skysight-inc/HackerNews huggingface dataset:
As far as I can tell there was basically a wink-wink nudge-nudge agreement between the various browser vendors/web standards authors (same people) that timing attacks that revealed things like the users browsing history, or that allowed tracking of users weren't a problem and not sufficient to block a feature from being added to browsers. See the many issues in [1][2][3][4][5] which stretch back over 6 years (and aren't all fixed) for an idea of how long this has been going on for (and a previous rant I wrote here https://news.ycombinator.com/item?id=10022315 ).

The cache attacks never received as much publicity for some reason (the papers being harder to read may be one). I do wonder what would have happened if this hadn't come out at the same time as meltdown. It's quite possible it would have been brushed under the carpet yet again.

There were token 'fixes' to these things (coarsening timers) in the past, but they never worked and everybody involved knew they wouldn't work. The introduction of features like SharedArrayBuffer revealed how (un)seriously they really took the problem. They knew it could be used to implement high precision timers but it got added to browsers anyway because it was central to the project of making the web an application platform.

They perceive a need to allow high precision timers (or features that can be used to implement them) because without that the web won't be able to do a lot of things that are possible in native applications.

I'd like to think that this is the moment that browser vendors come back to their senses and rethink what they are doing but I doubt it. Google is a multi billion dollar company based on the web as a platform, and running untrusted javascript on other peoples computers. Dropping the idea of the web as the platform to end all platforms would be an existential crisis for Mozilla. They are locked into this madness with no way to stop that wouldn't effectively be corporate suicide. Expect years of half hearted 'fixes' which don't fix the problem.

[1] https://news.ycombinator.com/item?id=10455735

[2] https://www.nds.rub.de/media/nds/veroeffentlichungen/2014/07...

[3] https://contextis.com/resources/white-papers/pixel-perfect-t...

[4] https://www.mozilla.org/en-US/security/advisories/mfsa2013-5... and https://bugzilla.mozilla.org/show_bug.cgi?id=711043

[5] https://bugzilla.mozilla.org/show_bug.cgi?id=884270
> In some cases though that is not possible, because at that timescale the signal they're after is degraded by noise that they cannot predict or control: operating system interrupts, memory traffic from other threads, etc.

Wrong, those signals will average out over a long enough data collection time.
Debunking the myth that people died young before modern medicine
Klar is just Focus for German-speaking countries, the name is the only difference. As you note, the name change is due to the eponymous magazine.
Thanks for pointing that out. I have moved action types to constants.
Alzheimer's is from the environment
Glad to get ideas, but yes I have tried this. Multiple bugs actually. And submitted 'sudo tmdiagnose' logs with them.

And Genius bar. And phone support, second tier support. And replaced the actual physical device with a brand new one via AppleCare. And then repeated the entire cycle with the new device.
Yeah, you can easily avoid having to make an account, if you just download and compile the plugins yourself. The account just makes it easier for those of us who don't want to fuss with all the compiling and copying-into-the-right-place of the plugins.

I do both - I have all the sources for all the public modules I can find (and there are usually about two more added, on average, every day by the community... WOW!) and I build VCV Rack from sources every week or so, just to see the development pace (and what a pace it is!), but I also just go through the web page, use an account, install the free plugins through the Plugin Manager feature, and so on.

It helps to compare the two while developing my own plugins.

And I have to say that this app is amazing! I've rekindled my love for modular synthesis (been into synths since the 70's) because of this app, and its all I'm taking to my bands jam sessions these days -replacing a suite of digital/DSP synths that I was previously relying on.
Next step will be to clone ranking from some well-known music critics which would actually make it work this time. Behavioral cloning is now used heavily in computer vision, haven't seen it used in music generation yet, but I expect it to be groundbreaking as algorithm would be able to discern certain qualities that pure generating sequences won't.
AA refuses to publish the data on their effectiveness. Which tells me they are not as good as other secular options.
On Control Flow Hijacks of Unsafe Rust [pdf]
NeXT was never about UNIX, rather about all the other UI/UX.

They only based it on UNIX, because they were going after Sun, and just like Microsoftm, UNIX compatibility was a way to bring software into their world, not to out of it.

Now Apple does not need to use that path any more for their survival nor do they care about servers, what matters are Objective-C and Swift OS APIs, not C ones and very latest version of POSIX CLI utilities.
I think what they mean is it's fully set up, so that if you've never used Emacs and you start using it, you won't encounter the situation where something stinks and your friend who's an experienced Emacs user says "oh, you need to customize such and such." So, "awesome by default" rather than "awesome after many hours of learning about and applying configuration changes." (I have no idea whether what they've done would meet that criterion for a large number of potential users.)
Does anyone know if you can actually write code on Emacs, like HTML/CSS/Javascript?

Do you mean modifying Emacs while it is running?

