skysight-inc/HackerNews huggingface dataset:
A few thoughts:

1. I don't think you have to disagree with vel0city to make your point. Just agree that the private prison complex is large and dangerous to society (as you apparently have) and point out that the unnecessary aspects of the public sector prison complex are also large and dangerous.

2. Any time someone can have a financial stake is something like a prison while also holding immense political power, we should all be very scared and concerned. This is why there's so much well-placed concern over the private prison industry. Of course, it's worth noting that there are also lots of ways to make lots of money off of public prisons. And those mechanisms should also be choked off.

3. Damon Hininger makes about $1M/yr in salary. Presumably if total revenue were only $200M, he'd be making a lot less in salary.
Prosecutional discretion is legalized bigotry. The legal system has a strong history of allowing sexist, racist, and classist thought to drive how laws are enforced. Any fair or just system would allow no such discretion.
Hybrid Approach to Big Data [Solution Reference]
I'm all for a faithful reading of the Constitution, and I agree that the federal government has overstepped the intended bounds, but it's ultimately irrelevant. For legal purposes, the Constitution is whatever the Supreme Court says it is. If you want them to be more faithful to the original meaning, appoint judges who feel the same way.
This too was provided as a proof of concept (without explanation): https://brainsmoke.github.io/misc/slicepattern.html. I'm not sure what I'm looking at though
Growing up, I heard the same anecdote 10+ from all sorts of people:

"I'm descended from the guy who fell overboard on the Mayflower!"

I concluded pretty early on that the claim must be either dubious, or that any claims of ancestry become uninteresting past your grandfather.

Heck, if we are going back to pre-Colonial ages, the pool of people I am related to is likely in the millions. For a world that was much, much smaller than it is today. It seems so weird to me that people want to just follow occasional threads and tell you how special they are.
I don't follow this at all. Yes companies are made by people not places, but people are in places. Those places matter a lot. Where will you find better people, in downtown London or rural Iowa?

Given a group of 7 people (posit some great team) their output is the same irrespective of location, sure -- but how did you get those 7 people? If you were in rural USA, your probability of ever having arrived at that situation is already much lower.

If location truly didn't matter, then you'd be able to move your SF team to Iowa and save a lot of money, but that's not going to work.
I agree, but here's a counterpoint / devil's advocate argument -

It's broadly true that wages tend to be "sticky downwards", and that it's much easier to not give something than to give it and then take it away.

As you correctly noted, there's much higher job security in European markets relative to the US. This also means that companies might be reluctant to over-extend themselves in good times, for fear of having no effective way of regulating salaries downwards in a prolonged slump.
WP Engine passes $100M in revenue and secures $250M investment from Silver Lake
https://academic.oup.com/bib/advance-article/doi/10.1093/bib...

I also seem to recall a paper from the 90s or early 2000s which compared speed of development & program execution between Lisp & other languages. Maybe it was somewhere on Ron Garrett's site? IIRC, Lisp programs were developed consistently more quickly than C/C++/Java/SmallTalk, and were normally faster than all but the very fastest C/C++ programs — but I could misremember. I remember that it had some interesting-looking charts.
An explorable explanation of relativistic spacetime
The paper on this site is well written explaining the method of using ROP with branch mispredict to load gadgets. Anybody interested in this, ROP, caches and branch prediction/misprediction is all in the intro [1]book[2]course CSApp

[1]http://csapp.cs.cmu.edu/3e/labs.html
[2]http://www.cs.cmu.edu/~213/schedule.html (Youtube lectures)
i know this came out as a leak, but makes one wonder how "responsible" even a Jan 9 official announcement would have been. the scope is absolutely terrifying. this bug will be exploitable for a very long time.
Not going to talk about my specific skills (throwaway account).

The algorithms stuff is useful. More useful than it seems. It comes up often in many engineering jobs. Perhaps more importantly at your stage in life, it will get you an internship.

