skysight-inc/HackerNews huggingface dataset:
> In general, asking a database for set membership is not close to the slowest thing applications do.

From Jeff Dean's list of numbers every programmer should know[0], a round trip within the same datacenter takes on the order of 500,000 ns; a main memory reference is on the order of 100 ns. How often will an application be making an order of magnitude more than 5,000 main memory references to service a request? Sometimes, sure.

In our experience online validation completely dominates our workloads.

> I don't think it's a given that internal auth has to work the same way external auth does, for a bunch of reasons.

Oh, you're completely correct. It has upsides & downsides.

> Without revocation, you can't log out of things, and you can't invalidate sessions after credential rotation.

I pointed out that I like the use of stateless tokens, which can be revoked. In many cases 'log out' can just be destruction of the token. And in many cases it doesn't make sense to invalidate access just because credentials have rotated (in many more cases it does, which of course is perfectly supportable with stateless tokens).

> So unless you're saying tokens should be valid for some tiny number of seconds.

I'm not: I'm saying that in many cases there's no business need to assure revocation within $SMALLNUM seconds, and that the business costs of online validation utterly dominate the costs of running a service.

> If you really desperately want to make the check faster, why is JWT better than a local token cache?

There are only two hard things in computer science … cache invalidation is one of them.

[1] https://gist.github.com/jboner/2841832
you won't get global versioning, issue integration, PRs, etc..
I really don't need 32GB, but considering my 15" Lenovo W520 from 6.5 years ago has 16GB too what on earth has happened to computer innovation!?

6.5 years without a DRAM increase for 15" laptops is bonkers.

It was $1500 for the laptop, it wasn't even crazy expensive back then.

On top of that it even supported 32GB. All in a rather sleek 15" form factor. (6.2 pounds vs 2018 XPS 15 4.6 pounds).

Sources:
https://forums.lenovo.com/t5/ThinkPad-P-and-W-Series-Mobile/...

https://www.youtube.com/watch?v=Ih3rD2ccGkM
Gotcha, thanks. Based on what you know, I'd say pointers and stuff like memory layout are generally going to be where you have issues, and data structures are basically an exercise in applied pointers and memory layout. So you shouldn't feel bad! Regarding what you should do next, reading the last few chapters of the book (19 in particular will be useful for you) would be good; and chapter 20 is a project, which it seems like you are looking for. I can also highly recommend the new O'Reilly book as well.

> I was wondering if I am missing anything

Nope, I think it's just that your experience led you astray.

If I need a linked list in Rust, I... well, I don't ever use linked lists (you can read the book for why). If I had to, I'd use the one in the stdlib.

If I need a graph in Rust, I use petgraph from crates.io.

Basically, other people are good at writing data structures, so I use their work as much as possible. Only if I'm particularly interested in a specific structure, or I require one that doesn't have some implementation out there yet, do I try to write my own.

Of course, at some point you'll want to learn it, but it's just going to be frustrating until it clicks. The less frustrated you are with the rest of Rust when that happens, the less overall frustration you'll have.

> (maybe once I learn unsafe it will be easier?)

That's very possible. Often, you can take a C implementation and translate it into unsafe Rust. Many data structures use unsafe internally, and present a safe interface.

Good luck on your journey! I hope it all makes sense for you soon.
> “When I saw my private website addresses from Firefox being dumped by the tool I wrote, I was really shocked,” Gruss told Reuters in an email interview, describing how he had unlocked personal data that should be secured.

I wish I knew how to interpret this comment. Did he manage to output his own firefox memory using client side javascript? Or perhaps a local script running in terminal? or is it totally different and hes describing running a process on his own webhost that broke the vm container and printed out other hosted websites ip addresses?
My day dream for fixing Spectre is as follows: Basically double the amount of L1 cache (where the second half doesn't need to be as fast as actual L1 cache), make only the first half usable as cache. When an instruction the CPU speculatively executes an instruction which would replace the content in its L1 cache, first copy the existing content to the second, usually unused, half, and _then_ replace the content of the first half with the new data. Then, if the CPU decides that the branch was correct, just do nothing; if the CPU decides that the branch was incorrect, just copy back the "backup" of the original cache. Copying the cache to and from the "backup" would obviously have to be done really quickly with dedicated hardware, and not be done by going through each byte and copying it, but that should be possible.