If you switch to the "* scratch * "[1] buffer and type one of these and after each of these either press «Ctrl-J» or «Alt-x eval-print-last-sexp»:

(message "Hello, World!")

(setq cursor-type 'hbar)

(setq cursor-type 'box)

(setq indicate-empty-lines t)

(setq show-trailing-whitespace t)

Is this what you meant?

[1] I have no idea how to get a normal asterisk on HN.
The Register translation of the Intel spin is quite amusing:

https://www.theregister.co.uk/2018/01/04/intels_spin_the_reg...
Hi - there are tons of great VCV patches available here:

https://patchstorage.com/platform/vcv-rack

A couple in there might qualify for your "full stack" requirement - or are at least pretty close.

I'd be happy to hear you found something - for my needs I've got a 'full stack' consisting of a 4-voice poly VCO/VCA/VCF standard, a little sequencer, and a drum synth - but its not really in a condition where I could share it since I built some of the modules with special configuration from sources... however, if I've wanted to sit down and create a stack from the standard modules for a while, so .. lets see who gets there first! :)
Staring into those deep field images sometimes gives me an out-of-body sensation. The vastness of it is so over-the-top.
Yes, but they might have focused more on Windows, which is not so easy to fix. Esp in microcode. The NT kernel fixes were already out for months, there the table layout is not as simple as in Linux, whilst Linux is still discussing it.
For Linux microcode you just need to look at the first bit for a permission check. Not so with Windows.
I've been using Firefox alongside Firefox Focus (Klar, since I'm from a German speaking country) for a few months now and I like the setup.

Focus is registered as the default browser on my Android device, so all normal links open up there. When I need to do something where I'd like to keep logins active (or something like that), I manually open up Firefox. The only thing that bothers me is that there are no tabs, so you can only have one session of Focus at a time.
SmartInspect: Smart Contract Inspection Technical Report [pdf]
I imagine they don't have any data to publish. I can't see how they would collect it.
I'm interested in this escorting platform, as I've been considering building one that is designed from the perspective of protecting sex workers and enabling them to operate more safely, as opposed to shitshows like AW that are just awful and exploitative.
Not Tetris 2 – all the upsides of Tetris and all the downsides of physics
I will (almost certainly) never switch from my current configuration to use any of these all-in-one package bundles, but I do like looking through them for ideas.
It isn't obvious at all how a separate address space would block that method.

What would block it is flushing the branch predictor state when switching privilege levels and/or address spaces.
No, because that’s exactly what rope isn’t.

The crucial step is understanding that you can link objects with a bendable but strong connection.

Then you can start innovating applications, such as multiple people working together to move a single heavy object.

Eventually you end up with previously unimaginable applications like horse bridles and ship rigging.

The point of invention isn’t a new tool, it’s a completely new class of tools with an open-ended set of applications that aren’t immediately obvious.
Interesting story. I remember having heard on radio another story about tang (https://en.wikipedia.org/wiki/Tang_(drink)). Excessive consumption was causing flatulence that was the cause of a dispute during a space mission. I was not able to find anything about it using google.
I think (and I say this with love) that any sane person who starts using emacs will find it infuriating- its part of the appeal.
This is basically an arms race. As long as the fundamental issue is not fixed and all silicon replaced, there will always be people coming up with new ways of exploiting the Spectre vulnerability in unexpected ways.
My prefered way to quickly test these things without having to mess with your own setup, elpa directories etc:

mkdir /tmp/.emacs.d
wget -P /tmp/.emacs.d https://raw.githubusercontent.com/thefrontside/frontmacs/master/scripts/init-frontmacs.el
echo '(load (expand-file-name "init-frontmacs.el" user-emacs-directory))' > /tmp/.emacs.d/init.el
env HOME=/tmp emacs
Is it "fucking USERS, man"?
@ASmallFiction had a beautiful, succinct take on this recently:

"Are we alone in the universe?" she asked.

"Yes," said the Oracle.

"So there's no other life out there?"

"There is. They're alone too."

https://twitter.com/ASmallFiction/status/946608733982822401
When using an IDE, memory consumption can be tolerated. Indexers, analyzers, open files, sometimes other tools which run with the IDE.

However, to spend 800Mb to change a single file is too much. Atom is not a complete IDE as VSCode or Eclipse by any means. Yes Atom has IDE packages and capabilities are started to be rolled in, but it's too young.

God knows what will be the memory usage of Atom when it grows to a complete IDE with project-wide knowledge.

Also, having enough resources is never a good excuse for an application to use massive amounts of memory.
Just the Naltrexone and it was simple and painless. I wish I had done it 15 or 20 years earlier.
Today, we've run low on the scope of reasonably easy to invent things that are actually valuable. All the obvious "wish we could X" things have been done or are nigh impossible for any one person or small team to figure out

I disagree. There are a lot of small inventions that are happening every day. I've had independently ideas that are now massive sites or products.