Do internships. If you miss the one you really want, think hard about why, then try again. Internships are the best place to start into my next piece of advice.

Specialize in something valuable while you're in school or once you start into your career. Jobs I might look for if I were entering the work force today:

- Image processing or other noisy data handling.

- Robotics, especially something requiring interdisciplinary skills like control theory.

- Deep learning techniques are all the rage; you'll be much more useful if you understand how they work and can build novel topologies. Being taken seriously here will likely require a portfolio (maybe graduate work).

- Systems programming is an unending hellscape of horrible problems. Some people seem to enjoy it.

- If you have a knack for it, security. It takes a certain deviousness to think of new ways to misuse things. It takes a wizard to do something like Meltdown and Spectre.

It doesn't really matter what you become a domain expert in as long as it's valuable. It does matter that you don't treat "domain expert" as a fixed target.

In terms of extracurricular work, find an open source project that's got engagement from companies with lots of senior people (Kubernetes would be a good example, it has many very talented people working on it). Fix open bugs. Fix the onboarding experience. Start with trivial things and go from there. Don't get dismayed when you end up with hundreds of review comments, that's how you learn.

Regarding compensation, the split is approximate. The cash is both salary and an annual bonus paid out in January. The stock is actual stock, not options, so every month some number of Google shares show up in my brokerage.
New research shows how alcohol damages DNA and increases cancer risk
7 Τάσεις Στο SEO Και Στη Google 2018 – WEB DESIGN|SEO|PARAMARKETING.GR
JavaScript Can Not Win – Because There Is No Contest
I understand this "isn't the point" etc - for curiosity sake: How practical are these exploits? From my reading, it seems using them in an attack against a sophisticated target is incredibly difficult, and against an unsophisticated target is still probably prohibitively difficult? I'm not an engineer so please pardon the ignorance.
Budz off 37% already today.

Hope sessions and his boyfriend had short positions on this dumpster fire
I can't help thinking of how the early-ITS approach to security (not only was there none, but looking at other users' work was a deliberate feature) was embraced by its users. I'm way too young to remember, but it rings a bell somewhere down my heart.

There's a lot of prominence being given to all kinds of damage malicious users might inflict, and ways to prevent or mitigate, but little to the malice itself. Whence does it arise? What emotions drive those users? What unmet needs?

Meanwhile, when these slowing-down patches for Sceptre and Meltdown arrive, I intend to not run them, to the possible extent. I intend to keep aside a VM with patches for critical stuff, like banking or others' data entrusted to me. But I don't want my machine to be slowed down just because someone, sometime, might invest effort in targeting these attacks at it. Given how transparent I want to be with my life, that's a risk I'm willing to take.
That's why States Rights is the solution. Let each state control what the law is for them and only for them. Tyranny of thy own self.

(Ignoring for the moment state level tyranny of the majority.)
Are you aware of historical events like the 1982 Siberian pipeline explosion? It was allegedly caused by sabotaged software inserted by a Canadian company on behalf of the CIA.

Modern chips are certainly dense enough and have enough layers that you can hide Trojans in them. Buying e.g. routers with Chinese ICs is a credible threat to the US government.
The AOT in the OpenJDK? It actually uses the same compiler, Graal, under the hood. But SubstrateVM is another level - it produces a single statically linked binary of your Java program - no JVM needed on your system or included in the binary. It's all written in Java - the GC and everything.
From the Ubuntu wiki, it's clear that someone broke the coordinated release date of January 9th. Does any one have more insights on why the news broke to soon?

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
> the technology will evolve into a kind of A.I. arms race

Ha! Google Brain organised a competition on "Adversarial Attacks and Defenses" within the NIPS 2017 conference.

