skysight-inc/HackerNews huggingface dataset:
Web browsers are potentially easier to protect, as I understand it. You prevent javascript from getting access to high accuracy timers and rate-limit their access to syscalls. If a script is repeatedly calling methods that trigger a syscall thousands of times a second, just slow it down a little and the attack becomes impossible.
> they also have very little chance of happening in our economy

Not if policymakers are judged based on GDP figures, in which case they will have an incentive to encourage these sorts of transactions to happen.
Well my group and others are toying with applying RNNs to permuted SMILES strings; if it ends up being better, we will find out some time this year.
I would not at all be surprised if Spectre and Meltdown were already known at nation state level, they have a lot of resources to throw at problems like this. The fact that Google provides this service for free is an amazing counterbalance to that kind of power, the bugs don't magically disappear but at least the playing field has been leveled a bit.
In general, you are right. But in this particular case, char-CNN is the standard used by many people, Stanford included. It is not sophisticated at all.

Look at the big list of exotic models they tried: http://moleculenet.ai/models

For me, this omission is a negligence. It is selective laziness.

The author (me) does not have 20 PhD students, postdocs and startuppers under his hand, to do the job for Stanford. With my limited resources, it is more cost-effective to do my job against Stanford ;)
"Blocking a world leader from Twitter or removing their controversial Tweets, would hide important information people should be able to see and debate."

I actually agree with this.

"We review Tweets by leaders within the political context that defines them, and enforce our rules accordingly."

Certain world leaders have sometimes posted tweets that would likely get anyone else banned. I would prefer Twitter to be more explicit about what they're doing -- namely not enforcing rules against hateful and abusive content when exposing such content is seen a net benefit.

If Random Q. Person posts something that's abusive enough to violate Twitter's rules, there's no particular benefit in allowing that content to remain. If Powerful Famous Person posts the same thing, there's arguably substantial benefit in letting it be exposed.

On the other hand, applying the same rules to both would also be a valid policy. I merely suggest being a bit clearer about what those rules are and how they're enforced.
wake up nasa is fake.
all staged during dive flights and the rest is hollywood greenscreen, wires etc.

https://www.youtube.com/watch?v=bRIFj0x1qvs
One could sell administrator bot to all the universities and other large organizations for a small fraction of a human admin's pay.

What should we do next administrator bot?

continually envisioneer goal-oriented initiatives
Phoronix is doing a ton of very thorough benchmarking for a variety of software. So far just on Intel CPUs but he will surely get to AMD too.
Per capita GDP is considerably higher for the US than everywhere in Europe except for a few small nations. Norway and Switzerland primarily.

It closed out 2017 near $59,000 for the US. That's nearly 70% higher than the European Union's GDP per capita.

Germany is around $42,000. Austria $44,000. Finland $43,000. Netherlands $45,000. Belgium $41,000. UK $40,000. France $38,000. Italy $30,000. Spain $26,000.

Denmark and Sweden get the closest otherwise at $54k and $51k.

To put it into further perspective, France, Italy, Belgium, the UK would be among the poorest US states on a GDP per capita level, comparable to West Virginia and Arkansas.

The US problem is allocation of resources. $200+ billion should be chopped right off of the military budget and redirected to infrastructure. Another $100 billion could be redirected for infrastructure by altering war on drugs / policing policies.

$300+ billion extra per year into US infrastructure would result in the US having among the best infrastructure on the planet.
At least in the case of Cortex A-7, there's about 2-3 cycles (maybe 3-4 instructions with dual-issuing) before a branch mis-predict causes a pipeline flush. You can maybe fit a couple of loads into that time, and maybe one of them will result in a Dcache fill. Other in-order cores in the Cortex-A line have similar Dcache side-effect under mis-predict. It's not clear whether this actually leads to speculated Dcache fills, though.

So it's possible that some of the Raspberry Pi versions are in fact vulnerable to (much weaker versions of) Meltdown and Spectre.
Sure they do, by virtue of creating the laws that they then adjudicate and enforce, the state has the authority to legally determine what is creative, at least in the legal sense.