Another solution I've thought of, which should probably be easier and/or cheaper: When speculatively executing an instruction, just don't write to cache at all. This would potentially make the speculatively executed instructions slower, but I can't imagine it would have a big effect.

Of course, both of those solutions would just mitigate this specific attack. You're probably exactly correct that timing attacks are going to continue to be a big problem.
DDR3 RAM was dirt cheap just a few years ago. I maxed out several of my systems.
I'm a fan of Anaconda, but conda sucks as a package manager compared to pip.
I would recommend looking at Singularity as well: http://singularity.lbl.gov/. Docker is not supported in the HPC world but Singularity is showing rapid adoption
These are results from starting with just a chord progression & stacking ontop of it:
http://signalsandsorcery.com About 5 months ago I decided to pivot & start with a melody & chords. I have not yet stood up the system that starts with chords & melody. So the answer is not yet.
The average user won't be doing this.

What sort of workloads are you running on your VMs? My VMs are typically provisioned for 512-2048MBs of RAM and given 16GB of RAM that's more VMs then I'll ever need running at once.
Ethereum Co-Founder Vitalik Buterin Withdraws 30,000 ETH to Bitstamp
From what I've been reading, none of the BSDs were notified.
There is already a mechanism to disable rdtsc in CR4, I don't know that it's used by anything though
In spectre, the victim process is coerced (via branch misprediction, in their first example) to speculatively access its own memory, resulting in side-effects that you can measure to determine the memory contents. No violation of memory protection needed.
The good numbers come from DMV registrations. There are industry sources which collect that data weekly.[1]

[1] https://hedgescompany.com/automotive-market-research-statist...
Pineapple is overkill. You can use any open-wrt device or Linux laptop with a card supporting hostap.

Just give it the ssid 'xfinitywifi'.
I learned to code in the era of 3:2 displays, and I don't miss them. I never code using the full width of my display. If your lines are that long you have issues. I also don't really need any more vertical space. On my 15" laptop and my 27" display I can see plenty of code at once. Having a few more lines on the top of bottom would not magically alleviate the need to scroll.

I'm all for people using the tools that suit them, but you seem to indicate that 3:2 is just flat out better and 16:9 has no advantages and it's just not the case. I like being able to do more things side by side.

It's personal preference like anything else. The reason 16:9 displays are now common is not because of movies. When they came on the scene most people said "Wow this is nice."
On that note: https://github.com/paragonie/past/issues/13

I might be dropping "seal" entirely, as its utility isn't really a good fit for security tokens. (Sealing APIs can be very useful in other contexts, though.)
Max 8gb for regular display...

I mean, who uses touch screens for development? I can't really imagine a scenario where it would be helpful for me. Maybe when doing work in Illustrator and Photoshop, but I usually use a different machine for that anyhow, because of Adobe's lack of Linux support.

I don't want to pay for something I won't use.

I am otherwise actively looking for a laptop.
System76 does not have European keyboard layouts, otherwise I would go with them.
Spaces. Your editor should convert the tab key to spaces.
I'm a happy XPS 13 9360 (i7-8550U, 16 GB RAM, 512 GB SSD) user and have mixed feelings about the latest XPS 13. Biggest reason why I opted for the XPS 13 is the size -- it is literally the smallest 13.3" laptop on the market.

My 2 cents based on the stuff I read online:

- The new one is even smaller and lighter, a big plus in my book.

