skysight-inc/HackerNews huggingface dataset:
Ryzen is affected by spectre but not meltdown by the looks of it
> When someone is "arguing semantics" they are often trying to obfuscate the original issue being discussed.

Well (and the irony is not lost on me here), this wasn't part of the definition of a semantic dispute that you just presumably quoted... it was just something you tacked onto it afterward. And the entire problem is that to you a semantic dispute might imply the original issue is being obfuscated, whereas to the other person it might imply you are trying to stretch your own ideas to where they wouldn't apply.

Read your own definition: you said a semantic dispute is when they disagree on essential words. Not fluff words. People don't need to disagree on facts to have legitimate disagreements about about their interpretations and consequences. We all agree the CPU behaved in an undesirable way. There is no debate there, but that fact was insufficient to get us anywhere. What we disagree on is whether that is a "bug", which matters to all sides because it has consequences as who is to resolve the issue and how.

> In this specific case the argument is being made that Intel is trying to use a different meaning for the word "bug" that favors them.

[Edit: I misread part of the comment here; see below.]

If it's "unintended behavior", then, sure, the CPU has "bugs", but that's a pretty useless definition that gets you nowhere (especially legally). If it's "does not perform as specified", which at least to me is a more logical choice, then I'm afraid I have not seen a shred of evidence that they ever claimed memory contents are immune from CPU timing/cache/etc. effects.
Microsoft beginning immediate VM reboot… gee… thanks for the warning
Thanks :) Yup, I source news from local news portals as shown in the website. Hourly, each source is crawled in each relevant category to get the latest news items, and stored into a database. Another job then goes and fetches the body of all these articles. (I use https://github.com/robfig/cron for cron jobs). Server and HTML templates are both Golang. As for the aggregation (grouping) algorithm, I'll just say that it's straight out of the textbook http://infolab.stanford.edu/~ullman/mmds/ch3.pdf
AMD rebukes Intel, says flaw poses 'near-zero risk' to its chips
Yes, indeed. You're being sarcastic, enjoying how you've supposedly caught all those SJWs in hypocrisy.

Yet Google news finds more than 600 articles with titles such as:

- Male teacher drought may hurt boys

- How do we recruit boys into female-dominated professions?

- Our schools are failing boys, which is bad news for Britain

- Most schools would love to have more male teachers to serve as role models for boys, but not many volunteer. (first line of article, not headline)

etc...

https://www.google.com/search?rls=en&biw=1324&bih=1190&tbm=n...

The higher salaries for the male teachers this very article is about may actually be a sign for Google's attempts to improve the gender ratio.
Sure this is a fair comment, aside from the fact I don’t believe I was “lashing out” - and, you only learn by asking questions.

So sorry but not sorry. ;-) (in a nice way, not upset at you at all)
Yeah I have been waiting for green card for 15 years. US Masters degree in CS from top-10 university, 6 publications, 100+ citations. Senior staff engineer in top valley company for 6 years, got multiple awards/always top performer. Then started own company(multi-million$ revenue) and created ~10 high-paying jobs in the valley.
With the new proposed H1 changes, I will have to leave since H1 extensions are being revoked. Not that I mind, getting bored of the valley - Europe is definitely better in terms of diversity. Also I have seen that the advantage of being physically in the valley is no longer what it was. Everything happens remotely - yes even sales.
Not only do they have brand demand, when they do enter the same markets as Tesla with their own EV they will have people flocking to them.

far too many people keep hyping numbers of Tesla's preorders or even sales of S & X while completely ignoring they don't even come close to equaling single lines of some other brands who do this year in year out
I should clarify I mean user to root privilege escalation.

I totally understand how the breaking out of the javascript sandbox attack works and the fact that IPT won't help with that. With Linux's clone(), you could clone without CLONE_VM and use CLONE_NEWUSER|SYSVMSEM and then unmap everything except the Javascript interpreter / JIT and leave a shared memory map and communicate only via the shared memory map and SYSV semaphores for synchronisation. Obviously this wouldn't be available on other platforms.
I can imagine some ways to armor the branch predictor, similar in principle to how languages like Perl have to include a random seed in their hash code (in some circumstances) to avoid being able to pre-compute values that will all hash to the same thing [1]. There should be some ways to relatively cheaply periodically inject such a randomization into the prediction system enough to prevent that aspect of the attack. This will cost something but probably not be noticeable to even the most performance-sensitive consumers.

