skysight-inc/HackerNews huggingface dataset:
One might get some idea if the eyebrow was evolving due to some usefulness by looking at various isolated tribes living with different cultures and within ecosystems/climates (would be much easier to do if one had a time machine).

I tend to agree with you that a lot of things that are called "science" are mainly story telling. There is "physics envy" for a reason. Physics focuses on a very small subset of reality that have observations that are true with uncertainties of 5, 6, 9 sigmas. This is the level of truth one needs to build up a models of complex things that match reality almost all the time. Physicists at LIGO or CERN don't publish in journals some observation with P=0.05 and expect others to use it. Hopefully the reproducibility crisis in psychology will get many truth seeking fields to spend more time on understanding what is true at the lowest level. Feynman had a good essay about this issue many years ago about rat studies[1,2].

[1]Feynman's Caltech speech:http://calteches.library.caltech.edu/51/2/CargoCult.htm
[2]More recent short essay on the rat study: https://www.realclearscience.com/blog/2014/02/the_rat_experi...
Still no support for 32gb of ram?
First Principles of Interaction Design (Revised and Expanded)
Bingo! VCV Rack is built for musicians, not software developers, many who do not know how to unzip a downloaded plugin. This is perfectly fine, because musicians can do many things that I can't. So to make it possible to use for the masses, an account system is best, where it takes two buttons to add and install a plugin. The minority who don't like giving their email address in exchange for this generously-made software can still look at the manifest JSON files to get the binary download link, or compile it themselves.
Don't be taking work out of my wheelhouse now! I learned django templates and how to make redundant rails models back in 2005 and I don't want the world to ever change, thank you very much!

Now get off my lawn!
Maybe next years we can get one of the Zen APUs.
Spectre, not Scepter :D
As someone who has great hopes for Rust, I am mildly concerned after reading https://www.reddit.com/r/node/comments/6whs2e/multiple_coc_v...

As the old saying goes: "The fish rots from the head down".
I'm guessing that nobody wants to buy new CPUs until a whole new architecture is available. Bad luck in the timing.
It's like we spent 20 years building houses out of wood, and then suddenly someone discovered fire. "This is not a flaw in Intel lumber supplies. This new 'fire' leverages chemical properties common to all plant products, potentially compromising structural integrity even though the lumber is operating exactly as it was designed to."

(Edit: It seems this analogy may be overly kind to Intel. Read all the replies to this comment for more information.)
Something like the portal calls and "turfs" described in there could help.
> Even if you know the why and the how, you're still in the same place as everybody else

If you know then you at least have the option to turn off PTI and compile your performance-critical binaries without retpoline.

And maybe disable microcode updates if intel's updates eat another few percent.
I’m not sure I follow: if the other party is allowed to create claims too, symmetric crypto seems more obvious. That’s what NS (and later KRBv5) did in the seventies. Or is that precisely what you’re saying?
I don't know why you're being downvoted; it's crucial that Intel patches this deficiency for all CPU models which are currently in use, which is pretty much all of them, since some systems work nearly forever. We're talking about going back 15 years or so?

I mean this is like the Y2K bug, in that every system needs to have its CPU verified to ensure that it's covered by the patches, otherwise the system should be shut down and a new CPU provided. Since many of these CPUs have sockets for which CPUs are not produced anymore, whole new systems will have to be purchased.

Of course this might the result Intel wants to achieve.
Perder Barriga e Peso Rápido para Homem ou Mulher
If they designed it like this, and it works as they designed it, is their PR spin opening them up to legal challenge? Presumbly they've just been misrepresenting what their system was capable of if they claim this wasn't news to them.

Is it a valid legal defence to say, that was just marketing lies so don't take it seriously?
What if I read the sites TLS/SSL keys? I could MITM the connection and inject JS to do more malcious thing.

