skysight-inc/HackerNews huggingface dataset:
I would guess they are fairly focused on it at this point.

They are releasing microcode update mitigations for the CPUs of today, and at least state they will be improving things in the CPUs of the future, which is more-or-less what one might guess they would do with billions of dollars at stake.

That's not to say that they are going to magically get rid of all speculative execution, and I wouldn't try defending their PR approach, but one would guess they would at a bare minimum whittle away at the cost of mitigations.

Some related snippets about at least declared future intent. This obviously isn't a comprehensive list, but I think it suggests they realize the current state of affairs is not good for them:

From LKML[1] related to approach taken with the new microcode update for variant #2 being better/less costly in future CPUs:

Later CPUs are intended to have an 'IBRS all the time' feature which is
set-and-forget, and will perform much better, I believe. If we find
we're running on a CPU with that, we'll turn off the retpoline..."

And from today's Intel PDF regarding variant #2:

There are three new capabilities that will now be supported for this mitigation strategy.
These capabilities will be available on modern existing products if the appropriate microcode update is
applied, as well as on future products, where the performance cost of these mitigations will be
improved.

And from today's Intel PDF regarding variant #3:

Future Intel processors will also have hardware support for mitigating Rogue Data Cache Load.

And a related comment from the always reputable source of "some security guy on the internet"[2]:

Whatever mitigations CPU vendors come up with will be in concert with software changes. "Page table isolation" is an overnight redesign of all operating systems. It's here to stay. The next step is for Intel CPUs to fix its performance cost

[1] https://lkml.org/lkml/2018/1/4/432

[2] https://twitter.com/ErrataRob/status/949194584399237120
For any search term I enter, the first 5 results are ads and only one actual result fits on my screen. What the actual fuck.
They're not partially executed. The branch predictor only fetches instructions. They might be decoded, but it's not an out-of-order processor-- pipeline stages only proceed if the previous phase is correct.

Here's the Cortex-A53 pipeline: https://www.anandtech.com/show/11441/dynamiq-and-arms-new-cp...

It's an in-order CPU, so that "issue" phase (pipeline step 5) stalls until the instruction pointer is resolved. Instructions must be issued to the "AGU Load" functional unit, which is what actually performs the read and pulls data into the cache hierarchy.

Note also that a single speculative memory load is insufficient for Spectre. You need two speculative memory loads.
The new keyboard isn't "hyper fragile" -- it's pretty great.
Nice timing. This follows up well from my previous HN comment, that timers are everywhere. Pretty much any operation that has a small predictable time can be used as the basis for timing something else.
I can see how a pithy hashtag could be misconstrued, and I doubt that is how the hashtag was intended.

It shouldn't mean assume the accused party is guilty, it should however mean don't dismiss the injured party. If someone came up to you and said "James broke my leg" the response shouldn't be "No he didn't", but it also shouldn't be "Let's beat him up". It should be "Hey lets help you get that leg fixed up, and help you get an investigation started". What people presently face with sexual assault, especially when bringing up cases against people in power is "No, not them, that didn't happen, you're making that up because you want something." It's not limited to just women, Terry Crews was sexually assaulted in an elevator and couldn't even use his massive muscles to pop them like an orange because of how that would appear. He didn't speak out because he didn't think anyone would believe him. So when people say believe the victim it doesn't mean assume the accused party is guilty, but rather it means don't just dismiss the victim when they say someone hurt them.
I can see why this is attractive in some circumstances. I don't see how this can be reconciled with copyright law. How can Anonymous Hacker show that they have auhority to transfer a clean copyright in their contribution? If you accept an anonymous patch, aren't you also accepting liability for all possible encumbrances?
This Jamie Dimon crypto sticker pack is amazing
In tech? How about Intel - Moore, Grove, Otellini. Nintendo - Yamauchi, Iwata. Microsoft, obviously.
> As a man, learning to code also changed my life. Would anyone like to read about my story and my perspective as a man?