If you want to know why things have taken so long, have a look to usual flamewars here. There are many in which half of usually smart people can't simply understand what's the others' position about.

The pattern is that one side considers current practice tedious, steep learning curve for professionals only, while the other side finds it "good enough". If it's good enough for you, you'll never invent something easier and faster to understand.
From the guidelines:

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.
Graphics programming, 3D debuggers, 3D drivers issues and power management are other caveats.
You're assuming that all life will be like ours. This is a safe bet, but there could be very many ways for life to exist.
>Why are you participating in these discussions if the only solution you have to offer has been tried and failed for most of human history?

I'm sorry, I was unaware of the existing solution that has succeeded at solving all social problems in the countries in which it's implemented.
It installs vim.
I wished the benchmark included the Micro editor. It is really intuitive.
> So no, there is no unbiased, high quality mainstream media.

At the same time, the first unbiased & objective human being has yet to be found.
No? The data for the makeup of energy in the universe is mostly from CMB anisotropy (plus various measures of how fast the universe is accelerating, like how much supernovae have been redshifted). Finding out that galaxies in the early universe used to be smaller and more numerous than previously thought doesn't much affect any of that. (there's quite a lot of different data sources now all pointing towards an omega_lambda of 0.7).

To be clear, per the article, the new discovery isn't about the early universe being a significantly different density (i.e. anything other than 'approximately flat', total omega ≈ 1) than the current one. Like, it's not that there was more mass-energy in it that's somehow vanished, rather that it's just distributed between more & smaller galaxies
I concur! As someone who has spent, probably, close to a quarter of a million bucks on synth/audio hardware over the decades, I'm extremely keen on VCV Rack because it lets me design my "perfect" Eurorack setup without any investment, other than the time to get it set up - and more to the point, it lets me experiment with my setup, refining it, without buying a single cable. So once I get my stack configured the way I like it, I'm quite likely to go ahead and switch over to reality and buy all the modules I've used, so I've got it in the real world too.

A truly amazing bit of software, and it has also been a very rewarding experience to be an early adopter of this suite, because the progress made so far by the developers is nothing short of astonishing - not to mention the uptake and adoption by a lot of the more cocktail/unique modular designers out there ... many of whom, seem to have taken VCV Rack as their new standard test-bench for working out ideas before hardware prototyping - meaning we have a huge plethora of modules to play with!

Anyone interested in synthesisers NEEDS to put a weekend or two worth of effort into learning VCV Rack and creating their own stacks. Its really a very, very valuable bit of software - and its free! And its open source! So, you interested-in-programming-synthesizer-algorithm folks can get started with very, very little fuss, already ..
Mercalli earthquake intensity scale
~8 hours charging at work is a plenty to top off after a 60 mile trip. However, 80 mile EV's are not designed for people with long commutes. I live 4 miles from work and their are charging stations in the office parking lot. So, based on my habits an 80 mile EV would cover 99% of my driving just fine.

However, I still think ~300 miles as the practical minimum because I do take longer trips and know I would occasionally forget to charge sometimes.
Interesting - I've been thinking of trying it out but was going to use a clinic like contral.com in Finland. Maybe I'll just see if I can find a local doc who will write me a script
This opinion comes around often and what bothers me a bit is this "free" in free healthcare. There is no such thing. Eventually the money for the people and things has to come from somewhere.

The conversation is often about how do some EU countries have free healthcare and US doesn't. The answer is higher taxes, longer waiting lists, lower quality, no support for extreme cases and low accountability.

"Free healthcare" countries often cannot afford these modern cutting edge treatments so people often end up leaving for US to pay for the treatment themselves. If US didn't have such a brutal healthcare system then who would do the research since the "free healthcare" countries cannot afford it?
Not just the same code, but in many cases, the same developers! So there is a vested interest in making things match as closely as possible - it sells hardware, after all!
How does healthcare becoming free (i.e. government funded) make the question of cost and benefit moot? If anything it becomes more of an issue because now such decisions are being made by political appointees and bureaucrats.
I got 10 or so in one region, 10 or so in another region, and 32 or so in asia. It was all spread out. It really seemed like a capacity issue. This was in March 2017.

In fairness, Google was pretty transparent about the whole thing. It had a lot more personal touch than the other providers. Google set me up on a call with some of their engineers to discuss autoscaling. But at some point the communication broke down a bit or maybe interest was lost in helping with my issue. Concluding with the realization that they didn't support managed instance groups with GPUs yet, and that was that.
I used to think all healthcare should be free. One observation changed my belief:

“The demand for healthcare is effectively infinite.”

There really is no limit to a person’s healthcare needs. It’s a moving target. The only way to make all healthcare free would be to start by defining exactly what is and isn’t healthcare. That’s exactly what is upsetting about the concept of government provided services. At some point someone will have to say “enough.”

