there's a row in the table for the instruction set, which is "x86 and x64(64-bit)".

1: http://en.zhaoxin.com/ZXC.aspx?seriesid=3
fruit flies are used in research because they are relatively simple, well-studied stand-ins for a larger class of organism.

having a super minimal reference implementation of a complicated subject makes it easier to learn, and easier to build on in a way that will be broadly understandable way. it's a communication tool
Probably, but correlation isn't causation and no group deserves to be judged by its worst constituents.
You’re underestimating the current oligarchy that exists. That’s why net neutrality is dead. You’re right, it’s not intrinsically true, but it’s pretty damn close to it...

Side note: big companies generally die because they don’t take a real threat seriously, and by the time they do, it’s too late.
They aren’t trying to obscure, they’re trying to be a moving target.
Just let me fix a few words, for science:

> There's a long history - I suppose it's a tradition - of composers claiming copyright on someone else's work and sending DMCA takedowns automatically

That's how absurd it has become.
> The picture of taxi owners as powerful doesn't at all match what I know. It's a shibboleth promoted by Uber.

You should read this then - https://priceonomics.com/post/47636506327/the-tyranny-of-the....

You may be confusing taxi drivers with taxi companies owning and selling medallions for hundreds of thousands of dollars. Taxi drivers have traditionally been thoroughly exploited from having to either put all their wealth at risk from buying an overpriced medallion, or through having to work the first x hours a day simply to break even from mandatory fees. Ask a former yellow cab driver in NYC who converted to Uber to understand which company treats them better.
Then who exactly are these people who vote this? Seriously curious.
Comm'r Rosenworcel on Release of Net Neutrality Repeal [pdf]
I have actually done a number of sweatshirts for my family and friends with this and it's a pretty great machine. If you've never done embroidery and want to start with a cheap and capable machine, I can vouch for this one. It's also a pretty solid sewing machine that I use a lot for fixing my kid's clothes or working on Halloween costumes, etc.

I've been personally using the SewArt software (paid $75) with Wine emulator on my Mac and it miraculously works. I'm looking forward to trying out this Inkscape extension, the SewArt stuff is hilariously bad while simultaneously being one of the most expensive software licenses on my computer.

Fun fact, this machine has 476KB (kilobytes!!) of memory to hold these designs, which is smaller than I thought possible for consumer hardware in this day. How do you outfit a machine with a USB connector and then put 400k of memory on it? Also fun, your PES file sizes can't be more than around 40k.
This announcement makes me wonder - Are there any banking laws to protect someone who loses money due to a hack?

The JS thing is a huge deal so someone might get their online banking credentials stolen and then account emptied. In which case, how helpful are the banks in helping to recover the money?

On the cryptocurrency side people need to secure their own money and ensure they don't open some shady ICO site. So stolen credentials means the money is gone forever.

Edit: FDIC insurance is applicable for the banks ie if the banks get hacked. The question here is on individuals getting hacked. I am not able to find if FDIC covers that.
FYI when you patent something, it becomes public. Trade secrets keep it that way.
Also audio.

Linux audio is pretty disappointing. It took me hours of googling and mucking around to get surround audio over HDMI working for my ubuntu HTPC.

I ended up having to completely disable PulseAudio which means there can't be any desktop sounds at all, but at least the audio works in surround from Kodi now.

Also every time I do an update I need to reinstall Nvidia drivers. Which might also break the fragile audio over HDMI setup, who knows?
no, it would not be silence. I don't mean to be all snooty here-- but since we are talking about it-- it would be whatever sounds occur during that time. He was inspired by those Rauschenberg paintings ( that appear to be blank canvasses, and are but are functioning as shadow catchers- real-time spontaneous art framers, if you will)- same with 4'33". It's about whatever happens in that space in that particular moment. It is a kind of unconscious spontaneous group improv, sort of. Interestingly, improvised solos over tunes aren't copyrightable- bandleaders ripped them off players all the time.
They apparently read 100 books in a single year. How does one accomplish that? I think the most I've ever managed to read was two books in a single week. That was light reading though and I was traveling with lots of downtime.
Uh uh. Nope. Not gonna fool me this time!

IIRC I have only been Rick Rolled 2 or 3 times. You had to have Navy SEAL level of discipline during that year or two.
It is scaling out much better now thanks to large number of iPhones and watches sold. It is very difficult to do this on the scale of desktop computer sales.
And what happens to that RAM when an instance is terminated. Is it zeroed or does the data linger until it is later overwritten by another process? Or maybe that's what you're referring to?
Dupe?

https://news.ycombinator.com/item?id=16071813
It's not a precise standard, the exact boundaries of "creativity" would be left up to a judge to decide in a case where it was truly ambiguous. I'm pretty sure that this specific case would count as a minor modification to a work in the public domain, which does not qualify.

https://copyright.uslegal.com/enumerated-categories-of-copyr...
If anything, I'm invoking the mystery of mathematics. Here is a list of unsolved problems in mathematics:

https://en.wikipedia.org/wiki/List_of_unsolved_problems_in_m...

Seriously though, I'm talking about something qualitative here. When I read about these side-channel attacks yesterday I had this crazy gut feeling about how exposed our technologies are to those who learn to understand them deeply.

There's an complementary kind of arrogance to the one you're suggested: "anything I don't understand couldn't possibly be a threat... since I could never easily exploit it, it'd be way too hard for someone else to."