Probably there is an audience for it, but probably not particularly either the audience for which the Glamour article is primarily published (who aren't men) or the HN audience (among whom men who already know how learning programming changed their own life are decidedly overrepresented.)
Needs some work...

https://imgur.com/a/Nt23F
Well put. What I would like to see is a public discussion around what constitutes a power dynamic large enough to make sexual advances unacceptable. Any two people have some degree of power differential, after all.
There is a market to take here: Javascript as a Service, to bypass CorpNets.
The top developer resources from 2017
Their reasoning probably rests on the word 'minimum', which you are typing but also completely ignoring.
ArrayUDF: Breakthrough data structure
Is it really necessary to have a vacuum procedure?

Isn't it possible to just use a data structure to index rows by transaction ids, and on each transaction commit efficiently find all rows that aren't visible to any transaction, and add them to a free list?

Seems kind of a bad design to rely on periodic full data scans.
From what I understand of this set of bugs, is that code executed by the branch prediction logic can access privileged memory that it normally wouldn't have access to. And that the CPU can't generate a protection fault, because it isn't known at that time if the code really would have tried to access that memory.

So would it be possible (through a microcode update) to mask the memory values, so that ANY read from privileged gets a NULL value returned?

Or could that cause issues, due to the fact that a branch that doesn't currently have access to a memory segment, may be granted legitimate access to it by the time it would normally be executed?
No, it's V8 that has to make sure the privilige check variable is in L1d cache when the if happens.

KeePass uses HTTP, and by the time it sees the request, it cannot do much if it's valid.
Can they walk to visit friends, the local shops, park, school, library, etc? All of these things were much more important to me as a child than a big backyard.
She clearly states that she is not a developer. For most of the article she is working in 'Customer Success,' and often distinguishes herself and her cohort from the engineers. In fact, it seems that a major theme in the article is what it's like to work at a tech company without being a developer.
The Future of Transmit iOS
What Self-Awareness Really Is (and How to Cultivate It)
I could not disagree more.

In a world where great injustice have happened, the solution is rarely to abandon the legal system in order to right the wrongs. Too much collateral damage.

The article encourage us to discuss how to right the wrongs without abandoning the legal system. That would be a nice discussion to have on HN.
This is spam, probably for malware. They give no reason to trust them, their site is a series of blogposts that only contain inane promises, and they're owned by a company who developed "Adverify," which seems to be some service to see how well your ads are getting past blockers.
Have been recommending CASI to everyone who listens.

Everyone has their own unique datasets. And anyone can install data science platforms such as Anacondas. But being able to map a particular algorithm to the inference you wish to make. And understanding, from a historical context, precisely what that inferences means at a philosophical level. That is where this text will assist on your path to mastery.

Computer Age Statistical Inference

https://web.stanford.edu/~hastie/CASI/
What does this portend for RISC/V and other architectures?
Except the easy way to increase productivity is to fire all the low paid workers, productivity would go up but I'm not sure that would be desirable.
"~$800M on failed drugs for every ~$900M in revenue" Do you have a source for this? Looking at big Pharma the marketing budget is at least 2X the R&D budget so the numbers really look off from what you are posting?
Introduction to Deep Learning Using MXNet
As it happens, not only do they remember, they actually organize their nut storage in geographic chunks: https://www.scientificamerican.com/article/squirrels-can-sto...
"worth" maybe?
Unless customers absolutely raise hell, this is going to be very good for AWS. Suddenly all of these autoscaling setups are going to consume 30% more resources in order to achieve the same throughput.

My expectation is we may see AWS apply some significant discounting to AWS services as a result, though that doesn't help all of us who utilize mostly prepaid reserved instances.
They are probably the largest TEE* supplier AFIK even bigger than Intel; they are pretty much the Java of the TEE world.

It’s a joint venture between ARM, Gemalto and a few other companies iirc.