Or even easier get the ssh key for the VM. Then do what ever I want.
A surprising few have pointed that out! https://bitbucket.org/duangle/oui-blendish/src
Should I hold off on buying a computer until this spectre and meltdown issues are fixed?
Considering the number of times US security agencies go to court to force Apple to give them locked up information, fail, and then go to third-parties to extract the information, I'd say we're safe. For now.
> isn't that straight-up corruption?

Some companies will also give you these things if you complain enough or yell at the staff until they give in.

There's plenty of people who get free upgrades and products simply by yelling at people until they are given free things to go away.
I'm not an alcoholic, but am very familiar with AA. The assent to a higher power thing is tough for many that I know in AA, but they still find benefit in it(AA). I tend to think that the higher power thing is useful to help externalize some of the bad things that happens in life (while still realizing that you have to deal with them). The narrative would be like, "This bad thing was put in my life by something beyond my control. It's not my fault this bad thing happened to me." I think this is useful for both historical trauma and issues those in AA deal with in the present.
If there were a government conspiracy to put you away, most of the time, they wouldn't need fake video evidence to convict you - just a bit of prejury by officer witnesses.
Thanks for the responses. Unfortunately I've registered on about 6 different exchanges (including the ones mentioned) but all are pending verification. Looks like a lot of these exchanges are struggling with scale...
"If I change the input in your equation, the result changes" !!
That will take a year no?
Only 16 gigs of RAM? Why do companies still hold that limit in 2018? I was hoping for 32 gigs back in 2015.
Meltdown is far worse in practice than Spectre.

Spectre needs a more perfect storm of factors to lead to exploitation. No hardware is immune to it, but not all software is vulnerable, either. You need code execution and you need a vulnerable target and you need to somehow trigger the vulnerable targets path and that vulnerable target needs data you want.

Meltdown just needs code execution and you have full read access to all memory.
My guess is that the GP meant “huge deficit in trust” and autocorrect or fast typing made that into “huge deposit in trust”. So GP is saying that Apple ditching Google Maps to roll out its own wasn’t a good idea at that time and eroded trust (on that topic, Apple Maps is still pathetic and comical outside of the U.S. and a few other countries).
Thanks for the plug wyattjoh, I'm one of the founders of Pachyderm so I'd like to expand on what you said just a bit to clarify.

Pachyderm does use Docker under the hood, but we don't obfuscate it away, so Data Scientists get the full power of Docker (and most of the power of Kubernetes) at their fingertips. This means you can easily grab prefabricated environments such as Jupyter or Tensorflow container images and deploy them directly. Docker is so good for packaging environments we didn't want to conceal it.

On the other hand, we felt the data orchestration capabilities of Docker were pretty lacking for Data Science use cases, so that's where we've focused our energy. Volumes are a good basic tool for getting data to your code, but they're a pretty blunt instrument. How do you split data up to parallelize over it? How do you make sure you've got the right version of data? How do you schedule new computations when data becomes available? Those are some of the use cases we solve with our distributed file system PFS.
No USB A ports?
Any idea how would they fix Spectre with this update? Or tries to make it harder to exploit?
Because he said he could do it. Those millions of potential eyeballs didn't find the Heartbleed bug. And out of the "millions" of potential eyeballs how many are skilled enough to find anything?

There are people looking and finding security vulnerabilities in closed software. Why do you assume that it's any harder for a skilled assembly language coder to find vulnerabilities in closed source software. Heck back in the day I knew assembly language well enough to read and understand dissembled code and I wasn't that great at it.
Lenovo's higher-end machines are still solid, but their midrange and low-end machines are really disappointing. Sucks that you've had this experience, but among the folks I work with, Dell's high-end machines have a rep for being really reliable in both Windows and Linux. My next machine's probably an Alienware 13, but the lighter XPS 13 is real tempting too.
I went the other direction. Bought a Thinkpad due to how amazing they were in the past. Found that the build quality had gone way down. Was pretty disappointed as this expensive piece of hardware developed cracks on the casing within the first year.

Switched to an XPS 15 and have been very happy. Love the build quality, specs are good enough. Battery life is much better even on Linux.