- USB-C exclusively seems good and bad at the same time. Three USB ports on 9360 all charge my phone at different speeds (two USB-A, one USB-C): Android reports "charging slowly", "charging" and "charging rapidly" depending on the port, and I _love_ having the option of charging my phone slowly, as the battery loses less capacity over time that way (due to reduced stress and heat). I don't mind having USB-C dongles around, but it would be great if all peripherals moved to USB-C, therefore having a USB-A port would be convenient, despite USB-C being progressive and pushing the market to switch. I see it as a good intent on Dell's part.

- Dislike microSD port. SD cards are faster and cheaper compared to microSD and with the new laptop one physically can't fit an SD card in it. So one would have to use an SD -> USB adapter, which most likely has USB-A on the other end, plus a USB-A -> USB-C dongle. Ugh.

- 4K screen not really needed. Not a big difference on 13.3", uses more power and QHD+ on 9360 can use nice 2X integer scaling -- shady fractional not needed.

- Equivalent configuration of my 9360 costs more than 2000 USD, tax excluded. I paid ~1400 USD for mine with the tax included, a non-refurbished model.
I think the biggest "issue" with additive is that it can be complex to program at its most low-level implementation. I'm thinking of stuff like the K5000 where you could not only set the initial volume of a partial, but every partial had an envelope to control volume. Extremely powerful, but on more complex patches that's a lot of envelopes to think about.

On the other hand, "simple" additive with relatively few partials is actually pretty easy too. (The Hammond B3 and other tonewheel organs are essentially additive synthesizers.) A lot of software (your Alchemys and Razors) is built on a simplified version of additive too, or uses additive techniques to perform "resynthesis", or has other tools that "simplify" some of the additive editing.
> they probably figured out how to turn off the branch predictor.

:P I hope the fix is this crude... the performance drop would be hilarious, Apple would probably switch back to PowerPC by the summer.
I would argue that's a terrible interview, as anyone who's in the position to give a Rust job should know this about Rust.
Oceans suffocating as huge dead zones quadruple since 1950, scientists warn
Chromosomes don't stay intact like (it sounds like) jonsen is assuming. Instead they cross-over or re-combine to make never-before-seen strands -- the new strand has one end from one copy & the other end from the other copy.

There are maybe 2-3 cross-over events per chromosome per generation in humans, e.g. https://biology.stackexchange.com/questions/19005/how-many-r... .
> main takeaway should be "speculative execution creates exploitable side-channels, and you should assume your hardware is exploitable until proven otherwise."

Speculative execution does not create side-channels in and of itself, side effects of speculative execution does that. In this case the side effect of cache state. Just don't change the cache during speculative execution and there's no problem.
Wi-Fi startup Eero lays off 30 employees
the Intel 30% tax...err, patch, has been applied.
Mobile devices have low upload bandwidth and will be mostly useless as relays.

If you want to contribute, lease a server and run a relay on it.
So, hold on, are you volunteering to pay for more people to be sick and disabled because we decided it just wasn't worth it to cure their illnesses?
List of Top 60+ Podcast Submission Sites to Submit Your Podcasts
"The iMac Pro isn’t running iOS apps"

I always find this kind of remarks funny because iOS is essentially a specialised strip down version of MacOS. So basically any accusation of MacOS copying iOS , however exaggerated, is an accusation that MacOS is copying itself.
> extra effort of writting FFI bindings to Android native APIs.

Does bindgen not work here?
Check out Yhat. They were a Ycombinator alumni, and they offer that service. They were purchased by an enterprise software company called Alteryx, due entirely to the technical excellence of their product.
> It's mostly inelastic. People don't buy resources unless they need to do work.

I work on a system (at Google) with significant hardware cost. Fundamentally, the work my system is doing needs to be done. But the time we spend improving efficiency is hugely elastic. I look at a CPU profile or request flow, have an idea to improve it, look at how much machine resources we're spending, guesstimate how long it will take us to implement and maintain, and use a chart to see if my idea is worth my team's time or not.[1]

If the resources get more expensive or simply impossible to acquire,[2] we'll optimize more.

[1] There are other considerations (will it make the code more complex, thus increasing risk of a security/privacy flaw? what about opportunity cost given that it's hard to hire more engineers and scale a team?) but that's a reasonable mental model.

