skysight-inc/HackerNews huggingface dataset:
This is my understanding, please correct me if wrong:

There's a basic class of bugs (let's call it Spectre-class) that's about exfiltration of memory contents via side channels introduced by speculative execution. Basically every processor that can speculatively execute code (i.e., every modern one in the past two decades or so) is potentially vulnerable.

Of known Spectre-class bugs, one (Spectre) relies on branch predictor tables. All tested CPUs (ARM, AMD, Intel) were vulnerable to Spectre. The other bug publicly announced (Meltdown) relies on when the #GP(0) exception actually gets thrown and is specific to Intel CPUs. The fix for Spectre is to basically banish branch prediction, and the fix for Meltdown to is to unmap kernel pages when in userspace code.

Beyond these two bugs, there may exist other Spectre-class bugs specific to different architectures/vendors that are not yet thoroughly investigated.

What did I get right and wrong?
The quote you have is for exploiting Variant 2, the post above yours was talking about Variant 1. For Variant 1, the authors say:

To be able to actually use this behavior for an attack, an attacker needs to be able to cause the execution of such a vulnerable code pattern in the targeted context with an out-of-bounds index. For this, the vulnerable code pattern must either be present in existing code, or there must be an interpreter or JIT engine that can be used to generate the vulnerable code pattern. So far, we have not actually identified any existing, exploitable instances of the vulnerable code pattern; the PoC for leaking kernel memory using variant 1 uses the eBPF interpreter or the eBPF JIT engine, which are built into the kernel and accessible to normal users.

For Variant 1, the "vulnerable code pattern" they're looking for has to be of a very specific type, it's not a run-of-the-mill gadget. It has to load from an array with a user-controlled offset, then mask out a small number of bits from the result and use that as an offset to load from another array, where we can then time our accesses to that second array.

However, they also go on to say:

A minor variant of this could be to instead use an out-of-bounds read to a function pointer to gain control of execution in the mis-speculated path. We did not investigate this variant further.

Which seems much less reassuring.
So what? They owe Apple nothing. They owe you nothing.

Unless you are taking requests from random HN commenters for software that you would like to build them for free, I suggest you rethink your suggestion for highly skilled researchers to donate charity labor to the largest corporation in the world.
Do you need root or comparable privileges to take advantage of BPF? I did not think that was the case. My understanding was that BPF code executes within the kernel.

BPF is employed by the `bpf()` syscall for socket packet filtering, as well as by `seccomp` itself for its syscall filtering. Is this threat vector not available to untrusted processes?
Yes, sort of - I don't think he has the evidence to claim that a competent CPU engineer would have done things in a certain way, because all the really theoretically good CPUs (and I count Transmeta among them!) seem to have not succeeded in the market nearly as well as the messy, awful ones, and a CPU that no longer exists doesn't actually count for anything. A competent CPU engineer is balancing lots of tradeoffs. It might be the case that he's right, but in the absence of evidence I weakly believe he's not, and I strongly believe that he's not in possession of strong enough evidence.
Runs a B2C SaaS company for photo manipulation / editing.
Indeed - you can even extend this idea to only identify factors less than or equal to the square root - all factors greater than this have a matching factor less than the square root.
By "user to root privilege escalation", I'll assume you mean leaking kernel data without root, since this attack doesn't directly allow escalating privileges at all.

For variant 1, you would need to find some legitimate kernel code, accessible by syscall, that looks at least somewhat similar to the example in the Project Zero blog post:

if (untrusted_offset_from_caller < arr1->length) {
unsigned char value = arr1->data[untrusted_offset_from_caller];
unsigned long index2 = ((value&1)*0x100)+0x200;
if (index2 < arr2->length) {
unsigned char value2 = arr2->data[index2];
}
}

In practice, you may not be able to find something nice like "((value&1)*0x100)+0x200", but even if it simply used 'value' as an index, you would be able to at least narrow it down to a range. Other code patterns may work too (and potentially be more powerful?), e.g. conditional branches based on 'value'.