Reminds me of Harry Potter learning magic attack and defence arts at Hogwarts.
Things I Learned During the Advent of Code
To be fair being racist is more than an opinion, it demonstrates your character. It reveals part of who you are and the framework with which you deal with the world. I agree that it is valuable knowledge in determining who you want to create lasting bonds with.
I can’t help wondering what igodard’s day is like so far...
Except it's not California. It's millions of American Citizens
Then again, while Emacs Lisp is based on Lisp, it's not really the best lisp. Some could say it's not even good, because of how old and crafty and lacking in features it is/was. But thing is, it slowly evolves, and maybe in a decade or two it closed the gap.
Ah, the old VIA chips, which VIA built from the tech they bought from Cyrix. If you're interested in the history of Cyrix and some of the older x86 compatible chips, here's a great video on it:

https://www.youtube.com/watch?v=iWGAdoMz1c0

Also these Zhaonix's are just 32-bit right? I didn't seen anything on the site about supporting x86_64.
Do you know that a man is not dead while his name is still spoken?
People don't need to know what jury nullification or be instructed on it in order to engage in it. It was happening in England before this country even existed. Ask any prosecutor and she'll tell you about a case where it happened to her.
Much better article indeed because of very simple and intuitive illustrations/graphs.
India’s Hospitals Are Filling Up with Desperate Americans
Dan Grossman's http://hnreplies.com/ still works
Transitioning from Academia-Industry:Perspectives from Indeed’s Data Scientists
let's submit patches that mine coins, with the recent 30% perf drop thanks to meltdown people won't notice
This side of the house is white.
> Intel meltdown is bad, but not anywhere near as bad as Spectre

I mentioned Meltdown because multiple entities (gcc, llvm, Google Cloud, Azure, Linux, Windows, etc) have already converged on concrete solutions such as new compiler flags and patches which gives us a glimpse into the costs and severity. The Spectre bug may be "bigger" but it doesn't have complete consensus mitigation yet and in the meantime, we really can't tell people to "just keep your laptop unplugged from internet and don't run any apps to avoid the Spectre bug." The Spectre hole seems like it will be an open problem for many years and the new gcc/llvm is an incomplete fix.
> am I supposed to get a blank screen when I "verify" my registration?

No. That is the white screen of death meaning there was an error pulling your user account from HN. I went in and clicked it for you, and it worked. HN API issues are pretty rare.

I was aware tangentially of HNNotify.com, and tried to buy the domain, but they wanted $1,000. I never used the service, because until about a year ago, I didn't really use HN all that often.

> Are you offering any long-term guarantees of existence?

My guarantee of HNNotify.xyz existing for no into infinity is that it costs my company < $20/mo to run, so it will take more time to shut it down than it costs to run. We get $450/mo of free azure hosting for the next two years, then after that the all in cost is $80/mo.

> Can I sign up to watch other people's usernames?

This is planned in the short-term. The user (if registered on HNNotify) will get notified they are being followed.

> What happens if two people sign up each to watch username "X" - is that detected?

You have to verify ownership of the account, so it isn't prevented. It is useful if you change emails, etc.

> you might want to create a FAQ to cover them.

That's a good idea. I'll try and type some of these things up.
I'm at a gigantic (50k+ employees), soul-sucking company that is mostly nontechnical business consulting, working remote as a Software Architect from a borderline-BFE city. $105k + 150%ish 401k match up to 5% of pay + decent benefits. Supposedly some kind of bonus next month.
The doctrine of States' rights is presupposes federal supremacy and a legalistic viewpoint. Marijuana can't be a State's rights issue because it's a federal issue. This is why you often hear the states' rights advocates call for a smaller federal government - states rights can only flourish without the shadow of federal jurisdiction.

Right now marijuana is illegal federally - all States' rights proponents acknowledge this. The old policy of being hands off but reserving the right to bring the iron fist down on otherwise legal businesses was a bad policy. The uncertainty and risk profile killed a lot of investment - to this day, the tax burden on pot businesses is insanely high because they're not permitted to deduct business expenses related to growing/distributing marijuana because those activities are federally illegal.

Thankfully, Sessions is legalistic. If congress got off their butts and legalized it/returned the legality decisions to the state, Sessions would surely respect their decision.