*Trusted Execution Environment
One somewhat self-serving justification Intel might make for this claim is that the functional specification does not say anything about the specific behavior that is being used by the exploits.

In addition, functional specifications are sometimes modified to conform to as-built behavior. When used responsibly, this is a reasonable response, and in practice unavoidable for something as complex as a modern processor.

On the other hand, Intel's statements are silent about what implications cannot be found in the effort they and others are putting into mitigating this feature.

Tangentially, the Titanic sailed with the number of lifeboats it was designed to carry.
Not only that, but the US Government (the US tax payer) has invested vast sums of money into furthering prosthetics technology over the span of many decades (heavily derived from the desire to aid wounded soldiers). They're one of the primary entities responsible for why prosthetics have seen the advances they have.
That's a VERY hard question to answer. And of course there is going to be situations where a Manager legitimately is romantically interested in a subordinate. It's going to happen, it's not even that out there of a scenario.

I think the most logical step is to get this shit out of the news cycle entirely. Accuser and accused should be out of the public eye for as long as we can possibly manage. The problem is so many mechanisms in both private corps and even civic orgs are shit, which is why women are going to the media instead because it's the only way they get listened to.
Good article. the timestamp is from 1st January; I wonder why the date of publication isn't included in the text. I wasted several minutes trying to figure out whether this was a new or old article.
Japan's 700-year-old 'oke' craft gets a modern makeover
In this case, intent has no bearing on its utility.

What should guide the rhetoric of social movements is, to take it back to your college GE writing class, the consideration of "writer-based" vs. "reader-based" writing. In the former, you write what you feel based on how it makes sense to you; in the latter, the intent of the writing is to convey a message in the way that the audience can comprehend it.

That hashtag will and does imply "the accused is guilty." Something that would convey the intent you describe more directly would be along the lines of #DismissNoWomen or #TakeHerSeriously.
> I don't think the title is representative of the article.

I think the article does an excellent job of communicating why the article should be of interest to the audience Glamour targets.

Which is, after all, the whole point of a headline.
The Well Appointed Skinner Box (Farewell, Medium)
> the bank is sending it out, so it is economically productive anyway

Even if the bank is just 'sending it out' to someone that is using it for property speculation?
If you want to search "privately", Search Encrypt will allow you to do so. Bing, however, tracks users and links their searches to Microsoft accounts. We also have expiring browser history so anyone with access to your computer will not be able to see what you searched for.

We explained how this works in this post:
https://blog.searchencrypt.com/tech/remove-search-encrypt-ex...
Looking at Pfizer last q. for example revenue 53 bil. R&D 7.5 bil
(I can't access this article, so I hope people will excuse this comment that is not informed by the article.)

That all depends on how much Person A and Person B enjoy watching coprophagia performances, doesn't it? If either Person A or B wanted something more with that $20k, they could have gotten that instead.

The $2k I spend at the opera each year doesn't increase "wealth, prosperity, or productivity" from the view of people that don't enjoy opera, but I certainly feel that it increases my prosperity.

The bigger problem with the GDP is it not counting serious economic activity that does not have an exchange of dollars, such as child care in a family. A stay-at-home parent does not get compensated for their work, but that work definitely has value as evidenced by the cost of day care.
His "origin story" for free software relates to a printer, and being unable to see the code (I think the driver rather than the firmware). His whole point is that software can be changed, and if only a vendor can touch the software for hardware you've purchased then you're entirely beholden to them.

Of course on some occasions the software isn't going to be able to compensate, but Stallman's ideas about why free software is important are grounded in some very practical realities.
If you don't feel overwhelmed enough by the misprediction variant of Spectre yet, consider that the cache side effect of speculation is actually desirable in most normal cases, because it helps prime caches with data that is likely to be used in the correct branch as well. Just turning it off is not the right way to solve this.