For variant 2, see caf's answer to you in another thread.
Most startups can’t afford to train anyone.
If I keep slaves, I'm "creating wealth". But it's hard to argue morally that I have a right to that wealth.

The difference between keeping slaves and having employees is one of degree, not of essential quality. Most people work because they have to, to avoid starvation and homelessness, not because they want to.

So the element of involuntary compulsion remains, but the punishment for non-compliance is deferred and obscured.

It's probably hard to organise a non-cornucopian society without some element of compulsion. But the real issue is how the benefits are distributed, how much free time and opportunity remains after the compulsory work is done, and how easy it is to lead a privileged life which avoids compulsory work.

I suspect that ultimately there's a self-centred moral view in which all transactions are seen purely in terms of personal losses/gains and hierarchies of status, and a wider synergistic moral view in which network effects generate social benefits that also boost individual gains - a kind of social trickle down, where the hierarchies are flatter, the status differences are less extreme, but the culture as a whole has the potential to innovate more quickly and creatively.

It's very hard for someone who lives in the self-centred view to accept that some loss of relative personal status is worth increased creativity and opportunity elsewhere.
So is this fixable or not?
That was my point - on kernel design, yes, he's way more qualified to comment than I am. But his claim was about CPU design, not kernel design. He's about as qualified to comment about CPU design as I am on kernel design.
Exactly. We have new streaming video services with their own exclusive content popping up almost daily.
Shearwater (Techstars '15) | Software Engineer, Senior Software Engineer | Boston | ONSITE | Full-time | $70k - $180k

We are a tech startup that helps schools deliver 1-on-1 mentorship to all their students. Our customers include Tufts University, Washington University in St. Louis, University of South Carolina, Northeastern and Penn State. Our users are students and alumni of these institutions.

Our mission is to directly increase the national graduation rate. We do randomized controlled trials to measure our impact on a given school. At the same time, we are constantly A/B testing new experiments to make progress on the deep human questions that underlie what we do:

- Out of the thousands of alumni from this school, who will make the best mentor for this student?
- What ingredients go into a profound mentoring relationship? How do these relationships get sustained?
- What helps students stay in school?

Overall, we have a nonprofit's mission and a tech startup's culture. We raised our seed round and went through Techstars in 2015. We are on our 4th consecutive year of doubling our revenue and are fortunate to be profitable.

We currently have 2 engineers (an overall team size of 16), one of whom is writing this message. We are hiring a 3rd. Our stack is Heroku/Postgres/Ruby on Rails with an EmberJS frontend, but we don't dock you points for not already knowing these technologies -- we care far more about demonstrated ability to learn. See http://shearwaterintl.com/engineering/ for more about our engineering culture and processes.

* While this is an onsite position, we have an extremely flexible remote work policy: work remotely whenever you feel like it and it's OK with anyone you're meeting with that day. I work from home two days a week.

Apply through AngelList (https://angel.co/shearwater-international) and mention HN in your note. Or send me an email (eli@shearwaterintl.com) and let's talk more.
Developer Happiness: Gratitude as an attitude
From coworking to retail, a Chicago space wants to give innovators a home base
How I made $1934.66 in two days consulting (from people I didn't know)
People also forget that a Tesla has a magnitude fewer moving parts than a ICE(internal combustion engine) car.

The big issue in scaling up is making enough battery packs. Which is a question of ‘when’.

Once they have a monopoly on cheapest battery packs and enough superchargers, a Tesla model 3 is cheaper to maintain, cheaper to run and similar price to an ICE auto, probably better performance.

Unless they fuck it up, BE battery electric is the way to go. Energy to motion, Tesla does more than 100MPG.
We know almost nothing about Euclid: we can figure out when he was active to within a century or two, and according to Pappus writing 500 years later some of his students/followers lived in Alexandria where Apollonius studied with them. That’s pretty much it for biographical details.

The earliest remaining editions of the Elements have no author mentioned, and our source that Euclid compiled it is a brief remark from Proclus 700 years later. Most of what is in the Elements was results from earlier, and it’s all but impossible to break down which bits were first done when or by whom. Most of what we can see today of the Elements or Euclid’s other books is later copies, much of it probably added/changed/reordered/... later.