I enjoy marijuana more than most and I suppose Sessions enforcing the law - it's a bad law and collectively we need the motivation to make it better. This legal twilight zone is complete bogus - bring it into the open and drive out the criminal element and let the best organization flourish.
The result might not be glorious but the fire is amazing to watch.
As I have said for years, our current systems rely on the inefficiency of an attacker.

Progress in technology ruins that illusion.

Want to play some heads up poker or chess with someone? How sure are you they aren't getting instructions from a program through some means?

Don't have anything to hide? How about an AI to dig up plausible sounding parallel construction stories to convince a jury?

And in a few decades we're talking about flirting, humor, writing stories, producing any sort of content.

There will be a time when a lot of these false positives will still be accepted, until people just stop trusting EVERYTHING.
Your points sound very interesting but don't provide any details. Could you provide more details, I'm interested in learning about this.

For instance is there a good resource you use on what are good alternatives when you think you need to use PKI when in fact there are better alternatives?

Is there a good resource on how to use JWT correctly that you trust?

(Edited-tone, was a bit more aggressive but was pointing out the opportunity to educate instead of just say things are bad).
You can now read the WSJ for free – but only if you burst your filter bubble
I agree. The cole memo was a real half-assed political approach in the first place, perhaps necessary at the time. This is a move coming at a time when this now state legal industry is gaining widespread popularity and acceptance and most importantly income.

It’s time to challenge the feds on the outdated CSA classification of marijuana as schedule one in general, in addition to forcing another states rights debate.

Also as I understand it, the only argument for the constitutional acceptance of the CSA is essentially the feds rights to govern interstate commerce. In this case they’re trying assert that right in an industry which is essentially operating within single states where the legality has been democratically assessed. IANAL, but I think this fact has some weight behind it in the states favor.
Ah, okay :)
5 Rules for Effective Customer Feedback
I have approximately 9 years of industry experience, following a BS and MS.
Can confirm. Get mail from it frequently. It just works. Open to new options though :)
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...

Status page for the fix.
The mission statement of the project is "privacy with ease of use but without zealotry" and the project is 99% based on existing projects. That looks to me what Ubuntu is to Debian.

Just by chance I looked the other week into installing LineageOS on a slightly older LG but then decided it was too much hassle - although I have experience with Cyanogen, i.e. it would not be the first time for me to install a custom ROM.

All I use on my phone are maps, email, messaging and a browser. I can easily do without Google Play Services and I am sure there are many others.

He is french and in France there are many people thinking like him. It is easy to get press coverage and therefore should be possible to create a user base of a few 10.000 people with little investment.
But if you go back far enough, that tech actually came from Cyrix, an American company. I highly doubt they rewrote everything.
I'm also using this and I'm happy with it. It's fast, simple and just works.
Great answer.

The web issue is easier to mitigate if not fix completely since there is already a massive infrastructure for widespread, rapid browser updates, and crippling Javascript to eliminate attack vectors such as high-resolution timers is completely acceptable.

The cloud/vm infrastructure is a massive problem though. It is 100% required that VMs be fully isolated. The entire infrastructure breaks down if they aren't.
https://millcomputing.com/docs/ e.g. the most recent talk https://millcomputing.com/docs/threading/
You’re conflating two different things. In the former, states have set up legal framework for marijuana sales. In the later, state laws don’t have any opinion on the matter.
> It is a huge tactical blunder that will force the states' rights issue into court and either result in a victory for the states or massive public discontent about federal overthrow of popular state policies.

The states already lost; this already went to the Supreme Court before Congress restricted such prosecution, and the feds won completely.