YMMV!
Intuitive way to understand the concepts and terms behind (subtractive) synthesis: Your mouth and vocal tract!

Open your mouth in a 'neutral' position and make a sound. That's an oscillator. Tensing your throat will change the waveform (on a synth that would be square, pulse, sawtooth).

Purse and widen your lips, make a 'wow' sound: that's a low-pass filter (which cuts off higher sound frequencies).

Make a 'shhh' sound: white noise. Purse your lips, make it sound like wind blowing: band-pass filter (which only lets certain frequencies through).

Turn that wind noise into a whistle: now you're adding filter resonance. As that noise becomes a pure tone, the filter becomes self-oscillating.

Add some vibrato to your sound (like an opera singer), or change the pitch (like a siren), and you're adding modulation.

Doing this in a room, or large hall: now you're changing the reverb (reverberation). In a canyon with echoes: delay.

Often, this is also a useful method to work out how to program a subtle or complicated patch (a sound preset on a synth, so named because early modular synths used telephone patch cables to make the necessary connections).

Aside: I've often wondered what a human choir, making 'synthy' sounds, would be able to do with something like Jarre's classic Oxygène IV...
Linux kernel patches to use forthcoming Intel microcode fixes
> that render those systems immune from both exploits (referred to as “Spectre” and “Meltdown”)

The language used seems to imply that they have patched all three identified vulnerabilities.

Is it possible that if this update is applied to a system running an unpatched Linux kernel on an Intel CPU that the system is no longer vulnerable to Meltdown?

Or does this microcode update complement work done by the kernel developers implementing KPTI as well as by the browser developers mitigating some portion of Spectre?

(My initial take is that the efforts by CPU manufacturers and OS/Software developers are orthogonal to provide better coverage to affected parties, such as those on CPUs where no update exists yet)
I had the impression that the main problem was that JWT was marketed as stateless and superior and then you were stuck with stolen tokens.

How does PAST solve this? Is it even possible to get secure stateless auth?
There are two different independent governments involved. One is conservative and wants aggressive illegal immigration enforcement. The other is liberal and wants to prevent such enforcement from affecting legal immigrants and citizens. Each is sovereign and independent to a degree.

It's the same thing with marijuana. Legal in many states, but illegal under federal law.
ML tools are available in Anaconda and is where we direct our data scientists until they are comfortable customizing further.
"Works as coded"
[Infographic] 7 secrets: how to pass an interview with flying colors 5th is best
Check out: http://www.onlinejobsview.com/how-to-pass-an-interview-with-flying-colors/
We're all third world. The saying about individuals probably applies to governments and corporations: Power (or money) doesn't change you, it just reveals who you are.
Like many others, I was told by their Twitter people that coil whine on my 9560 was "not a known issue per se" and that I just needed to update my BIOS.

I won't be buying a Dell next time.
CoffeeMiner mixed with a WiFi Pineapple seems like the way to go.
And who of you lads downvoted this?
I know who they are, yeah. The folks getting talked-to are AWS, Apple, Google, Microsoft, VMWare--heavy hitters with the technical acumen to enact changes and provide useful, actionable feedback immediately. But, on top of that, the folks who've tipped that they've known about it are folks who are known for being good, cooperative partners in security matters--maybe Scaleway is too, but I can understand Intel restricting the conversation to the Big Ones who they already trust.
So is this article implying that only code executed on branch predictions is readable? What about normally executed code? What are the exact differences? How is normally executed code protected and how is branch predicted code not protected? Any experts care to chime in?
The Fundamental modules included with Rack and all other VCV-branded modules are designed by Grayscale, also responsible for the panel design of a dozen Eurorack manufactures on the market. http://grayscale.info/design-services/
Meltdown and Spectre Are Good … for Innovation
(Not the parent)

I used to love Homebrew, but I recently uninstalled it from my machines and went back to MacPorts. This was motivated by the discovery that the lead maintainer of Homebrew is a huge jerk. The tl;dr is he deliberately took offense at inadvertent rudeness in someone's GitHub comment that they had already edited to remove (he recognized this and quoted the original form from the email anyway), then subsequently threatened to ban them from the Homebrew GitHub organization for politely asking that their issue be reopened, and when I pointed this out, he banned me and deleted the relevant comments.
And that same lay person can assume some experts (including some at Google) have looked at closed source software.

