skysight-inc/HackerNews huggingface dataset:
I'm using Firefox 57 on Ubuntu. You may want to hide the markers until someone hovers over the title in question, like in the Django docs[1].

[1]: https://docs.djangoproject.com/en/2.0/
Can you tell with any degree of precision what kind of benchmark the "GeekBench" is and does ? What guarantees do you have that it is testing "real world common workloads" ?

Do you think common users execute guassian blurs in a loop and ray tracers before perfoming rigid body physics in their "common workloads" ? As you said, I know I am welcome to argue for a different kind of workload, specially when I am being taken for a fool.
Note that `dmesg` prints from a fixed-size ring buffer, so if your system has significant other output (e.g. if you create and destroy lots of devices or such), it's very possible the boot-time message about page table isolation will have fallen out of the ring buffer.

If you use journald, it by default saves the kernel's ring buffer to disk, so you can use it to check for that message:

sudo journalctl -b -o cat | grep "page table isolation"
From my cursory reading I understand it is a cleverly orchestrated timing attack.

In other words, if something would need 500 picoseconds you have bit 1, if it is 250 picoseconds instead it is bit 0 (numbers pulled out of thin air).

This is made possible because processors execute the read speculatively even if it is actually forbidden. This read causes a cache hit. Of course the read is never brought into effect because first it is forbidden and second it is in a branch which will never be executed. At the time of the speculative read the CPU seems not to have enough information to know not to execute that read. Even speculatively.

And that speculative read has a side effect on the cache which is measured by the exploit.

Of course the read is never made visible to the process because later the CPU knows not to bring it into effect. However then it is too late: there is measurable difference in caching times.

Did I understand the way of the attack correctly?
Yes, i forgot to mention that the build should be done from a more powerful system :-).
I wonder how much of that performance difference is due to "Three.js vs Unity/Unreal" rather than "WebGL vs Native GLES".

AFAIK Three.js is still missing standard optimizations that are taken for granted in a "real" engine, like batching and occlusion culling, and some optimizations it does support are scarcely used due to poor tooling. Pre-baked lighting and compressed textures are technically supported but there's no easy workflow to pre-generate the necessary data.
> To be fair to Intel, mitigating this type of issue isn't at all trivial.

It's understandable that they may not have been able to mitigate it in the 8th gen CPUs in just a few months, but they also put those CPUs out on the market, advertised them, and sold them, all the while they knew of their design flaw, without saying anything about it to the unsuspecting customer.
The original sin is JITing JavaScript.
Thanks, I'm happy to read similar experience from other developers.
Cautionary tale to tame your ego.
If I don't have to run minikube, and instead get something equivalent just by installing Docker for Mac, that's a minor win.

If Docker's local Kubernetes install provides a way to connect to custom registries (e.g. GCR) without installing a third party plugin onto every minikube, I'd consider that a major win.

https://github.com/kubernetes/minikube/blob/master/docs/inse...
I've used this debugger for quite a while. It's excellent. Clean UI, feature rich, and all around stable. The UI is familiar (kinda like olly), but also new fealing. Highly recommend
Wow. Love the colors.
This is a replacement for minikube, i.e. a local dev k8s cluster.
Homeschool Science Fair Projects
In the age of fancy JavaScript webapps, this seems laughable. 2 or 3 tabs in Chrome is enough to turn my laptop into a space heater.
As the Debian announcement says:

* https://lists.debian.org/debian-security-announce/2018/msg00... (https://news.ycombinator.com/item?id=16076175)

It's not the only operating system where the process is slightly more complex than a kernel update. Windows NT updates require the coöperation of other softwares on one's machine. (-:

* https://news.ycombinator.com/item?id=16076660
I can report the same with both Rails and Elixir. People reach for outside search tools far too quickly.
Ubuntu say they will release a patch on or before the 9th of January.