But have you listened to the radiolab about the z-cash cryptography ritual? It's very enjoyable and has a spooky surprise ending:

http://www.radiolab.org/story/ceremony/
Would the FDIC cover losses?
There seems to be a good deal of info in the README: https://github.com/cretz/asmble#compilation-details

I haven't dug deeply but it seems from the documentation that the project is trying to do things the 'right' way (mapping instructions to JVM bytecodes at a low level)... as opposed to, say, trying somehow to compile to Java code.
In the end, how will this differ from a Java applet?
>Perhaps the 'real people in the real world' would be offended and stop using Uber if they knew of Kalanick and his team's doings

I haven't stopped using them. But then, I buy Apple products manufactured with suicidal slave labor, use fossil fuels in my car, eat meat, etc. I suspect you probably do plenty of things that are someone else's pet issue too. WRT Uber I have some minimal faith left in "the system" that whatever legal issues need to be taken care of will. In the meantime, I will continue to use products and services that provide a good value in my life.
Yes, they would have been better off leaving out this "cycling" bit altogether.
From the rest of the article, I assume he listens to a lot of audiobooks while exercising.
Last I checked: the linux kernel initially had a comment saying something to the effect of "assume all x86 processors are vulnerable." Later, they added a check for amd, which they don't do mitigations on. It seems likely they'll add another check, when future processors come out. As for windows and macosx, it's up for speculation. No other OSes yet have mitigations in place.
I suppose it would only make the stock price rocket if it wasn't decided in some class-action suit that Intel has to replace the CPUs for free.
> Sure, but who's to say over the counter purchasing of marijuana isn't medical by definition?

In the first instance, the Department of Justice.

If people disagree, it becomes a dispute in the courts as people try to rollback the DoJ’s actions.

I’ve pointed out that this argument is available in another subthread, but you really don't want to be in the position of having to make it: https://news.ycombinator.com/item?id=16075569
Money in banks is FDIC insured. I believe that protects it from things like hacks, even if the bank itself went bankrupt.
no, it isn't, because that piece is unconscious- it is meant to be what happens without any intention. A crank up to noise is a definite intention of the performer. In 4'33", the performer does nothing but open the score and the keyboard, mark movements, and bow at the end.
I'd hope that Amazon would zero out that RAM first, since whoever uses the machine next could always dump /dev/mem.
An interesting related video: Slow Motion Flipping Cat Physics [1]

[1]: https://www.youtube.com/watch?v=RtWbpyjJqrU
If you're going to ignore compatibility anyway, you could also use good crypto. The JWT doesn't define what "Recommended" and "Recommended+" means but apparently RSA+PKCSv15 is Recommended+ so I guess it means "crypto known to be broken in the 90s".
Like so.

* http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect... https://news.ycombinator.com/item?id=16064545 (https://newsroom.intel.com/news/intel-responds-to-security-r...)

* https://news.ycombinator.com/item?id=16072368 (https://newsroom.intel.com/news-releases/intel-issues-update...)

* https://news.ycombinator.com/item?id=16067245 (https://www.amd.com/en/corporate/speculative-execution)

* https://news.ycombinator.com/item?id=16068118 (https://developer.arm.com/support/security-update)

* https://news.ycombinator.com/item?id=16072912 (http://blog.dustinkirkland.com/2018/01/ubuntu-updates-for-me...)

* https://news.ycombinator.com/item?id=16071769 (https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...)

* No headline, although mentioned at https://news.ycombinator.com/item?id=16074531 and elsewhere (https://www.freebsd.org/news/newsflash.html#event20180104:01)

* https://news.ycombinator.com/item?id=16076660 (https://support.microsoft.com/en-gb/help/4072699/important-i... https://support.microsoft.com/en-gb/help/4072698/windows-ser... )

* https://news.ycombinator.com/item?id=16075348 (https://support.apple.com/en-gb/HT208394)

* https://news.ycombinator.com/item?id=16076175 (https://lists.debian.org/debian-security-announce/2018/msg00...)

* https://news.ycombinator.com/item?id=16076328 (https://lists.opensuse.org/opensuse-updates/2018-01/msg00000...)
http://www.telegraph.co.uk/culture/music/rockandjazzmusic/35...

You were saying?
I've encountered this, with great unhappiness.

I have a theory that this heavily relates to the feedback loops and signals in play. New features are positively observable and their impact is observable from release onwards.

When defending against unknown unknowns, security is unobservable. It's observable only in its absence. All that's left are heuristics and synthetic signals like pentesting.

I wrote a multi-thousand word essay on the topic, but for an internal audience. I don't know if I could properly share it.
2018 new year resolutions to thrive in the Algorithmic World – Part 2 of 3
Ask HN: Why are Meltdown and Spectre being linked in the press?
Graz University of Technology, Google, and the rest have disclosed Meltdown and Spectre as a packaged deal and the media is treating them as such. Meltdown is a long-standing, exploitable Intel-exclusive hardware defect, whereas Spectre is an exploitable concept common to many vendors' processors.

Why are these issues being coupled when they are completely separate things? Is this a case of Intel being "Too Big to Fail" requiring Big Tech and the media to circle the wagons and provide them cover?

Personally speaking, I have hoped for a Meltdown-style exploit to emerge that forces Intel to switch focus from feature creep to software quality, formal verification, and removing the entire ME feature set from consumer chip offerings.

At the very least, I was hoping an event like Meltdown would usher in a "Snow Leopard-esque" generation of Intel chips that focus on quality/polish and not new features, process improvements or GHz bumps.