But all of the people running Linux on x86 had no way of knowing that there was a bug in the x86 microcode.
This is not by or for technologists, it is by PR folks for stock-market analysts.

Far from being at risk of being fired their whole PR department is probably swelled by ranks of excruciatingly expensive corporate emergency consultants and experts paid precisely to output this kind of menial drivel.
If you fall 10 floors and die, it's not the architect's fault for not putting a handrail around the balcony. It's your fault for improper use of gravity.

/s
> The difference is that senior engineers do something resembling engineering. When not attending meetings, I turn coffee into emails and Google docs.

I like you.
I'm asking as someone who is mid level Python & DS experienced and out of real curiosity (not a "mine is better than yours" thought): Could you elaborate what in your opinion makes anaconda superior? I am frequently doing data munging & low level ML things and - so far - I am more happy with the pip side of things as a combination of virtualenv, autoenv [1], pip tools [2], pyup [3] and the rest of the eco system.

Standard procedure, takes two minutes and I have a Jupyter notebook up, smartly automated base processes for dependency management, full control of environment variables and can deploy/ integrate this in any other Python setup (if I were to port IPython code to pure Python).

Is this more a thing of each his own or am I missing a crucial advantage of Anaconda?

[1] https://github.com/kennethreitz/autoenv
[2] https://github.com/jazzband/pip-tools
[3] https://github.com/pyupio/pyup
Not good, but still thousands of times better. And don't forget that you still need to guess where to read from, which better be a very very accurate guess at that rate. Making such an accurate guess is difficult when your runtime is as complex as a browsers, and so even without that extra timing noise no PoC exists (AFAIK?) attacking browsers.

But you know... you're not wrong ;-). I'm just not particularly worried about the likelihood of this attack hitting anything I care about anytime very soon.
Came to say the same thing (or see if someone else said it). This looks like classic multiprocessing, and looks like computing, like music and clothing, is also subject to ~20-year fashion cycles for some things.
We'll leave the jail house light on for you.
Except that these CPUs were not designed to be insecure. CPU makers spent decades marketing their architectures as able to support the implementation of secure operating systems. All of a sudden it is clear that this is not possible without heavy dose of software stopgaps. It is a fundamental flaw on CPU architecture that was not disclosed by these companies.
Quoting Barton George:

> We are definitely looking into the coil whine issue, this has senior management visibility, and pursuing several avenues for the current system as well as solutions going forward.

Source: http://en.community.dell.com/techcenter/os-applications/f/46...
2018 will be the year that big, incumbent companies take on big tech
Are you saying a bug cannot exist unless some functionality is specifically mentioned in the specification, and broken in reality?
Xerox Alto zero-day: cracking disk password protection on a 45 year old system
I assume that is a difference in cultur not ability. But lack of introspection and prototyping is a surprise. After all at the end it's just a browser, which have good tools for such things. Maybe it's just not mature enough for this at the moment.
The Register does a pretty fine job of shredding Intel's doublespeak: "We translated Intel's crap attempt to spin its way out of CPU security bug PR nightmare"

http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect...
Should We Give Poor People Free Money?
Intel chips don't support LPDDR4
Do any of the frontside people use evil mode ?
And an awful touch pad?
In at least one of the variants, I believe that the branch predictor is primed in the attacker program with some value, say 0x00ABCDEF by jumping there consistently in certain circumstances.

Then the CPU switches to running another program that is allowed to access different memory. The CPU encounters a branch and predicts that it will land at 0x00ABCDEF and begins running attacker code briefly. Since it's working on the victim program, the code can access the victim program's data. After several cycles the CPU realizes it made the wrong prediction and NOPs out all of those instructions. However, the malicious code stores its results by shuffling things on the cache, which aren't rolled back because the CPU doesn't consider that to be nominal.