Perhaps this will finally provide enough incentives to model data sensitivity in the type systems of practical programming languages.
...like a particular painter and WW1 veteran in Germany that the than current art world dismissed...
They don't have "this" problem -- but they certainly have problems. Kind of ridiculous to suggest otherwise.
> So when people say believe the victim it doesn't mean assume the accused party is guilty, but rather it means don't just dismiss the victim when they say someone hurt them.

It does mean that. That's what the word "believe" means. I understand you're trying to say that people's intentions are to instead support all women, but that's exactly the problem. That's not what "believe all women" means.
Ask HN: When can I expect to buy an AMD chip with a hardware fix for Spectre?
The post is titled "why you should be using a private search engine" and yet there's only a paragraph at the end that's subtitled:

Why You Should Use Private Search Engines?

Here's the entirety of that section:

The truth is, people know that search engines are
tracking them. Most websites have privacy policies
which clearly state that they use cookies and other
means of tracking users. Any in many cases, when we
are asked to give apps, websites, or products
permission to track us, we blindly agree. This may
seem acceptable at first, but it’s problematic if that
same tracker is following you two years later, when
you’ve forgotten about it.

Your search engine should be optimized for searching
the internet, not tracking you once you’ve left. Your
Google information can be used against you in legal
cases, even in civil cases like divorces.

So if I understand correctly:

1. You might forget about trackers you've accepted.

2. Your search history can be used against you in the court of law.

They couldn't come up with anything better for this ad?
It is interesting that all security measures that Tor developers implemented gave them exactly nothing. The researches were able to get the same 2ns resolution as with stock Firefox.

I wonder if the measures in FF to counter the Spectre will fire any better.
Show HN: Sibylant graze, play the multiplayer word game Contact (Haskell/WS)
I don't know about an event. I think people will just stop buying Apple because of all the frustration with their products. I think it'll be subtle and one day we'll just all realize that, "hey, Apple used to be worth $900 Billion, now it's worth half that."
I think that this is a natural consequence of a world in which it's impossible to have a dialogue about some things. There are some topics in which it's essentially impossible to have a reasoned discussion about things that we disagree over.

This article talks about one: it's impossible to have this discussion with most people (including friends and family) because as soon as someone questions the generally accepted opinion, they're put on the defensive (in this case: "OMG why would you defend a molester?"), and the entire discussion becomes one of trying to defend yourself, and not about what you're trying to discuss.

The same thing happened with the Googler who questioned the idea of whether the tactics used for trying to improve Google's male-vs-female pay discrepancies. Instead of anyone responding to points he made in any sort of rational way, the discussion was immediately turned into "how can you defend someone who says women are worse than men?" -- not at all the case, but a quick way to avoid a factual discussion by pigeon-holing a person who dares to deviate from the generally accepted opinion.

This has also spread to politics: it's impossible to have any sort of reasoned debate about "hey, maybe <insert your favorite politician here> isn't literally the devil across the board" -- the conversation immediately becomes one of trying to undermine the person ("OMG I can't believe you're defending Franken, a man who has assaulted women!").

It also happens when people try to debate things like whether the "Yes means yes" laws are useful, reasonable or effective; I've never seen a reasonable discussion about this (online or in real life), because if anyone questions it, they're immediately on the defensive, trying to argue that no, they're not defending rapists, and no they're not against a safe environment for women. Politically, it's brilliant marketing, because there is absolutely no way to argue against it without being immediately pigeonholed as a rape-defender, and then spending all of your time trying to dig out of a hole that you've been put into.

It's unhealthy, and I think leads to echo chambers -- no one dares to voice an opinion unless they know people will agree with them. And this ultimately makes the problem worse, I think, because without a reasonable dialogue about issues, and without being able to accept the fact that people may have logical reasons to disagree with you, I don't really understand how things will get any better.

