skysight-inc/HackerNews huggingface dataset:
Back then games had to be gold to be sent to the CD/Disk manufacturer, then you had to receive the copies and send them to be packed or directly to the distributors if they handled the finale packaging.
This meant that a golden sample could circulate for as much as 6 months (and even longer) before the game would go on sale.
Also as all support was pretty much phone support which also included some basic gameplay support you would have support staff often at 3rd party call centers who would require access to the game before it goes on sale (for large games at least, small companies tended to have support in house).

Today with digital distribution even if it's for patches only you don't care about the game going gold the DVD could contain a build that is utterly irrelevant pretty much every new install from disk requires a day 1 patch that can be often as large as downloading the whole from scratch (pretty much every console owner knows this, PC games also get a day one patch but digital distribution is a given for the PC market these days).

So zero-day for games at least isn't that important anymore, also DRM is harder to crack these games some games take months to crack, some don't get cracked at all, some rely on a weaken DRM version to be released (e.g. STEAM) down the line that can be cracked more easily.

For DVDs/BR today this also often happens you have full BR rips often weeks before the official release date, sometimes months just because they are already ready just waiting on the right time to go on sale or for some online distribution exclusivity deal to end.
These things should be using m.2.
I really like the traditions. I think they are a very good foundation for keeping small groups of people cooperating and I wish they were emphasized more outside of recovery programs.
London Tube tunnels are much, much deeper than anything in Manhattan transit-wise. An escalator at the Angel stop down to the bowels of the Northern Line is all you need to be convinced. Just don't stare too long or you'll get dizzy looking down. Bonus: great exercise running up the stairs.
It seems nice, but for some reason I can only set a global username for imap, rather than a per-email one. How can I log in to multiple gmail imap accounts?
What surprised me is when I realized that it was entirely possible (though maybe not probable) for siblings to share 0% of their DNA. That is, if one sibling received the "first" 50% of the father and mother's genes, and the other sibling received the "second" 50%, they would have 0 overlapping genes.
https://news.ycombinator.com/item?id=16068363

> This could be an extinction level event for less popular OSes. Intel, and to a lesser extent AMD, may end up causing enormous damage for which they'll pay nothing much.
There is a chapter on acetylene lamps I read. There was maybe 50-75 years of development by different companies and inventors trying to solve a bunch of issues with a frankly simple device. Easy enough to build a lamp the slowly drips water on to calcium carbide and burns the acetylene, that works on the bench.

Now build one that will work reliably when the miner dropped it, cleaned and refiled with water from murky puddle, in the dark 500 feet below ground.
AMD did things the "right" way, not because they understood the security implication, but because it was very hard to achieve such high level of speculation, and I think the performance gains didn't justify the effort for them.
The example I saw didn't seem that impractical.

A malicious process allocates a 256 member array. Then it creates a conditional where the speculatively executed part writes a byte at offset array + kernel_memory_value. The speculative branch is executed but then backed out, but the byte in the array was touched so it is in cache now. Then the malicious process reads all of the members of the array and looks for one that returns much faster than expected (is in cache) and they know the value of that byte. Rinse and repeat to read the rest of the kernel memory. It's not going to give you MB/s of throughput, but it's plenty fast to read some key material or process tables or anything like that.

It's a very impressive attack. My hat is off to whomever thought it up.
> There are many in which half of usually smart people can't simply understand what's the others' position about.

> The pattern is that one side considers current practice tedious, steep learning curve for professionals only, while the other side finds it "good enough". If it's good enough for you, you'll never invent something easier and faster to understand.

This is a bit baffling to me -- the phenomena to which you refer. And it seems to be more general than the pattern you outline.

It appears to have something to do with both pre-suppositions and different orderings of personal values [0]. But I'm not sure.

Do you think it is possible to generalize the structure of the process via which reasonably educated and smart people can be presented with the same facts and come to different conclusions -- that they will defend against each other in pretty feisty debates?

[0] By this I mean, for example, that some people might put individual freedom higher than equality across large populations and vice-versa.
How to Protect Against New Security Flaws Meltdown and Spectre
> “I would have a neighborhood with little 1920s, ‘30s and ‘40s single-family homes look like Dubai 10 years later,” Koretz said.

yeah, well, that would be a shame, except of course that the homeowners will have each become multi-millionaires from the sale of their property, all for the great sacrifice of letting someone else pay even more money to live there.
So where is the "secure software running on open source firmware" that you can point to as being super secure? In your x86 based PCs running Linux? In the Android devices using chips, shipped with binary blobs that even the phone manufacturers don't have access to?