If you want a 2000-year-old idol, go for Archimedes.

In the last 1000 years, the most influential mathematician is surely Newton, with an honorable mention for Leibniz. For the computer age (from 1950 through the upcoming few centuries), I’d put my vote on Grassmann (1809–1877), though his work was long ahead of its time and still substantially underappreciated.

Euler and Gauss were of course both brilliant and prolific and well worth studying, along with Descartes, Lagrange, Riemann, Poincaré, ....
I don't know much about this particular flaw, but I imagine it'll be pretty hard until someone releases an exploit kit, and then pretty easy after that.
There are 3 known CVEs related to this issue in combination with Intel, AMD, and ARM architectures. Additional exploits for other architectures are also known to exist. These include IBM System Z, POWER8 (Big Endian and Little Endian), and POWER9 (Little Endian).

https://access.redhat.com/security/vulnerabilities/speculati...
Just tested this on systems of varying age.

Works on processors going back as far as 2007 (the oldest I have access to now is an Athlon 64 X2 6000+), but the example code relies on an instruction that the Atom D510 does not suport.

Because Spectre seems to be an intrinsic problem with out-of-order execution, which is almost as old as the FDIV bug in intel processors, I would be very surprised if the Atom D510 did not turn out to be susceptible using other methods as outlined in the paper.

EDIT: I originally suspected this instruction was CLFLUSH and erroneously claimed the D510 doesn't support sse2. It does support sse2, so it must be that it does not support the RDTSCP instruction used for timing.

EDIT: This gets very interesting. I made some modifications to use a CPUID followed by RDTSC, which now runs without illegal instructions and works everywhere the previous version worked. Except on the D510, this runs but I cannot get the leak to happen despite exploring values of CACHE_HIT_THRESHOLD. Could the Atom D510 really be immune from Spectre?
Are extensions like 1password vulnerable do they run in the same process as js from a page?
I reimplemented variant 3 based solely on clues from twitter posts yesterday.

I am by no means a computer security guru - I just did a CPU architecture course at uni and figured I'd cowboy up an implementation. It worked nearly first time, and can read both kernel and userspace pages from userspace by fooling the branch predictor into going down the wrong path, and relying on the permission checks to be slower than the data reads from a virtually addressed cache. It can only access stuff already cached though, so you can't do a full memory dump with it.
I got stuck trying to make confluence more usable
I personally am not a fan of these types of devices, but I am also not as doom and gloom about them as GP.

IMO, it isn't an imminent threat. It's not going to kill you. It's not going to cause you any physical harm. It's the slow erosion of privacy which is a detriment to everyone.

I'm going to avoid the cliche Orwellian arguments and the normalizing surveillance arguments. Both of these have been addressed ad nauseaum. I'm going to go a different route and see if it resonates with you at all.

It is incredibly easy for humans to be manipulated. This only gets easier as we have treasure troves of data about individuals. Amazon has many of the smartest people in the world working to manipulate you to do things in their best interest. Sometimes their interests lineup with your best interests and things are great. Other times, their interests will be negative to your life.

It is in their best interest for you to not be content with what you have. It probably is your best interest to be content with what you have. It's not wrong to want things, but things will never fulfill you.

I'm not saying capitalism is evil, Amazon is bad, or that we aren't living in one of the best times in human history. I am saying that putting a marketing device (which is also a privacy concern) in my home is not something I am interested in. Especially when I can do the 90% with my phone in 5 thumb presses.
the sticking point is finding a way to make markdown round trip from and to confluence via the REST API.
The VM host will still have the patch applied, won't it?
How do we keep secrets from enemies while telling all secrets to our citizens? Such an idea does not seem to live in the real world.
But the former don't repeatedly knock out runaway success stories.

Runaway success stories are incredibly rare. Worse, the people who are most famous for achieving them rarely appear particularly sympathetic or humane.