It's likely that your "creative work" will need to be similar to other forms of creative work in order to enjoy that status. Either that, or you need to earn a reputation within a creative community as a person how pushes the conventional boundaries.

In other words, randomly generated sounds are not widely considered to be creative in the conventional sense. So, unless you become the next deadmau5, it's unlikely that a court would rule that your random noise is considered art.
Sap
Agreed, except 'sensible thing' was a very slow thing for Intel architecture - a lookup to determine if the address was allowed.
Computer security has been ridiculous for quite some time. Your only chance is tons of layers and early detection that something's not OK. I'm really happy that everything that's happening is happening. Sad that things like Cloudbleed got so little attention outside HN-like circles.

I'm happy because it's gonna have to change. Whole stack revisited. Eventually. These things speed it up. On the long run, the thing that holds most value, in my opinion, is information. Not physical things, not energy, information. Bitcoin is a big step in that direction but I don't just mean cryptocurrencies. If you can't keep your information secret the value is destroyed.

I see two paths. One, we do a huge refactoring of how do we do computations. Super clear assumptions and provably building simple layers on top of that. I'd like that. The other one is that we keep this whole messy legacy. And security will become based on more and more layers and heuristics. Which would eventually become AIs competition. Brr.

Just some random ponderings, I'm not a security expert.
This video on the use of Finite State Machines in the context of React/JS may be of interest:

https://www.youtube.com/watch?v=VU1NKX6Qkxc
Also a handy memorable password generator!
rapidiously fabricate standards compliant experiences

This sounds like a goal bullet on any bank password requirements “feature”.
Wow! ... That is just awesome!
This reads like an updated version of American Psycho. Love it.
Databreach of the #Aadhaar biometric system poses a risk for 1B residents
GDP does not have to be accurate to be useful, it just needs to be consistent for comparison.
Without accountability, how would you combat hidden backdoors in code? Doesn't accountability reduce the risk for hidden backdoors?
Right - things that were not tweets:

* Mocking the parents of a man killed in action serving his country in the military.

* The "grab em by the pussy" tape.

* Racist comments about Mexicans.

* Mocking a disabled reporter

* 'Both sides' about actual nazis.

* Having no knowledge of policy

* Constant lying

We don't need twitter to tell us that he's unfit, unhinged and incapable of doing the job.
You'll get targeted through a web ad which will then install a BTC miner on your machine, so your performance will be shot anyway.
Nobody is arguing that GDP always fails.
I meant rendering tikz diagrams[1] using js/canvas tag. It's used commonly in math textbooks typeset in LaTeX.

[1]: https://www.sharelatex.com/blog/2013/05/28/How-to-draw-Vecto...
Not if you're just trying to avoid a bubble in you pipeline and not actually executing the opcodes speculatively. In this situation the code will be loaded (and probably decoded etc...) but not executed before the CPU made sure that the branch was actually taken. If it's not the pipeline is flushed and a bubble is introduced after all. It's not as efficient as executing speculatively out of order but at least if you predict correctly you avoid the cost of stalling the CPU on every conditional branch until it's resolved.

ARM also has an other trick for that, every opcode in the (full, non-Thumb) instruction set has a condition code that can let you execute an instruction conditionally based on the flags state without requiring an explicit branch. This way from the CPU perspective the flow of the code is linear, it's only late in the pipeline that the condition code is evaluated and the instruction discarded if it doesn't mach the flags. This way you're sure you'll never have a bubble no matter what, although the downside is that you end up fetching instructions that may end up not being executed so it's only worth it for "short" branches.
And "b2bm.io" is amazingly unclaimed.
Now you have exposed the magic.
A lot of the cheaper Pi-like boards also aren't affected for the same reason, as are lower-end Android phones. The articles claiming it affected every modern CPU were basically mistaken. It was an easy mistake to make, given that ARM's announcement only listed the cores that were affected and had a little note saying everything not listed was unaffected by both Meltdown and Spectre. (There is precisely one ARM-designed core that is affected by Meltdown, a high-end one so new that no chips based on it have been released yet.)
> I always thought it was possible for a collective resignation of an editorial board but I've never seen it realized.