How has all of the "openness" of the Android ecosystem helped customers get patches for security vulnerabilities compared to iOS users?

And no one has pointed to a real world metric showing open source software being less vulnerable and getting patches faster than closed software.

And that one poorly maintained library was the basis of a mass industry wide security problem. It wasn't some obscure backwater piece of code.
The 4K resolution is a huge bonus as well. Haven't been able to go back since going to 4K. It has the same vertical resolution as a 2K monitor on its side! Can't go back.
> he said he could do it

Yes. Not necessarily with the knowledge I currently possess or with the effort I'm currently willing to put in, but if I wanted to put in the necessary effort and study, I could. Having that option open to me has value in and of itself even if I choose not to exercise it.
It's more dense than NY as a whole, which has suburban-like areas, but less dense than Manhattan. Not by a huge margin relative to other cities.
I was under the impression that the changes for Clang with retropipe was for specter. Mitigation of it then can be done by recompiling... everything.

> Introduce the "retpoline" x86 mitigation technique for variant #2 of the speculative execution vulnerabilities disclosed today, specifically identified by CVE-2017-5715, "Branch Target Injection", and is one of the two halves to Spectre..
No it doesn't. 'Pure rationalists' means people who purely rational and never irrational, and I find it hard to believe you couldn't work that out for yourself.

The vast majority of people are not pure rationalists, and a good many of them (though I don't know exactly what proportion) are easily swayed by emotional stimuli rather than logic and reason alone. If you place all your reliance on logic and reason then you are likely to experience an unpleasant surprise because it's possible for bad actors to shape the behavior of large numbers of people in non-rational ways.

Logic and reason work on you. I'm saying that you are overestimating their persuasive power because of an (apparent) assumption that either they work equally well on everyone else, or that irrational people are generally incompetent. Sadly, neither is true. Think of religious fundamentalists whose core premises may seem irrational to you but who are nevertheless competent to act in the world and impact others, eg through terrorism.
Ya, see the difference between the DPP and KMT. Chiang Kai Shek’s legacy is also very dubious amongst many Taiwanese (especially in the DPP), who don’t align with the communists either (and let’s not get into Japan).
Economies of scale, more or less. 16:9 panels seem to be cheaper these days (particularly noticeable if you look at desktop monitors; 16:10 models carry a premium), because most panels are 16:9.

16:9 monitors are also more marketing-friendly, because the standard measure of monitor size is the diagonal. A 13" 16:10 monitor has a fair bit more area than a 16:9 one, but both are advertised as 13".
i find 16:9 allows me to comfortably fit a text editor (with tree browser, minimap, and 100 columns of text) on the left and a terminal on the right. i need to shrink the text further than is comfortable for me if i want that layout on most 3:2 displays.
It seems like the baseline of DS skill sets is all over the place, depending on where you started off.

I would have thought most DS wouldn't be interested in learning docker just to deploy. But then again, I could be wrong. What made you write the post? Was it because you saw lots of DS wanting to deploy, or something else?
> There is no evidence for trade between Europe and Africa going back thousands of years.

I take it you're not familiar with Phoenicia, Carthage, Macedonia, or the Roman empire?

> Thousands of years ago there was very little, if any, industry to speak of in sub-Saharan Africa. What was being traded?

https://en.wikipedia.org/wiki/Trans-Saharan_trade
Backstory: https://twitter.com/tehjh/status/948737135007424512

Original paper (which I actually read when it first came out earlier this year): http://www.cs.binghamton.edu/~dima/micro16.pdf

First PoC for leaking ASLR based on timing side-channel attack: https://github.com/felixwilhelm/mario_baslr
That's the niche that Box, Dropbox, GDrive, OneDrive and others are already living in. In fact, there is new generation of tools that offer way more value adds for niche uses like Zeplin for designers.
Maybe having arrays of simpler CPUs and safer full stack semantics (linear logic).

in order instead of out of order, more trivial parallelism..
TrueCar | Santa Monica, CA - San Francisco, CA - Austin, TX | Full Time

TrueCar is continuing to grow our technology team in 2018. We are hiring engineers with interest in the below positions:

* Software Engineers (Rails)

* Software Engineers (Rails/Platform)

* Data Engineers (Java/Hadoop)

* DevOps / Site Reliability / Infrastructure Engineers (AWS)

* QA / Software Development Engineers in Test (SDET)

We acquired the talent of quite a few Carwoo (YCS09) alums a few years ago. We've been around for over 10 years and went public 3 years ago. The company has big plans for the coming years and is looking for good developers to help us grow. See http://careers.true.com for the full scoop.

* We prefer you work with us in-person in our Santa Monica HQ. We'll handle most visa situations.