Edit to add: that was a great read, IMO - unusually interesting and insightful.
For software that requires self-modifying code to run the existing Linux kernel patch would apply (performance penalty). If there is other ways to flush the cache it is necessary to evict the entire software memory on the interrupt.
You can also prime factor the larger factors. Once you have all the primes, you can build the other numbers.

50 = 2x5x5
So 100 = 2x2x5x5

You can build your other factors of 4,10, 20 and 25 by multiplying the subsets.
I bet it’s different for various niches. Consider young families. Disney absolutely dominates children’s content, and very old content still resonates with kids. My niece and and nephew were obsessed with Toy Story, Finding Dory, Frozen, etc. I bet Disney’s streaming service will be the first one families buy.
As of this writing, my uBlock Origin set-up is still making use of 18 of the NoCoin list's 73 filters, so it probably is worth installing if you're concerned about this sort of thing.
Ask HN: Best conferences to attend?
Hi HN! What are the best conferences to attend for engineers (software/hardware)? I know that using the word 'best' may be a bit ambiguous since everyone has their own professional goals, and what is best for one individual may not be the best for another.

Feel free to list the conferences and give a bit of background as to what to expect when attending?

If it helps, I'm about ~3 years into my career, and looking to continuously keep learning, improving, and growing my network. I see conferences advertised here and there, but not sure which ones are worth attending. Any additional tips and advice would be greatly appreciated!
Not really.

See: https://blog.mozilla.org/security/2018/01/03/mitigations-lan...
I understand the utility of stable coins, but am not sure that consumers would be interested.

It's a non-appreciating asset, so no real consumer benefit to buying with USD and holding. However, consumers still have risk of oracles failing or flaws in software costing them money. What is the economic incentive to use a stablecoin?
Well yes, both have In-Q-Tel ties, and a former member of the CIA was on Facebook's original advisory board. Even more reason to not give these huge tech companies a pass.
In at least Java, and probably more languages, you can also use braces to limit variable scope. E.g.:

List<String> lines;
{
int whatever;
lines = new ArrayList<>();
// modify lines
}

List<Object> processed_data;
{
int whatever;
processed_data = new ArrayList<>();
// modify processed_data, using lines
}
So in all cases just evict the entire process memory from the cache when the interrupt is raised when reading from a protected memory. The performance penalty would apply only to misbehaved code.
If you're going to go that far, you might as well use 64 bits to say whether each square contains a piece. There are a maximum of 32 pieces, and for each (potentially) occupied square there are 12 possibilities for what might be there (not counting "nothing" as a possibility in a square since that's already covered by the 64 bits indicating whether each square is occupied), which can be represented in 4 bits per square. So that's 64 bits to say which squares have pieces, plus 32 * 4 = 128 bits to say what is in each occupied square, for a total of 192 bits to store the chessboard.

You can take it even further, too. For the 32 possibly occupied spaces, you can encode what is in them as a 32 digit base 12 integer, then convert to binary, which is guaranteed to fit in 115 bits. So you can get away with 115 + 64 = 179 bits.
What does this matter at all? How does the GDP of Germany change anything? If Germany was poor it would be different?

If it were poor and were being coercively restructured by some outside hegemonic power (as many argue Tibet is) then yes of course that would make a difference.

The native population is being completely replaced with immigrants.

Germany's immigrant population is 10-12%, and last time I looked everyone in the German government was German. It's impossible to take your hyperbole seriously.
Treasury handles tracking of financial flows involving sanctioned entities, terrorist groups, nations hostile to the US, etc. DoE handles nukes.
I wonder if this part of the reason why Google added Site Isolation as documented here: https://securityboulevard.com/2017/12/google-chrome-update-f...
There are, but it comes with the baggage of contracting an additional phone line, and more importantly having it charged at all times and on the kid.

Even just the risk of breaking, losing or getting it stolen is not negligeable.