But no solution leaps to mind for the problem of preventing speculative code from leaking things via cache, short of entirely preventing speculating code from being able to load things into the cache. If nobody can come up with a solution for that, that's going to cost us something to close that side channel. Not sure what though, without a really thorough profiling run.

And I'd put my metaphorical $5 down on someone finding another side channel from the speculative code; interactions with changing processor flags in a speculative execution, or interaction with some forgotten feature [2] where the speculation ends up incorrectly undone or something.

Yuck.

[1]: https://blog.booking.com/hardening-perls-hash-function.html

[2]: https://www.youtube.com/watch?v=lR0nh-TdpVg - The Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation (Dec 29, 2015)
I wish I could find the article about the guy who wrote a program in excel for working with digital surround sound like 5.1 and 7.1 Dolby.
medical costs to insurance companies and consumers rose

that directly contradicts what you wrote in the parent comment.
I don't think there's any way to know; it could be a month or it could be two years.
Please apply through Starsky Robotics Lever page: https://jobs.lever.co/starskyrobotics/
Just closed $45M in Series D funding back in May 2017 and looking to grow our development team of 150 -225! Please apply on the link above our email jordan.chan@visiercorp.com for more details
I was about to say something like, "Well, in a broad sense they introduced protection features to x86 to prevent modification or disclosure of memory contents across process boundaries...and that's broken, therefore bug."

However, looking at the reference manual for the 80386 [1], and a modern version of their x64 manual [2], they don't actually say it's for security:

Original: "6.1 Why Protection? The purpose of the protection features of the 80386 is to help detect and identify bugs. The 80386 supports sophisticated applications that may consist of hundreds or thousands of program modules..."

Modern: "The IA-32 architecture’s protection mechanism recognizes four privilege levels, numbered from 0 to 3, where a greater number mean less privilege. The reason to use privilege levels is to improve the reliability of operating systems."

So it's more like someone sells you a box with a lock on the front that looks a lot like a safe and all of the individual hinges and pins and whatnot are guaranteed to some degree, but they never actually say it's OK to lock your stuff inside.

[1]https://css.csail.mit.edu/6.858/2013/readings/i386.pdf

[2]https://www.intel.com/content/www/us/en/architecture-and-tec...
>We'll need new CPUs.

I don't think that's an option either.
> When reciting the alphabet German school kids don't add the umlauts (at least I didn't – I don't think that has changed in the last decades) and if you ask someone how many letters the alphabet has they will answer "26" without hesitation while in Sweden they are treated as distinct characters of the alphabet in every sense.

Meanwhile, the Swedish alphabet has 29 letters. Since 2006. Before 2006, "W" wasn't considered a letter of the alphabet, since it was just a double "V", and only existed in German and English loan-words and names.

So before that, this would have been the correct sort order of some names: "Valter, William, Viktor", but these days they would probably be sorted like "Valter, Viktor, William"
Humble Book Bundle: Python by Packt
There are fundamental causes for inequality that can't be fixed once-and-for-all. The Pareto principle and other similar dynamics provide a glimpse into this. We see this everywhere in nature (distribution of mass in a star system, distribution of energy in an ecosystem, etc).

That being said, there are significant anachronistic, unjust human causes for inequality. Corruption, cultural/racial bias, skewed market incentives, externalities, etc.

That is where we should focus our energy. There is much good that can and should be done there.

And we can work to broadly lift the floor of human experience for all, even if such endeavors don't eliminate all relative inequality.

A perfectly equal system would be static, unchanging, fixed in place. There would be no vibrance or life. Dynamic processes that bring about change do not provide the same result to all pieces of a system, and require non-uniformity to continue occurring. Think of the heat death of the universe -- everything everywhere is the same temperature, and no interesting changes can ever happen again.