* Benefits are exceptional: Your health premiums are 100% paid for, we match your 401k (up to 3% of your contributions), and give stock packages. We also pay for your gym membership (up to $50/month) and have catered lunches every Wednesday.

* Our Santa Monica HQ is right by the beach and Third Street Promenade, so expect fresh air, amazing views, and plenty of food options.

We just completed our first TrueCar Hackathon which our CTO, Tommy McClung, just wrote a blog post about. You can read about on our technology blog: https://www.drivenbycode.com/hack-a-thon-winners/

Here is a video that documented the hackathon as well: https://www.youtube.com/watch?v=tlfEvPMNxuc&list=PL4s6FxzGb8...

Tech Stack: Ruby on Rails, React, AWS, Redis, PostgreSQL, Hadoop, and Elasticsearch

VISAS are handled under the right circumstances.

Send an email to me (Brett) (bemma AT truecar.com) with your resume and/or GitHub profile. Even if you're not applying but just have questions, drop me a line
CPU side-channel attacks have been an active area of research for years. Here's an incomplete list of papers. "by 2016 it got crazy so this is nowhere near complete" https://twitter.com/csirac2/status/948575368956411904

csirac2's list on reddit: https://www.reddit.com/r/securityengineering/comments/7o2uzy...
I got the touch screen for the better resolution. I also disabled the touch screen capabilities by toggling an option in BIOS
Oh nice. I know the average user is going to go right ahead and update their CPU microcode.
> Do you have any research to support your claims?

I thought it obvious from the language that I was sharing an anecdote.
I didn't because I can't (obviously) and this is a real problem, which I am trying to solve by building my own hardware to act as a root of trust:

https://sc4.us/hsm/
Now it seems to mean 'zero days of notification to the vendor'.

I think 'zero days since a patch has been released' is probably more accurate.

And those old (~1995) WaReZ sites are the reason I distrusted javascript from the beginning
"Who uses touch screens for development?"

I do! While the kids were watching TV, I was sitting next to them coding a personal project. As I was scrolling through documentation on the web, sometimes it was just easier to use the touch screen than to use the trackpad. I remember thinking to myself, "Whoa, I didn't think I'd use the touchscreen on this laptop".

If I had my quiet space with an actual keyboard and a mouse, I would not use the touch screen. But I no longer have that luxury and I found myself appreciating the touchscreen on my laptop.
IMHO 16:9 is best for coding. You can have multiple files side by side. Or a terminal next to your editor. When Debugging: Watching variables, call stack, ... next to your code.
What is old is new again:

https://www.folklore.org/StoryView.py?story=Five_Different_M...
Weirdly, you can in Europe.
Many of these files in our case are imported in Python so need to be in the codebase and committed. Some of them are templates which also need to be in the repositories.
Overeaters Anonymous has a similar issue. I can't imagine trying to quit drinking while keeping a bottle of vodka on the table.
By downloading a shared key over TLS rather than the provider's public key?

No difference from the perspective of the token consumer. From the perspective of they token generator, it means rotating per-tenant keys rather than a single keypair.
For England I want to say the crossover is about 150 years ago, could be 200, from memory. France & Germany a generation or two later, most other places later still.

The US frontier may well be different -- having almost infinite land meant it could sustain rapid expansion for a long time. I know that New England & Quebec had something like a doubling per generation in total a bit earlier, from say 1650-1800. Which was unprecedented, I don't think any other pre-industrial civilisation got close. (Mathus had the numbers and was suitably impressed.)

(Bear in mind that number of siblings looking backwards is a different measure to number of offspring looking forwards -- 2 kids/parent on average is perfectly compatible with everyone having 3 siblings, as long as they have some childless aunts.)
In the world of crypto we've known about cache timing issues forever. Writing cryptographic algorithm implementations so that they are constant-time is really hard, but also always the goal nowadays, as timing side-channels are and long have been a big deal.

What's new here is exploitation of speculative execution (branch prediction). It takes what was already difficult in the world of crypto to a new level of difficulty (or maybe not; it looks like the fix for this will be to effectively disable branch prediction in sensitive code, or even preferably by default and enable it only where it's necessary and safe).
Say you have a memory pointer to sensitive info in a CPU register.

Could the subroutine troll through memory and find it? Yes, but it would be orders of magnitude harder than having that pointer in a register.

Better example is if you are using 64 bit ints in registers as security tokens. Those should be zeroed after use and the compiler needs to not accidentally optimize away zeroing them.
Which orgs have you seen this as the biggest force multiplier?