They got caught out by the embargo being ended early.
A good way Intel could say sorry is to have a new generation hardened cpus at a good price.
Thanks for your feedback, I obviously agree with you, but I'm starting to plan to use PG FTS with Django also in some bigger project. I hope to write another article about it in new future.
Show HN: Pretty print mysql binlog to the console
As I understand the microcode updates get installed by Linux distros and Windows by updates. Microcodes are loaded by the CPU at every boot.

The question is, how can one check if the CPU already got the microcode update?

Can a OS running inside a VM (over Intel VT ring-1) patch the CPU's microcode? (e.g. Linux host, and Win guest patches CPU's microcode) Nothing seems impossible anymore.
This is definitely not a trend here in SV. Never heard of that.
It's not supposed to install via "apt upgrade", as that command won't pull in new packages or remove packages. Unlike most, kernel packages can co exist so they are all separate packages. Thus need the extra "apt-get dist-upgrade" or "apt full-upgrade" variants as they are new dependencies.
ESCORT KAROLINA – ESCORTS – ESCORT ATHENS – ESCORTS ATHENS
TL;DR: Some businesses will forego an option to connect with a US supplier rather than try to send a lawyer through customs.
When build stuff on a real slow platform a trick I have used is to setup distcc on the slow computer and at least one real fast computer with a compiler set to the slow computer's arch. Set the slow computer distcc to 0 so it compiles nothing locally, but it does do the configure/linking/etc. This avoids almost all the cross compilation issues you might run into while getting many of the fast benefits.
ES6 Language Constructs and Their ES5 Equivalents
Is there a particular reason why you can't enable JS yourself? Metered connection? Low-end machine?
Big glasses, bigger shoulder pads.

Why is this on Hacker News at all though?
> Our penetration testers would see it in their HTTP request monitoring tools!
> What hours do they work? My code doesn’t send anything between 7am and 7pm.

Which Time Zone? Hah!

(Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything)
Even if you had that, no one is going to inspect all that code. npm is a cluster-farkle of insane amounts of packages.

The whole point of the article is you should implement CSP.
Atomic Swap Execution Between Scorum's Graphene Blockchain and Litecoin
>There's no point adding another padlock to the outside wall of Fort Knox.

Strongly disagree. No single defense measure is infallible and defense in depth has proven one of the most important topics in computer security.
Couldn't one circumvent CSP by sending the data to a legitimate analytics service that everyone uses like Google Analytics?
It is absurd. Obscenely absurd.

Rockefeller could literally pay an army of people to fan him with palm leaves, make sorbet from the ol' ice house and make him fresh iced tea as he walked around town if he wanted.

What the fuck does Rockefeller care if the carrying capacity of agricultural land increases due to the Haber process if his personal consumption would remain the five-star best-in-class ingredients for every meal he ever has if he so chooses. He doesn't care about the mean's position. He is the tail.

The existence of air conditioning and the Haber process doesn't make the life of the working poor better than his.
Why not just have a GIN index on the expression to_tsvector(body, 'english') or whatever? Then you don't need to maintain a separate column.
The browser’s? People do tend to keep their PC in the local timezone.
First thing that struck me - no earbuds.

Reminds me of this funky dance video my uncle made in the early 90s.

https://www.youtube.com/watch?v=P0opXVKNgfM
I've never heard of your project but woke up this morning when my phone started buzzing with alerts from issue #1864. Looks like my account somehow has ended up starring and watching your project. That probably explains why you have replies to that issue saying "Unsubscribe" and "what?"
I'd argue that the author is criticising cynicism, rather than skepticism. Healthy, genuine skepticism should take into account the amount of scientific attention devoted to a topic.

When I was young I read a book called Bad Thoughts by a philosopher called Jamie Whyte. In hindsight it wasn't a great book, but it did leave me with the memorable phrase "Cynicism, like gullibility, is a symptom of underdeveloped critical faculties."
I’m toying with converting mine from arch to FBSD on the same machine — where did you get the drm-next bits? Is it from Ports or a branch on /usr/src? I bought a dongle to try it out but somehow ended up with one of the few unsupported ones... which one are you using?
> All the fast ARM cores are vulnerable to one of the two meltdown flaws

Do you mean Spectre? Meltdown is the Variant 3 in that link.