As can be seen in the Elsevier Wikipedia page, it has happened several times (not often enough). The Journal of Algorithms case is instructive [1]. Any individual researcher that "fights" the publisher will lose out, but collectively in a concerted move one can be successful.

I think Don Knuth provided enough credibility to transfer the prestige of the journal, and enough of a towering figure to give everyone the impetus to go ahead with the defection collectively.

It would be very interesting to examine cases where this worked successfully and where it failed (or wasn't attempted) and see what differentiates them. I'm pretty sure Elsevier is examining these cases very carefully...

[1] http://www.cs.colorado.edu/%7Ehal/jalg.html
It's just an index on the transaction id fields of the rows, so it should scale like any other index on the table.
I can say that I have never watched a video past where an ad tries to load. I never even see the ad; I exit out before the ad loads.

I view it as a bait-and-switch, and I refuse to support such (IMO, morally repugnant) tactics.

I wish that we as consumers had a better, more effective way to punish such adversarial tactics.
You would not send requests to keepass in order to leak passwords. Instead, you would try to setup the branch prediction cache in way such that during ordinary execution, keepass will causes cache accesses dependent on secret data b.c. of the code that is speculatively executed due to indirect branch prediction (you setup the branch prediction cache in such a way that it executes your "gadget" to leak things). So yes, assuming you manage to get enough control over the addresses of things in memory via javascript (may be hard, but there are known ways to defeat ASLR via javascript as well), I think you should be able to attack keepass even if V8 fixed it.
Because it's difficult. Sure, it's obvious in hindsight, but it's a flaw in a small part of a very large and complex system.
The total US GDP is higher because the US population is gigantic compared to typical European countries.

The US GDP-per-capita (adjusted for purchasing power) [1] is only somewhat higher than highly developed European countries.

Given the relatively small GDP gap, the differences you are seeing have to with different cultural and therefore political priorities around spending on public infrastructure and social goods like education and job training. Different as in less.

Also, a lot of the US pattern of production and consumption is based on premise of disposability (with the notable exception of some infrastructure built leading up to WWII).

That has an effect on the durability and perceived quality of the things you see and experience in the US.

[1] https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP)...
> you are paying for a compromise

Very good point. Apparently including at least one compromise that most people (probably including the engineers who designed the CPUs) didn't know they were making.
Yeah, for something like a modern x86 core, you'd need something like this.

https://www.cadence.com/content/cadence-www/global/en_US/hom...

It'll cost you ~$1M and run at a few MHz.
For the Mac Pro, definitely, a special case where they totally screwed up and had to be like, "don't abandon us! we still care about you, we promise!"
What are Meltdown and Spectre? Here’s what you need to know
It seems like in the case of Meltdown and Spectre, FOSS may have /everything/ to do with security. FOSS with the addendum that you don't execute arbitrary javascript, anyway.

In a world where personal computers only ran code the user could safely trust, these exploits would only be full attack vectors when applied to multi-tenant computing environments.

I'm not arguing that FOSS systems are inherently more secure than closed systems, but when it comes to exploits that require arbitrary code execution to be effective, Stallman really was/is right. Between a NoScript browser extension and a system whose source code is entirely available to you, you've basically got Meltdown/Spectre immunity.
The negative consequences of X is all of the known issues with obesity and an increased risk of diabetes. The negative consequences of Y is you have to cut back on sugar.

The consequence of Y (a healthier life and a decreased risk of diabetes) is well worth the sacrifices of doing X.

The gains of doing X is not worth the consequences of not Y (all of the health consequences of being overweight)

Is there any scientific literature that says consuming a lot of sugar is healthy for you?

If you could bet $50 and have a 90% chance of getting $500 would you take it? Would not betting $50 and having a 10% chance of not losing the $50 be equivalent?

Yes I realize the odds are exaggerated in the example above.
Does anyone know if the IBM AS/400 architecture is affected?