But this is certainly no excuse to not make the valuable and necessary improvements that we are capable of doing.

Lastly, it is certainly possible that the "natural" dynamics driving inequality are not at ideal levels right now, and that we should enact policy changes or other measures that counteract such dynamics and increase equality (higher taxes, social programs, etc). I think this is likely the case, and support such efforts.

Edit: Getting some downvotes. I hope no one think I'm implying regressive action, as I have no desire for that. I'd love to hear people's take on things. My main reason for posting is that I often see discussions that don't recognize what seem to me certain fundamental dynamics. If my understanding is off, please share how. Thanks.
Compare Tesla to others and not their own targets and its clear.
Amazon Assistant: Chrome extension that adds Amazon products to Google results
> And Google's representation of women in software engineering roles is also around the industry average.

Sure. And both scenarios need industry-wide efforts to increase gender equality. But Google is basically an irrelevant factor in the pre-K teaching industry, and a giant one in the software industry.

> To your second point, it's not either or.

Societally, sure. In the case of particular firms, their ability to impact different fields with the same expenditure of resources is highly dependent on their position in the various fields.
Well, lets also not forget that Spotify has been slowly steering itself from a pure "music playback tool" to a "music discovery tool", and a trusted one at that. They are heavily promoting things like Discover Weekly, Podcasts, playlists like RapCaviar and their various "n+Moods" and "n+Vibes" playlists.

There was a great article[0] posted here some time ago, I think, that likened the algorithmic discovery "products" of Spotify plus the effortless access to individual songs as creating a sort of thin spread of musical diversity (the auther's e.g. Muzak), generic and accessible enough to be replicated by almost anybody. A great example of this, today, is Cardi B[1] – this is a person who honed her personality through social media and reality TV, linked up with a music camp, and is now the third person in history with her first 3 commercial songs in the Billboard Top 10[2]. Her biggest hit, Bodak Yellow, uses a flow lifted from another rapper named Kodak Black (and she has done this multiple times[3]). The thing is, though, she was groomed to be a hit.

Once Spotify achieves a critical mass of listeners that trust their algorithms, and rely on their tastemakers to deliver fresh music, Spotify could easily slot in musicians that they themselves hold the contracts for. Their pockets are just as deep as a record label, and their listener data is far richer. I have no difficulty imagining that Spotify could replicate a Cardi B-esque pop zeitgeist. "Tastemaking", even if the word makes you cringe, is what will define the winners and losers of the streaming wars. It's why Apple hired away Zane Lowe – an relatively bland DJ personality, but an incredibly gifted ear and a cache of trust – and why Spotify relies more on Playlists and Discovery every day.

Remember, they didn't even have the Beatles until Christmas 2016! That shows a decent picture of how much the majority cares about back catalogues. I don't think it's unreasonable to think that Spotify themselves couldn't produce a top 10 rapper, or a top 10 country singer, or a popular podcast, just based on the level of engagement in their playlists.

0. https://thebaffler.com/salvos/the-problem-with-muzak-pelly

1. https://noisey.vice.com/en_us/article/evpbxj/cardi-bs-bodak-...

2. https://noisey.vice.com/en_us/article/bjyvad/cardi-b-makes-h...

3. https://genius.com/a/how-kodak-black-influenced-cardi-b-s-bo...
I think the "best sports car ever made" title belongs to Porsche, but on the Cayman instead of the 911.

The Z3/Z4 is a different kind of sports car than the Miata/S2000 kind. It's heavier which required a stronger/heavier engine to maintain Miata-like power-to-weight. The suspension is softer and, due to the car's heavier weight, less nimble. It's closer to GT car than sports car.
In the Tech World, It Really Helps When People Think You’re Male
The promise of AI in audio processing
"due to that UGB" ...

Man, developers always say that, and it's simply never been true. There's so much undeveloped land still within the UGB, and so many opportunities to build densely close into city limits--a lot of which is happening, but a lot more of which could still happen.