Edited: Dialog -> dialogue
Direct links to each role:

Sr. Software Engineer - https://www.workable.com/j/517731C0AC

Director of Data Science - https://www.workable.com/j/56B45C90A7

Enterprise Account Executive - https://www.workable.com/j/CE4A04AD6B

Technical Support Engineer - https://www.workable.com/j/5385EE67B5
The GPS signal in below thermal noise at ambient temperature [1]. Using your logic you would say that then it would be impossible to extract. However, with clever math you can extract a signal which is below the noise floor.

Particle physicists are experts at this, extracting tiny signals from huge piles of noisy data.

[1] https://sdrgps.blogspot.co.uk/2016/02/find-signal-in-noise.h...
Ironically enough, RMS could probably be using the most side-channel-leaking CPU on his computer and it wouldn't matter... because he is the sole user and runs only his carefully-chosen free software on it.

His thoughts on cloud computing, however, are very much worth listening to.
You can simply use Sci-hub. I don't see any moral argument against it. The research that you want to access was probably entirely done by researchers who don't get a dime of the subscription money of publishers.
Continuous Verification for Cryptographic Protocol Development
Healthcare is heavily rationed in socialized medicine systems. That's why wait times are so extreme in Canada, and doubled from ~1990 to 2015.

Rationing is the same exact thing as what you're talking about. They're choosing who gets what medical access and when. If you're 92 years old and you want an extremely expensive surgery or treatment in Canada, and it's only going to prolong your life by 18 months, you are not going to get that treatment, period. The same applies in France and Britain. Rationing is a required tenet of socialized healthcare. I'm not saying all rationing is bad, however pretending that under socialized healthcare it's just a free-for-all, is flat out wrong.

A very recent example of the rationing squeeze:

"N.H.S. Overwhelmed in Britain, Leaving Patients to Wait"

"Cuts to the National Health Service budget in Britain have left hospitals stretched over the winter for years, but this time a flu outbreak, colder weather and high levels of respiratory illnesses have put the N.H.S. under the highest strain in decades. The situation has become so dire that the head of the health service is warning that the system is overwhelmed."

"Some doctors took to Twitter to vent their frustrations publicly. One complained of having to practice “battlefield medicine,” while another apologized for the “3rd world conditions” caused by overcrowding."

https://www.nytimes.com/2018/01/03/world/europe/uk-national-...
Yes, that's exactly right and why it's hard to sell "security" and how we get to an voluminous x86 ISA.

My own speculation is that we got here in this industry
though a complete absence of liability. Bugs are not a
big deal, they are _expected_ now.

The only counter example I know of is Knuth's bug reward
system.
Introduction to Modern Cryptography (2005) [pdf]
About ten of us are playing in https://modalduality.org/sibylant-graze/play/lobby if you'd like to join!

A bit about the technical stack: the server was written in Haskell using WebSockets. Source at https://git.modalduality.org/sibylant-graze/tree/.
If you're interested, there's a whole load of them: https://duckduckgo.com/bang
Interesting. I see how that can follow, for example, from the bit about her friend who won the hackathon lottery. Also from the "What is it like to be fun? What is it like to feel like you’ve earned this?", though she writes that when she's talking with a developer who isn't actually in silicon valley.

It still seems like a bit of a stretch to infer that from the text, this feeling upset because of her own brain being manipulated by random rewards making the payoff seem higher. But it's a self-consistent interpretation and better than any that I have so I'll take it.

Thank you for taking the time to write it!
An example of why I generally jump to the comments on HN before clicking through. Because the OP's info is sorted alphabetically, there's little guidance on what's supposed to be eye-catching, nevermind that what we're supposed to be concerned with is literally not in the OP (as of posting time).
Another angle to consider is that well to do Indian immigrants in the US, while less likely to follow the traditional codified restrictions of caste, are quite likely to engage in their adoptive societies' own (often unspoken) rules around class.

Hence, in places like the US, Indians are more likely to have professional spouses, whether those spouses are Indian or not.
TLDR: @realDonaldTrump can post whatever he wants and we won't do anything about it. Also, we claim that he doesn't impact our growth.
Translation: Only closes some low-hanging attack vectors.