What will go to court next—unless Rohrabacher-Farr fails to be renewed (it's included in the most recent stopgap spending measure, but that expires, IIRC, later this month) before any prosecutions under the new DoJ policy—will not be a Constitutional states rights issue, but a federal statutory interpretation issue over whether DoJ is prohibited by Congress from this action.
I wonder if any of the companies the build their own ARM cores are not vulnerable?
It would be nice if HN had a system to allow new accounts to post in threads like this without getting the "you're posting too fast" message on the first comment.
How exactly should that work? The differences would still be there. How would you merge it without removing them?
How much money do companies spend on an average per month for GPU computing ? (looking for anecdotal figures).
> The market is a tool, not the objective.

This perspective I agree on. Specifically, markets are a tool for finding prices, because we've observed all throughout humanity that alternative methods of pricing (and hence resource allocation) go poorly. It's the least worst system! If you need to do that thing (establish prices and distribution of resources with minimum waste) then the market is a great tool.

If you're trying to solve some other problem (establishing "fair" pay) -- then I agree that appealing to the market is like pounding nails with a saw. It isn't even supposed to do that thing.

In Buffer's case, they're trying to go after fairness, which is fine. But this overall post above (bringing us back to topic) is that they're starting to introduce factors that are swinging them back towards the market. The market is pretty tough to ignore in the long term, irrespective of our feelings about its fairness.
The Case for App Patronage
Sure but to the GP's question, the format of json vs pipe delimted strings is not the problem, it's WHAT you put in the Json or string and what it allows (eg configuration) that is the problem, correct?

GP:
Basically PAST is just limiting your options down to things we think are secure combinations and eliminating things we know are insecure. However it does this with WHAT it puts in the JSON, not that it's JSON vs anything else. As you said that's just serialization.
To the extent that he exploits computers for a living (e.g. pentesting) and not stops exploits for a living, it seems more like a (presumably law-abiding) arsonist calling houses burning glorious.
I agree. I underslept for a few months. I didn't realize I had a headache all along until I made quality sleep my top priority. Now I go to bed at 9/10pm everyday. If I miss that window, it's much harder to fall asleep.

Recovering from sleep deprivation also takes a long time, let's say, one week per night of work. the extra hours are not worth the overall loss of productivity and health.
Or time to have Kernel live on dedicated cache not ever accessed/shared with anything else. Let the CPU speculate all it wants, just not when playing in the kernel's cache. It may even be time for dedicated kernel cpus/cores.
That video of the past was faked.

And the experts you cite that say it is real are in on it.

It's the Establishment trying to suppress the truth. That's what they say today. With more technology, the underdog with AI can beat the Establishment in a few weeks. And there will not be any way to distinguish what's true anymore than you can distinguish a chess line played by AlphaGo vs any other really good chess line.
Legitimate question: on any non-shared non-virtualized system is there any reason to enable these workarounds besides running sandboxed applications such as javascript in a web browser (or flash/java applets/Active X, but those are not really super popular nowadays)?

For any other non-sanboxed application you pretty much have to trust the code anyway. Privilege escalation is always a bad thing of course, but for single user desktop machines getting user shell access as an attacker means that you can do pretty much anything you want.

As far as I can see the only surface of attack for my current machine would be a website running untrusted JS. For all other applications running on my machine if one of them is actually hostile them I'm already screwed.

Frankly I'm more annoyed at the ridiculous over-engineering of the Web than at CPU vendors. Because in 2017 you need to enable a turing complete language interpreter in your browser in order to display text and pictures on many (most?) websites.

Gopher should've won.
Wait but... isn't this journal considered "newsworthy" and thus able to publish whatever they want? There is at least one person out there publishing hate speech in a non-satirical way and getting away with it on an almost daily basis.
This frustration is why Korg sold so many Minilogues last year.

Check out this Minilogue review playlist by Marc Doty of Automatic Gainsay. You can see what's happening on the oscilloscope while he's explaining things.

https://www.youtube.com/playlist?list=PLAGrtvdn2CyYwV6gxgiXv...
What about Atom? As I understood it Atom processors did not use speculative execution.
Meltdown is fixed by page-table isolation (unmap the kernel's pagetables after syscalls are done). All the other bugs are Spectre, and these are the ones that require fixing every compiler.