[2] There's a global RAM and SSD manufacturing crunch already, and if lots of CPUs are replaced due to these vulnerabilities or simply are no longer enough, that's gonna be a big crunch as well. If you're one of the few biggest cloud providers, I think you can't just replace / add tons more hardware than planned without dramatically increasing the price per unit for everyone.
I'm an independent consultant: the "company" is me. And I think stickers look silly.
This misses the point. A $10k drone can probably take out a $12 drone, but you need to be armed to take out the bigger threat, because you don't know whether the drone any given defensive drone will try to take out is a $12 drone or another $10k drone with defensive capabilities of its own.

That's the point of this scenario: Deploy a bunch of cheap junk, in between a handful actually dangerous ones. If you knew they were all just $12 drones you'd hardly even need a countermeasure - they'd fall down after not that many minutes flight.

The point would be to force the defensive force to commit far more resources than necessary.

> and do it more than once.

Yes, but the problem is you need to scale for peak load. If someone sends 1000 drones after you spread around your perimeter and it'll take those drones 5m to target, you need to have enough to intercept and destroy all 1000 in 5m. Sure, you can reuse many of them - next time your adversary may up the attack to 2000 drones, and see if you still have enough to kill them all.

> Besides cheap drones have low range and low speed, it will be hard for the perp to get away, or even get close enough in the first place.

The $12 drones in question have wifi and transmit hd video. You can get suitable SOC's with dual wifi chipsets and relay connections quite easily, and some of those cheap drones also have proximity sensors good enough to be able to add tolerable flocking behavior. Judging from the stability of automated takeoff and "return" functionality on the toy drones I've tested, we're not long away from having the ability to have them do unaided flight. Not least because the toy ones do not need to reach a specific target: Flying erratically is not a problem. They just need to cause fear. Speed is also less of an issue if your intent is to spread fear - you can fly drones low over locations where a defender does not dare use too drastic interception means for fear of causing more harm than they prevent.

Besides, the most likely use for this type of thing are in situations where some desperate group is fighting a state actor and losses are high anyway. It doesn't make it worse.

> Non-state actors are very limited in budget. They might catch some targets off-guard, but it’s not a game changer.

I think it is, exactly because they are very limited in budget; the terror you'll spread with a $10k explosive device + $10k worth of drones aimed to make the response more expensive is likely to be far greater than what you'll achieve with 2x$10k explosive devices, and the chance of actually hitting anything of value can likely be made higher. E.g. look at the rockets regularly fired by Hamas - it's rare they cause much real harm, because they're basically unguided; they're mostly about fear. For that kind of scenario, the ability to get people to fear the buzzing of a drone because they don't know if it's a $12 toy or a $10k bomb would definitively be a game changer.
For me, that's basically the Alienware 13. With the discrete GPU off it seems to get 4-5 hours (at least, according to my brother, who owns one) and that's good enough for me, while also having 32GB of RAM and a 7700HQ.
No. This is a simple message board, a news aggregator. If you add features to make it more than that, it turns into a social network and all the drivel that comes with that.
But it's your own transactions.
Javascript is theoretically fixable -- what's needed is less fine-grained timing capabilities. I think it would be very hard to completely eliminate the possibility of controlling speculative execution as long as you can predictably invalidate the CPU branch predictor, which can be done even at a high level with if statements. Unless you get rid of the notion of contiguous arrays (making predictable word-aligned cache manipulation nearly impossible) and potentially remove the JIT completely in favor of an interpreter, it's hard to completely be rid of this class of an attack when executing any sort of code on the processor. Those steps are probably possible, but the JS performance hit that ensues would be the death knell of any browser.