Edit: I'm referring to the System/38 architecture that used capability-based addressing.
You're pretending pen and paper doesn't bring another set of problems of its own.
Apple is really good about not pre-announcing new versions of existing products, but when it’s an entirely new product unlikely to cannibslize existing products, they are happy to pre-announce way sooner.
Wrote my own for 68xx and 65xx chips in ancient times.

https://en.wikipedia.org/wiki/Relocation_(computing)

If you have access to the symbol table it is an easy problem to solve, if you don't it can get quite difficult all the way to impossible if the original code makes use of tricks such as jumping into the middle of an instruction. But if the code is 'well behaved' then it can usually be done.

Many games used tricks like this to relocate themselves to memory that was otherwise not usable for programs, for instance to live in secondary screen space. This ensured the game would be wiped on reset. Crude but effective.
Oh man, cool to see this on front page of HN again. For convenience, here is the first part where its best to start: http://www.andreykurenkov.com/writing/a-brief-history-of-neu...

One of these days I'll finally get around to making a PDF version that's a bit more convenient to save for lengthy reading and not just a series of blog posts...
Thanks for this, seems appropriately cutting. The whole situation has put Twitter in a weird place, and I can understand why they don't want to cut Donald off, but it's clear that this post is just "We don't want to", but with a few paragraphs of spin. I wish they would be more honest about it.

Personally, I don't think it should be Twitter's responsibility to censor Trump. He has a way of shoehorning himself into public consciousness, and I think the public (especially the mainstream media) needs to self-censor and stop paying him so much attention. I wouldn't care if Donald tweeted whatever he wants, except that it always seems to end up in the news.
JavaScript and Functional Programming: Currying (Pt.4)
Service Ribbons for IT Vulnerabilities
Neat pic (after I figured out I had to zoom in to see the destinations). It's just missing the route from the Moon to Earth Intercept(/Escape). I'd also love to see these maps include routes to the asteroid belt from the Earth/Moon/Mars.
JavaScript and Functional Programming – Pt. 3: Pure Functions
Great, so we agree to some extent. And I agree that we are right to be proud of our special qualities. It's the assertion that humans are exceptionally special in any objective sense which I don't agree with, and which would require some super-specie value system to be logically valid. Religion or some similar belief can obviously be such a system, but I personally find such incompatible with what I can reasonably infer from established facts. I guess we can leave it at that.
And it's somewhat disheartening to see that even academics (who should be in a position to see what's going on) frequently can't come together to cooperate and be better off.
This comment is related to AI in healthcare services, not drug discovery specifically, but is illustrative. I recently went to a talk by a sr exec at one of the biggest health systems in the country. They were evaluating AI tools to predict which patients would die in 18 months so they could design the most patient friendly and cost effective end of life plan. None of the algorithms they evaluated outperformed simply asking a doctor which patients she thought would die in the next year
Correct, FPGA simulation of a 3.0Ghz processor means you'd be waiting on the order of weeks to boot into linux.

I work for a company that works with Intel on new things. Lets just say the FPGA's they use are... really expensive, and despite being capable of simulating a design fast, are still very slow.

By expensive I found out $20 million per FPGA simulator was on the low end. And I think that would simulate at the rate of about 10mhz for the amount of transistors/internal setup present.

Fpgas are cool, but a poor choice for fixing this issue.

You could probably do it for up to an 80386 with some $400ish dollar FPGA's.
I would say there is one difference, which is that you may or may not have data access. I've been traveling internationally for over 10 years now, and never had cellular data when I would travel (thanks ATT), and most airports would have wifi, but different subways/trains etc don't. And I've been in a situation of relying only on GPS and hoping the app doesn't shut down while I'm walking somewhere far too many times.

Google has improved here with their offline maps, but even then, it's not 100%.

I'm not saying that PT is worthless or that we shouldn't improve it, but IMHO, Uber and the like fill a very critical "last mile" kind of problem that I think pairs nicely in cities with public transportation.
I don't think that was the point of the parent comment. Obviously Stallman's system is not perfectly secure, but it may well be immune to exploits that require arbitrary code execution like Meltdown and Spectre.
The US is better, and it's worse.