Portland does have a big housing problem, it's true, but the solution isn't in opening up the UGB--it's in getting more good jobs, and encouraging more entrepreneurship, so that folks can actually afford to buy the condos going up all over that city.
Where Did We Come From? An Astonishing Hypothesis
Was this quote removed from the article? I'm no longer able to find it.
If you're using an in order processor, a Nexus 9 tablet say, then you should be safe.
The closest thing I can think of is [Geant4](https://en.wikipedia.org/wiki/Geant4), which is a monte carlo-based particle simulator. It doesn't have facilities to work with geometric models of spacetime, of course, but it's used extensively in the high energy physics community and medical imaging communities.
Except the New York Times article shows that MTA's costs are 5-7x higher than recent projects under London or Paris.
>Nobody knew what those people were doing, if they were doing anything

I just can't help but smile and remember the scene from The Sopranos of some wiseguys seating in lawn chairs at the construction site eating pastrami sandwiches... but in a tunnel this time!
It seems like practical attacks rely on having a reasonably precise timer available. The spectre paper uses SharedArrayBuffer to synthesize a timer, which is a recent and obscure feature:

https://groups.google.com/a/chromium.org/forum/#!topic/blink...

https://groups.google.com/forum/#!topic/mozilla.dev.platform...

Chrome and Firefox's "intent to ship" posts both contain claims to the effect that there probably aren't any really serious timing channel attacks, which... seems to have been disproved. Why isn't SharedArrayBuffer already being disabled as a stopgap? I think users can turn it off in firefox, how about Chrome?
I generally agree! The unfortunate thing for me is that when that stuff breaks in some obscure way, I end up being the one to debug it. Magically having private fields populated during application launch is great, until the junior guys can't figure out why one of them is null sometimes.
Yes please!

Long live progressive enhancement and graceful degradation.

At least until we get a JS interpreter with proper permission controls and sandbox limits. Something closer to how Lua is embedded sounds nice.
Uh... that's universal health insurance. It has nothing to do with whether or not the system is private.
Many people are vegan because of ideological principles not having anything to do with weight management. (Such as not killing animals or keeping them in miserable conditions.)

You can in fact stuff yourself on vegetables, nuts, fruits and beans and maintain a high body fat percentage. (Potatoes and such are vegetables, by the way). Fruits are high in sugar. You're also forgetting grains.
Yeah this is due to the recent security bug related to speculative execution on CPUs. It causes a performance hit, and they have to force people who haven't restarted in a long time to restart now because it's around the official disclosure deadline.
Sorry to be daft, but hasn't the Google Zero team jumped the gun on the coordinated disclosure date by publishing their blog post 6 days in advance?
It might incorrectly tell you the weather is hot, so you walk out with just a t-shirt, then freeze to death.
If nothing else, I bet it loads fast!
Would love to see the HN crowd's take on this. I had thought that using extensions to modify someone else's site becomes a bit of a legal issue. See Facebook's legal threats to extension writers that add features like "who de-friended me" to Facebook.
Chrome starts putting multiple tabs in the same process once certain resource thresholds are reached. There's an experimental "site isolation" option that you can toggle on to enforce this better, currently with some caveats: https://www.chromium.org/Home/chromium-security/site-isolati... .

Curious to know whether Firefox has anything similar in the pipe, since it uses a fixed number of content processes rather than a variable number of processes.
Comcast in particular seems to evoke near-universal feelings of rage, and has done so for decads. I remember a while back, my dad looked into bonded ISDN as an option when we couldn't get DSL just to avoid Comcast (ISDN turned out to be way too expensive, but the moment FIOS was available he switched, after using Comcast for over a decade)

See also Comcast's customer satisfaction scores rise, but are still below the IRS's: http://bgr.com/2017/04/25/comcast-customer-service-scores-20...

Americans in general don't trust the government to provide good services and yet municipal broadband gets strong support from voters almost everywhere. It's really hard to understate how much people don't like Comcast
Respectfully, do you really believe that? I find that doubtful. Google has zero to gain from doing so.
But somehow you have to get that kernel address in the first place in order to alias it in the BTB. How do you get that without root?
>the technology company employed roughly 147 women and three men as pre-school teachers

Three men isn't remotely statistically significant. They can't make any kind of statistical claim based on that.