> It affects WAY more ARM processors than A75. All the fast ARM cores ...

The ARM cores listed on that page are not all the ARM cores in the market (or running in the real-world). There are many more ARM cores than listen in that table, and the page says any ARM core not listed in that table is not vulnerable to any variant of Meltdown or Spectre.
For one thing, the fixes are up in the Linux kernel for anyone to see.
The debian security announcement for stretch says

> For the oldstable distribution (jessie), this problem will be fixed in a separate update.

You can check https://security-tracker.debian.org/tracker/CVE-2017-5754 whether the KPTI patch has been released for jessie.
As far as I am aware, you cannot get ES/Solr quality ranking + fuzzy search out of the box.
> you can just start hacking up something nontrivial on THREE.js and you'll come out of it knowing most of WebGL.

Sorry, but this is wildly untrue. I don't really know where to begin, but you wouldn't even need to touch shaders to accomplish that, so no, you wouldn't know most of WebGL. THREE.js is very much a thick abstraction over WebGL.

> And in doing so you'll eventually realize that even WebGL itself is quite "high level" -- there is a _huge_ amount of abstraction that you take for granted in the browser.

Also not accurate. WebGL is a -very- thin wrapper over OpenGL ES, which is itself as low level as you can go without stepping into something like Vulkan. There's almost no abstraction.
This seems like a no-brainer. If you don't want CBP digging through your data, it's not hard to backup and wipe your phone before a trip. Or just buy a cheap burner for travel purposes.
Yikes, I gave them the benefit of the doubt and assumed they drilled to the source below ground. Literally anything can happen on surface water - one of your workers comes to work sick and shoots a snot rocket into the creek fed by the spring, rabid skunk dies and tumbles in, etc.

Ground (preferably very deep) has far less that can spontaneous go wrong if you follow good practice - no barns or significant domestic animal activity, no composting, etc
Informally, a Nash Equilibrium is:

If all players write down the strategy they are going to play on a sheet of paper and show them to all other players (can include randomisation) then no player would have a strict incentive to alter their strategy.

With rock paper scissors, if me and my opponent both write down 1/3,1/3,1/3 randomisation, then neither of us would strictly benefit from doing something else.

Your [1/3,1/3,1/3], [1,0,0] is not a Nash Equilibrium. Whilst the second player does not have a strict incentive to change strategies, the first player can switch to [0,0,1] and win every time.
here - https://www.elastic.co/guide/en/elasticsearch/reference/curr...

similarity/relevance is the mathematical difference between search and database query. Its an inexact match.
NAR waarschuwt voor “Sukru”
Depending on the ES version, it either does TF/IDF (older versions) or BM25 (newer versions) by default. You have to explicitly disable it if you don't want it.

https://www.elastic.co/guide/en/elasticsearch/reference/curr...
Health Benefits of Drinking Water: How Much Water Should You Drink Every Day?
I think there might actually be something going on weird with this project on Github's end. I've never heard of this project but started getting alerts in my email for it this morning. My account has apparently stared and watched this project. I hadn't used that account for awhile and the security page for my account doesn't show any logins for my account except from this morning, which leads me to believe that it probably wasn't compromised.
Hi grawprog, the lessons are taken from the free university textbook on Biology by Openstax. (https://openstax.org/details/books/biology)
And everybody looking straight ahead rather than down at a smartphone
We can't be certain what would have happened had they chosen otherwise. But I find it very hard to believe they wouldn't've done better by switching to an existing cross-platform web language.
I've always recommended getting a "Pro" or Mini and recommend avoiding the iMac completely. Throwing out a huge, decent monitor simply because you need more processor power and/or storage is (sorry) asinine.
I wouldn't trust recruiters if you're still starting out. Went through the process! Ad Agencies dunno ?
hyperbole and nonsense
Nope, sorry but you're completely wrong on this. UDP is better because head of line blocking will causes large delays during packet loss.