Poster anecdote describes vet who has more leg prostheses than he is able to use. Article anecdote describes cost-cutting to the point that prostheses which adequately replace the function of hands for a quadruple amputee are considered a luxury. Compassion is a cost; cut it.

That makes a pretty wide range of outcomes. We even have a dolphin that has a state-of-the-art tail fluke prosthetic. I doubt it had insurance. If it did, I doubt it would pay out without a 3 tuna deductible, a 40 sardine co-pay, and a 15 sailfish lifetime maximum.

Do these insurance companies think we're paying just for our own sakes? Do they think we should breathe a sign of relief for not having to pay that $260k in increased premiums? Every one of us that's not a sociopath can empathize with the woman who got shot twice in the chest and as a result woke up one day not even able to pick her nose by herself. That could have been me! I, for one, love picking my nose by myself. And I am super pissed that the sole reasonable outcome to this story was achieved only through the wish-granting generosity of a passing fairy godparent.

Good for that guy in private life, but his day job is actually making more difficult several of the more reasonable paths to that outcome. What about all the people who will never get a fairy wish?

Nobody is ever going to take $260k worth of pity on people like me. I really need all this to be a matter of enforceable contracts or laws, rather than what charity may grow in the human heart. Any safety net based on that sort of goodwill simply has me-sized holes in it everywhere.
Open source is necessary but not sufficient for security. Secure systems are a strict subset of open systems.
I think that's the Google X mission statement
Wouldn't the value be calculated as whatever the government payed for them just like the rest of GDP? Maybe I'm misunderstanding how government spending is added to GDP but the fact that the amount spent on something doesn't always correlate to the value doesn't seem to be a problem unique to the government and hardly seems a reason to ignore what is in the US up to a few trillion in spending
Ask HN: When is it safe to upgrade to Ubuntu 17.10
This page still discourages "download of Ubuntu 17.10":

https://www.ubuntu.com/download/desktop

Do we know any ETA when this advisory will be lifted? Does this only apply to fresh installs, or are upgrades equally affected? I know I can click through to Launchpad tickets, but I was rather hoping for some clearer statement somewhere (the primary Launchpad ticket has over 400 comments to sift through).

I only recently moved to Ubuntu Desktop, coming from Windows (though having used a lot of Linux on servers). I'm on 16.04 now, but I'd like to upgrade. I happen to be using a Lenovo YOGA 710-15IKB laptop.
It is good but a bit unsatisfying as they are stingy on factories, handlers, proxies and singletons.
> I think the danger is that if you then give both A and B an incentive to increase GDP and tell them that the GDP measures wealth, then they will start paying each other $20, then $40, then $100.

Prior to the headline of this article, I've never seen the idea that GDP measures wealth as opposed to activity anywhere.

And I don't think anyone is going to be convinced that spending more money for no stuff and ending up with no more money in the bank at the end of the day is increasing their wealth, no matter what you tell them about GDP. In fact, I suspect the main outcome of what you suggest would be to convince people that you were wrong that GDP is a wealth measure (although people with a strong pre-existing belief that GDP does measure wealth might incorrectly be convinced that you just don't know what GDP means).
Not really same though. Forgetting about GPUs, packaging etc, aren’t we?
I still have my old MSI Wind U100 from 2010-ish. I was lately wondering what to do with it. It’s already running Mint, so I guess I’ll make it my main machine. :-)
> Seems kind of a bad design to rely on periodic full data scans.

Note that it's not full scans - only pages that have been modified since the last vacuum, or were in a state last vacuum that they couldn't be processed, are vacuumed again. So there essentially is a block-level index for this.

https://www.postgresql.org/docs/current/static/storage-vm.ht...
I wonder what will happen when you've 30 dimensions and you want to group by one of the 30 dimensions, then group by one of 30 dimensions then group by one of 30 dimensions. Is it possible to to do this stuff with counters?