It’s a viable option depending on the kid and the environment , I just feel kids phone are still too clunky to be worth it. I’d prefer to go straight for a regular smartphone once the kid is big enough to properly take care of it.
Yes i share the pain with you. When it does not work, you still must have a senior or a junior willing to dig into it and become senior after some time as well. Pushing the responsibility away to magic sauce is good and bad. Yup.
When visiting cousins or friends in the Portland area I always found myself having to slink back into my car, closing my half-cocked door in the process, so I could uncomfortably wait for my tank to be filled for me. I could never remember that "in Oregon, I legally shall need help at the gas pump". I sometimes wondered at what point of forgetfulness I'd get cited or fined. Once I fancied that there was a union of gas pumpers ready for action at the slightest provocation, held in check only by the State's tourism department.

I'd be interested in learning why//how such things came into place.
Not sure about other countries, but I'd be shocked if legislation like this passed in the United States.
Just to be clear, your amounts are in GBP right?
Yeah it's not like the good old days where I had to use my 'dial-up' 'modem' to connect to the 'world wide web' and go to AOL and use my 'keyword' to load a 'website' from their 'server' and 'download' my 'emails' - it was so simple back then without that jargon.

Usability isn't about only using existing terms, it's about explaining the process well during on-boarding.

Human language is malleable and we all now know 100x the technical terms we did in the 90s. The same will eventually happen with blockchain tech, you're just seeing it in the early stages.
You mean, like a Taser?
A good question, though we're currently living in a world that is the author's death plus 95 years in the US, so this is already standard practice. Works not covered this way get a ridiculous 120 years copyright coverage. I would say a flat 35 years from publication or 50 years for unpublished works would be reasonable.
It depends on whom they talk to. Adult informed people will easily ignore their nonsense, while youngsters will very often be attracted by the Nazi/Fascist false sense of strength because in their still young minds aggressiveness equals strength.
Fascism is coming back in some parts of Europe and we won't get rid of it by simply asking politely to go away.
Not being familiar with the usage of SharedArrayBuffer, is disabling it the nuclear option (eg bad for everyone involved and clearly not the best option if others existed)?

I see over 100 pages of commits on github referencing it, which tells me it's not exactly rare?
> So, here's a newer piece, with opposing results:

It's a more limited piece that only talks about 15-19 year olds, which is a far smaller audience than kingraoul3's link. kingraoul3's link has data on ages 12 and older.
Gotcha! Thanks for setting me straight here.
Location: New York

Remote: Yes

Willing to relocate: Yes

Technologies: Ruby on Rails, Javascript, React, HTML, CSS3, SQL, PostgreSQL, RESTful API, RSpec, Minitest, Capybara, Mocha, Chai

Resume: https://drive.google.com/file/d/1El68c8MUM_ajsAFJ8IfqUpcN9xQ...

Email: bschwartz92@gmail.com

I am a software developer with 1+ years of experience looking for a full-time role. I have experience working with production apps in Rails and React.
Apple's $29 Battery Replacement Could Lead to 16M Fewer iPhones Sold in 2018
Oh, I'm in agreement, and should have made my point about this more clear. The reason I brought it up at all is that there are other external factors that influence a patients decision, or lack thereof, in choosing a CT surgeon for their non urgent (or emergency I guess, but there's even less choice there) procedure.
I believe this paper is very full of one-sided ideals of what people think nature and society is.
Perhaps high-resolution timing needs to be a permission and not a "right", just like access to location or webcam data.
Blogspam of

http://www.lancaster.ac.uk/news/articles/2017/diabetes-drug-...
Speculatively, No comment. And this was a really badly thought out comment.
Not sure how this is relevant. No one is doubting that executives at all levels and in all industries skew male.
Cane or beet sugar is sucrose, not glucose (although glucose is a constituent of sucrose.)
Are you running the light Geth client on the device?
Wouldn't that cut both ways? If its unfair to laud macOS for its consistency i.e. forced defaults, you likewise cannot laud Linux for its multitude of options i.e. tweakability.

On a sidenote, you needn't have switch to Linux. Command-Tab-Plus[1] has the feature you want ('Isolate applications in Spaces').

[1]http://commandtab.noteifyapp.com
Any idea where to start