Therefore, the exploit can access memory from other programs. This is my limited understanding of Spectre. Reading the white paper, it must be much more complicated.

Apparently the CPU would normally stop accesses even speculatively when running from the malicious program (except for Meltdown, where it doesn't even stop that).
It's much better to say "I'm afraid for the safety and lack of equality and freedom for gay people if being gay is illegal." By focusing on Muslims, you're making it personal and ignoring many non-Muslim countries and religions which have anti-gay beliefs.

If the gay equality issue is important to you, why are you focused so narrowly on Muslims? Why not simply focus on your core issue which is equality for gays?

Making it about your fear allows people to hear you and is not arguable. Saying "Muslims are anti-gay" is arguable because you can't accurately survey billions of Muslims worldwide and statistically you'll probably find millions of Muslims who don't agree with every aspect of the religion and some that are gay themselves.

Religion and races are not consistent or homogenous. Lumping people together on those criteria is rarely accurate or productive.

For semantics, the term racism applies to race as you mentioned. If you hate Muslims that I suppose the best way to describe you is bigoted or a religious discriminator.

And as you seem intent on the pizza aspect, pizza isn't a person. While hating a pizza sounds like anger issues, it's certainly not the same connotation or implications of hating a person. If you want to be kinder to your pizza friends, you could say "I prefer the taste of thin crust pizza". If you want to be kinder to your human friends, I would focus on what you want rather than what you think a group of unique people is all acting out in unison.
Collective action problems don't get solved. The market very rarely speaks.

Government exists to curb abuses.
Not 100% sure but mostly due to battery life, the more ram you have, the more power you use. 32 gigs probably shaves hour or so off the battery (don't know for sure) and that might be the reason.
>...but those CPUs are still speculative out-of-order super-scalars aren't they?

Not universally, even in current-generation devices e.g. the Cortex A53 and A55 are in-order and were explicitly mentioned as safe by ARM.

Snapdragon 625/626 is an octa-core Cortex A53 at 2.2GHz in a lot of the current mid-range devices from almost every major phone manufacturer (Xiaomi, Samsung, Moto, Huawei, Asus, Lenovo, ...)
Ubuntu kernel don't rely on Debian. Have you seen how Debian lags behind the rest in terms of versions.
https://www.apple.com/business/docs/iOS_Security_Guide.pdf

https://images.apple.com/business/docs/FaceID_Security_Guide...

Seems pretty likely there will be a whitepaper and some conference talks about this as well.
Custom motherboards is an expertise Apple has built up over the years with the iPhone (of course they also do custom CPUs as well there!).

A huge portion of bugs and power issues on a modern PC stem from poor hardware drivers. Cutting out the middle man and just writing all the drivers themselves may very well be a net win for Apple if they want to keep a reputation for working hardware.

Then again they have gotten have their lighting out for display working quite right.
> If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks?

It does not. Unless you have specifically hardened your server to refuse to even try verifying tokens which use "bad" algorithms, a client can still present a key signed with one of those algorithms, and attempting to verify it may pose a risk.
Well I found the graph I was remembering: https://www.economist.com/node/21732803

Although I'm not actually sure exactly what the time scale this is measuring. Data is from is here, I believe: http://www.pnas.org/content/115/1/151.abstract
Very happy with my 6th gen dev edition. Only issue is the basically unusable camera, but that looks like it's been partially mitigated.
This reads like the Patrick Star's "Not my Wallet" meme.
I can't reply directly to my two comments above, which have been both downvoted and flagged because I've pointed out that the NYT has disqualifying conflicts of interest when reporting about the Iranian theocracy, and thus should not be trusted -- to the same extent it was not to be trusted when it was withholding facts about the Soviet-created mass-famine in the Ukraine.
I would imagine trying to preempt class actions.
CERT -Only way to fix Meltdown and Spectre vulnerabilities is to replace CPU
Actually, it’s a feature.