Who would decide that, and how?
Another very annoying bug. When you press the Home button with your non-Touch-ID registered finger, an "Enter Passcode" screen will appear. But when you cover that finger let say with a tissue paper and press, nothing happen. So I can not unlock my iPhone 6s when I go jogging as I put the phone in a case with a clear front plastic. Even when I use the AssistiveTouch and place a virtual Home button I get the same bug. But this bug does not occur all the time, probably 80-90% of the time. Did Apple change the TouchID feature to require sensing our flesh in order to work?
https://www.reddit.com/r/todayilearned/comments/3bco7e/til_a...
"Discounts apply to the aggregate number of vCPUs or memory within a region so they are not affected by changes to your instance's machine type."
1. Expand my development horizons. I've been a .NET developer for most of my career, and I've recently taken a job at a company that is mostly Node/Ruby. This year, I want to learn enough RoR, Django, and Node to be able to contribute wherever needed.

2. Compete at blue belt at a BJJ competition. I've a fresh blue belt, so my training needs to be more consistent in order to hang at that level.

3. Learn to enjoy travelling more. For the first time in my life I've got the money to travel and see the world, and rather than being constantly anxious of being somewhere different I want to embrace it.
And for importers, it's the Mazda Eunos.
Exactly. The invention isn’t the physical object, it’s the idea - the realisation that a certain class of objects/processes can be useful in unexpected and open-ended ways.

Wheels are almost useless in dense forests that have no roads, for obvious reasons. So why would anyone waste a day or two making one?
Skylab had a flatulence problem: https://history.nasa.gov/SP-4208/ch16.htm
Is there any advantage of using this instead of the classic Firefox + uBlock?
Didi's Got 99 Taxis. Brazil's Just One of Them
Your question is a bit too vague. TrustZone by itself doesn't really give you anything. For instance, by default you run everything w/ TrustZone bit set unless you do something different during boot.

In general, I would say TrustZone is not special at all (yet) in regards to immunity to side-channel attacks. See: https://twitter.com/bryanbuckley/status/912458210191093760 On the other hand, TZ (NS bit) was a bit special for ARM so maybe they paid more attention to it (i.e. maybe it matters greatly that addresses are tagged NS/S for the HW, unlike x86 which was not designed to consider addresses part of securable boundary between modes/rings?). Or maybe ARM still opted for speed over security, in some surprising/disappointing ways.

However, that may be a moot point if you can execute arbitrary code in SWd and if something like Spectre might leak SWd usr to SWd usr (since you could then use normal communication between the SWd/NWd)?

Of course folks will experiment and we will know in the coming months.. if a TEE vendor does not first make a comment (e.g. linaro). Also remember that the TEE folks have different OSes (some are micro-kernels that are more security-focused).

Curiously, I saw the blog post in August last year and it reminded that it was during OMAP5 bring-up that I think I sent my first ever patch to lkml, dealing with aborts being spammed (being originated via speculation; aborting because we had a region of memory dedicated for TZ). A15 had introduced a deeper branch prediction buffer, iianm.

I can't find the final patch. Hopefully my sign-off was just omitted rather than the commit living in some OMAP specific fork. My RFC patch was pretty dumb (basically I disabled speculation during early linux loading, re-enabled once "the real" page tables were ready to activate) so better programmers took the helm and I confirmed the fix..

So anyway.. at least on OMAP the hardware _seemed_ to disallow any access at all across TZ boundary, even by hardware. Then again, you can't really trust this reporting/aborting (good sign at though) and would have to verify yourself w/ some PoC attack.

And obligatory mention that The Mill seems like a better CPU arch.
Undoing in Git
If you look in frontmacs-config.el you can see this setting:

(awesome-mode t)

/s
> Electron can do better

Think of electron as a single tab open in a browser instance. If you open 12 tabs in chrome, it doesn't use 12x the RAM, because most of the initial RAM is used maintaining the browser instance, not the rendered tab. most electron apps don't have "tabs" but if they did they wouldn't multiply the memory usage either
Terry A. Davis of TempleOS fame has been dong something similar: awake for 32 hours, then sleep 16 hours. Judge the effects on his sanity yourself.
Well I spend most of my Android coding with the NDK, and I consider it lacks lots of love.

While some things are understable due to the security issues of using C and C++, having to use JNI to call native libraries on device (Skia, libpng, ...) or C for C++ APIs, feels less understandable.

Or how gdb support is hit-and-miss, depending on device's firmware.

Oh and the fun of combining CMake, ndk-build and Gradle experimental plugin builds.
Same here. My Emacs is always on configs of my own, but I do mine other peoples' configs for ideas like crazy.
Both!

https://www.emacswiki.org/emacs/TabsSpacesBoth