Source: I used to write networking stacks for realtime games.
If you are opting into these "programs", you are already part of the problem.
Metered wouldn't really matter would it? Scripts are still downloaded, right? (never had JS off, because the web)
Can you expand on the difficulty with synchronization? With ES I understand because you have to build it from scratch. However Solr has the DataImportHandler [1] which is made to sync data from a relational database.

1. https://lucene.apache.org/solr/guide/7_2/uploading-structure...
Bitcoin mining being pushed out of China: how the shutdown’s being managed
I’m referring to all the stuff Docker machine does beyond apt-get install docker. It sets up TLS certs and sockets do you can control the docker daemon remotely. When docker machine works it’s great, but when it doesn’t it’s frustrating.
Skip That Newborn Vitamin K Shot
I don't think this is equivalent to the VW emissions cheating ... I guess we could find out otherwise later but if so it would amaze me that such a large and variable organization kept a secret for 20 years.
Jai Language Status Update
Quickbooks enterprise! The web version of QB fries not meet out inventory needs. The desktop version sucks! But it is industry standard.
Understanding the React Source Code – Initial Rendering (Simple Component) I
> As for how this was all handled by the companies involved, well this could be described as a textbook example of how NOT to interact with the Linux kernel community properly. The people and companies involved know what happened, and I’m sure it will all come out eventually

I'm looking forward to that story.
That's better, except someone would then complain that "first" implies that it's the world's first and happens to be in Australia. We used your suggestion but reordered the phrases above.

Edit: actually, I think we can get around all this by just using the first sentence of the article.
The definition of 'criminal' changes over time too but that doesn't prevent us from prosecuting those who we determine to be criminals today.

Regardless of how the subtleties of politics shift over time, someone who enters a country seeking to kill and destroy should not be a allowed inside regardless of what they're called.
Very cool! This looks really helpful for integrating canvas elements within a page.

I was thinking of making a similar library for doing smart, reasonably efficient drawing/graphical annotation relative to the positions and dimensions of DOM elements in screen space. Right now, my method has been to create a single canvas with fixed positioning and stretch it across the screen.

Then, I do the somewhat tedious work of translating between elements' bounding rectangles and positions into this space.

You can see the technique in action here: https://micahscopes.github.io/tangled-web-components/example...

The dogs are custom elements and the edges are drawn on a fixed canvas.

A big part of why it's so tedious to go from DOM coordinates to fixed canvas coordinates is that there's not an efficient way to get notified when a DOM object's position changes relative to the screen (e.g., because you're scrolling or resizing the window) or the body.

Right now, with MutationObservers, you can get notified when an objects bounding box changes (ResizeObserver), AFAIK there's not an efficient way listen for updates to an objects' screen-space position, so you have to poll getBoundingClientRect... and it's not scalable!

Check out the top comment on this discussion:
https://developers.google.com/web/updates/2016/10/resizeobse...

The question is "where's PositionObserver" at? Anybody know?
I've overridden ctrl-r in my local Bash to search with fzf[0] and I'm using my history so much more now.

Didn't know about ctrl-o though, it sounds great! I hope that my ctrl-r override doesn't somehow break it.

[0]: https://github.com/junegunn/fzf

E: Fixed link.
> Why is this on Hacker News at all though?

Because it is technology-related, is my guess.
> Going with your analogy, this would be like training a net using a database of lock structures and their corresponding keys, and then having it predict a key for a given lock.

If we have that, then the problem is entirely trivial- just look at the lengths of the tumblers, and give the key teeth that match. And so it is, with the corresponding increase in complexity, in biology- given a complete and confident structure of the target, we have (non-AI, reasonably reliable) chemical modelling methods to see whether and how a given compound will bind; iterate molecules until you find one that works and you've found your "key" quite cheaply. So, there's another limitation to the practicality of AI- when it's not irreducibly complex and intrinsically unknown, biology is usually mechanistic and deterministic enough that conventional approaches can reason about it quite effectively without resorting to anything so fancy as a neural network.