That said, without some way of extracting timing at the granularity of 10s of instructions, this attack is moot. So that's likely going to be the mitigation. Unfortunately, the web frames used in some apps are infrequently if ever updated, so JS engine updates there are gonna be hard.
JSX works great with Mithril.
These patches should only affect syscall entry/exit performance. So if you're not doing things that do enormous amounts of syscalls, you should be more at the 3% end of the scale. The 30% number comes from doing things like calculating the file sizes of a directory with a lot of very small files, where the performance overhead of a single syscall matters. In most performance sensitive applications like games, you probably won't see any syscalls in a hot loop since that'd be too slow anyway. Even if you're doing heavy IO, then that is most likely also done in batch and blocked on disk IO speed, not on syscall overhead.
Thank you! This is a very simple clear explanation of why I should use swap on my system!
Depends how much are you using this. Looks like right now, for k80+4cores/15G of ram, you will have to pay $0.26 per hour.
PC with 1060 would run you probably less than 600USD, so ~100days of using VM 24/7, excluding network traffic on one side, and power consumption on other (although, latter should not be that much when looking at the whole cost).

And you will still have pretty powerful PC at your home for everyday use/gaming
IIRC uCode updates are volatile. You re-install them to CPU on every boot. OS actually does this for you.
Using a thread to keep mispredicting as desired is just one (though faster) possibiliy. It can be done in single threaded mode as well.

Also doing that on purpose would again worsen cache performance.
Dear Intel, dont worry, this will be court tested.

And btw, did you notice that huge amount of people disagrees already with you, simply putting your stock 8% down in two days?
I agree this is a big gap in the curricula; "engineering chops" (managing servers, environments, etc.) is what I've seen be the biggest force multiplier for data scientists (esp. at non-huge orgs), not how good at stats they are or how fancy a model they can build.
Computación cuántica, una introducción rápida
As memory serves that was exactly how the hypervisor on the PS3 Cell setup worked.
New NASA mission will explore key zone between Earth and space
Computación cuántica, circuitos cuánticos
> Beyond the thirteen countries above, there is a much longer list of countries where the 9370 is available offline. (I’ll be posting this list in the next few days.)
Decentralized tools come at the risk of being harder to control? Lol I think we all know where Mark "dumb fucks" Zuckerberg comes down on power and control. There is something to this however since he is acknowledging it's a problem. Look for some big tech players to roll out more "decentralized" tools that still quietly give them various control and backdoors. Decentralization is a movement and the power brokers are getting in front to blunt it's effect.
The proper selfish thing to do is lock all of your pages immediately after allocation.

https://linux.die.net/man/2/mlock
Scalable+APIs+are+Built+From+Consistency
I have perhaps a controversial opinion:

If you want a position where you will be working on real things and want lots of input from a senior person, then that probably means them spending at least 1 hour per day working with you directly. That’s about 140 hours over 7 months. At a company cost of $200/hour (minimum in NYC) for a senior developer, this translates to $28,000 of company cost.

Why would a company agree to $18000 out of pocket cost in your scenario vs $28000 in an unpaid intern position? I posit that, perhaps, the type of company that would cover $18k cost but not $28k may not be the type of company you want to intern with.

Personally I wouldn’t want to hire someone in this way. I’d rather real internship or no internship because I’d be concerned about mixed messages.

Have you considered a change of location and finding a real internship?

Also remember all this is free internet advice. You have no obligation to agree with any of it.
As absurdum, so that they could advertise the home being more efficient, faster to heat and less wasteful of the lucky phenomenon peculiar to their furnace design for running beyond the specification so instead of overheating one room, or expensive distribution, the furnace gets you really quick hot water and the excess energy isn't wasted, so compared to fully internally insulated homes, the benefits just keep adding up, e.g. installing plenum cable would be inefficient because this system dumps the excess heat quickly through the house, the ability to convect nicely preventing past occurrences of furnace fires. To be the most efficient inhabitant (kernel process) Intel recommends you enter and exit the over and under heated rooms frequently to manage your body temperature. This design is excellent for your hyperactive residents, please refer to our release notes for the use of rooms either exclusively or during long operations such as Netflix consumption.
But not in nearly as many emvironments as we can today. We can assume, over time, life learns to live under absurd conditions; but its hardly safe to think it can start in those same conditions.