Second a gender ration of 1 male to 50 females is obscene. Tech is supposedly incredibly sexist for having a gender ratio of less than 2 to 1.
> Come on, Google completely "forgets" to mention the others

Err… fourth paragraph:

> Before the issues described here were publicly disclosed, Daniel Gruss, Moritz Lipp, Yuval Yarom, Paul Kocher, Daniel Genkin, Michael Schwarz, Mike Hamburg, Stefan Mangard, Thomas Prescher and Werner Haas also reported them; their [writeups/blogposts/paper drafts] are at: Spectre (variants 1 and 2) Meltdown (variant 3)
Nevermind the merits of this case. I'm shocked that a child care that costs what Google charges pays its educators only $20/hour. This isn't a company perk, it's astronomically expensive. Much more expensive than my kids' private grade school, where the teachers are paid far more.
They have these in e.g. DC: https://www.apta.com/resources/reportsandpublications/Docume.... Besides that, MTA simply needs to raise rates. London Tube fares are quite a bit higher than MTA fares.
The general principle applies but just in case anyone's confused, Cipher's wallet is a client running on the phone, and Parity's wallet was a smart contract running on the blockchain. It's a bit unfortunate that the term got reused for multisig contracts.
I know that humans want to know these things, but can someone ELI5 why this important?
Wow. $18 an hour, for someone with 5 years experience and a masters degree in early childhood education. I know she deserved the L2 salary of $21, but even that is terrible! A software intern will make almost double that with barely a data structures class under their belt!

Seems like Google is no better than anyone else when it comes to using letting "market rate" limit the income opportunities of workers in "pink collar" jobs like this. Google could easily give a decent 55-60k salary to each skilled education professional that works full-time in their pre-k program. The fact that they would play games with this woman's economic well-being over a petty 3$/hr shows that they've coasted on their reputation as a good place to work for much longer than deserved. Hope they pay out well for this.
Chromebooks, obv. Integrated marketing strategy!
Cloud services will benefit from this greatly.

Spectre occurs no matter you are in cloud or not, while cloud companies can advertise themselves to help customers proactively to mitigate such risks.
There are two different issues.

1. Intel only (so far) is related to prefetching privileged memory
2. More or less everyone: Speculatively executing code that has variable execution time.
Thanks for your thoughts.

I didn't mean dropping anything related to programming - it would be a waste of all the skills I developed over the years. But I don't want to be stuck forever doing pure software projects that are only meant to help the rich get richer, and don't contribute anything of actual use to society - which is what I feel the tech industry is mostly about these days.

My strategy is definitely to try and leverage my software skills in the new field - but ultimately, I would like to learn something else than just how to write code.

Could I be an astronaut? With my health and experience, there's no way. Sadly. But I dream that if the industry develops fast enough, maybe I'll live long enough to get the chance to get as high as LEO.
We'll have to dig a time machine out and go back to 1998 then.

I'm being a facetious ass. But you know I'm not wrong, either.
I have my hn bar set as pink with the Karma-unlocked feature. This is tempting though...
Meet Mastodon
> I think users can turn it off in firefox, how about Chrome?

This month's stable Chrome release will be outright disabling SharedArrayBuffer until additional mitigations are enacted.
I believe SAB is being disabled, and apparently precision of performance.now() as well? (based on other comments)
But then you have to release the module as GPL, no?
BMW in particular i'm looking at quite closely.

Unlike MB and Audi, BMW are invested in electric tech and have already been for a while with the i3 (both full and hybrid trims) and also the X series hybrid SUVs. So for them battery tech is a "solved problem". They already have a production capacity of 2.5m/yr and likely will keep the same capacity in the gas-electric transition.

> Just make absurdly expensive cars that few people can own and you're halfway there.

Not that the GTR was absurdly expensive, but i don't think that car changed the perception of Nissan much.