Biology is almost always more complicated than a given description, so yes, the real problem is more complicated. As you mention, the key we create must not only fit the target lock, but it must also not fit any other locks that might cause problems. Perhaps AI methods could try to make a working key that is un-key-like as possible, to make it unlikely to fit off-target locks; potentially useful. But, absent knowledge of the various perverse configurations that locks in the wider world can have, the confidence the AI method's inferences are very limited- roughly speaking, it's attempting to make a classifier for a population that is mostly unknown. We might hope for a severalfold increase in the number of successful drug candidates, in the best case, but not a fundamental disruption of the pharmaceutical research process.
As someone who has to occasionally modify 100+ line bash scripts written by Coworkers from Christmas Past which matched your spec in terms of what they had to do, please please just use Python (or similar).

Yes, you will have a few extra lines but it will be vastly more readable and maintainable.

And yes, I know I will get the standard the person who wrote the script did a bad job but at some point it should be okay to blame the tools instead of the workman if workmen disproportionately create worse results with a set of tools.
It was autokilled before I vouched for it.
Id' imagine they dont include it because the descriptions are very intertwined and complicated. I don't even know what they all mean but I usually just google this mess.
Debian didn't break the kernel CSPRNG — they broke entropy seeding for OpenSSL. Debian could have unbroken OpenSSL seeding by reading from /dev/urandom.
Don’t forget it randomly picking what device to send audio to. Every day it’s a lottery for me. Is it the left or right monitor? The built in dac in my elgato dock? Or maybe it’s the laptop in clamshell mode.

Then there’s the case of it getting an ip from the docks ethernet.

And all of that is assuming the thing even wakes up.
This is a problem for the PHP composer ecosystem as well. I took a look at how many vendor packages our core has and its about 20...
That's some wells. When I was growing up, my parents' well was pretty much untreated. The water was a acidic so that first morning drink of water tasted of copper. I suspect most of the safety came from arranging the conditions so the water would be safe by default. There is a minimum depth for the well and it needs to be a certain distance from the septic system.
Right, I agree.

But with your easier Swarm setup, how do you then attach cloud disks directly to your docker container, like a PersistentVolume affords? That one feature makes basically anything worth it, IMO. Most apps are stateful.
Most design is unnecessary when it comes to plaintext.

Personally I disable most fonts and limit the sizes to improve my browsing experience
I'm using Firefox 57 on Ubuntu 17.10. Thanks for your suggestion about the paragraph markers. I'll update it. ;-)
Timing the L1 cache response for speculatively fetched data that one could not normally access is just one of the problems. It's the one that it is easiest to explain, and it's also the one that the few operating system writers who were told about this tackled first. Hence it is the one that is getting the focus in many discussions.

* https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne... (https://news.ycombinator.com/item?id=16080002)

* https://dev.to/isaacandsuch/how-meltdown-works-28j2 (https://news.ycombinator.com/item?id=16085592)

One of the other problems is tricking the branch predictor into speculatively jumping into code of one's choosing.

* https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... (https://news.ycombinator.com/item?id=16079910)
If you want to try some real wasabi, you can get it from Oregon Coast Wasabi (aka Frog Eyes Wasabi):

http://www.thewasabistore.com/

They sell the graters too. (You don't want to use an ordinary grater.)

I haven't tried their wasabi myself, but heard about them a few years ago and have been meaning to order some ever since, so this thread reminded me to look them up again.
Pseudoscience dreck.
You mention Newton’s method, but of course that requires second order information which, as I mentioned, is not generally workable in high dimensions. You have to be careful with quasi-Newton methods like conjugate gradient for the same reason.
It'll be in GDP eventually when the child ends up less productive.
It's client-side code. So the browser's time zone.
I do think the monitors are partly to blame. They seem to want to go into low power mode right before the computer sends a signal.
Business conversations end up over email anyways, why not start them there?
dupe: https://news.ycombinator.com/item?id=16081158