From the sibling comments in this thread, it seems like there are some agree, and others don't. I was curious if there's a segment that does, and who they might be.
(MELTDOWN) Benchmarking Windows Emergency Patch Desktop Benchmarks.
The W520 was and is an outlier in just about every category, though. Not exactly a fair comparison...

Also, if you're going to be talking about the form factor and weight, you should probably mention the power adapter...The XPS takes a 45W, 0.2 pound little USB C device. The W520 requires you to lug around a 1.7 lbs, 170W beast that definitely qualifies as a brick. That and a lack of support for the latest NVMe drives are some of the only shortcomings, IMO.
I disagree. The attacks are clever to focus on Speculative evaluation but are otherwise fairly simple (timing attacks are well known). I'm surprised such attacks have not been discovered earlier, as speculative evaluation seems quite broken. Security is likely not a top priority for Intel and probably not something their verification teams are targeting. There is perhaps a gap in the market for a vendor focusing on secure CPUs.
Medical sales
How you can make your startup's cloud infrastructure more stable
I think there is good reason to be concerned about moving into a future where the wealthy get to live forever (or at least for a very long time) while the poor live short lives of labor. I don't think the author is saying that what they want is wrong, just that we should think through the implications of such a future when we already have such high inequality.

"The future is already here – it's just not evenly distributed." -William Gibson
Think of system calls too.
It has byte arrays and indexing on those which is equivalent to having pointers. See page 6 and 7 of the Spectre paper.
Maybe. I don’t think we pay per user on GitHub (we might still be on legacy pricing). I expect we might move to internal GitLab in the long term.
That might be a bit of an overreaction. But I will concede this is a close as I've ever seen this get to reality: http://ansible.uk/writing/c-b-faq.html

Which is really sequel to the short story: http://www.infinityplus.co.uk/stories/blit.htm , and which is followed up with http://www.lightspeedmagazine.com/fiction/different-kinds-of... (the "FAQ" I linked above is in between those two things).
My newly found issue with Dell and the XPS 13 9360 series is their insane costs.

Dell you see wont give you an indication of cost, instead you must send the laptop back at a cost of £40.

Stupidly I thought they'd be fair, but no they came back with a quote for £626. They had no interest in offering a discount - so I told them to send it back and get shoved.

£40 was the cost of my laziness. Now I'll just DIY for significantly less.

Worth baring in mind if you're not confident repairing the machine yourself.
This is the blog article: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...
Given that he self identifies as “often a dick” this doesn’t seem too surprising:

https://www.quora.com/Whats-the-logic-behind-Google-rejectin...
How did you manage the dependency versioning problem? Did you set up automated tests for that? Or did you just make sure everyone installed the same version with a requirements.txt file?
Ease of use. I run outreach events and when you have sporadic internet access, being able to give new programmers an exe to install Python with a load of useful packages is a godsend. Also, it takes a lot of the pain out of setting up a Python environment on Windows when you need funny packages that require compilation (e.g OpenCV).

I've been to enough software carpentry talks where people nod and smile, and then promptly ignore the "how to be a responsible developer" advice. They don't care. They just want to run Python and plot some stuff or classify some data without worrying about multiple CLI tools. People seem to accept Anaconda because it comes across as a monolith and it's easier to understand for new programmers than virtualenvs and worrying about pinning pip installs.

That said, I don't use Anaconda on Mac or Linux.
You're the one saying we should effectively stick with the current mechanism, despite its flaws. The onus isn't on me to provide an alternative, it's on you to defend a problematic solution.
CIX – Comprehensive Inspection of uniX
Yes. Not necessarily with the knowledge I currently possess or with the effort I'm currently willing to put in, but if I wanted to put in the necessary effort and study, I could. Having that option open to me has value in and of itself even if I choose not to exercise it.

And the option is also open to you to be really good and find security vulnerabilities in closed source software just like the researchers at Google do and all of the people who found jailbreaks.

But even then, that wouldn't have helped with the latest bug found in x86 microcode...
That's just the PTI fix. On top of that runtimes recompiled with the retpoline. The question is whether the microcode update contributes an additional slowdown once used or makes the other mitigations cheaper.
> Cargo. The only build and dependency tool that has never annoyed me.

What exactly is annoying about other build systems?

I asked that questions a few times already and I rarely get concrete answers. This time I just started a public document [0]. Contributions welcome!

[0] https://github.com/qznc/annoying-build-systems
For a learning project, I started messing around with the rodio library to generate realtime electronic music:

https://github.com/jcushman/coolsounds

As a python programmer, the part I find exciting/motivational is performance -- I can get my hands dirty writing low-level math code to dump weird sounds out to the speakers 44k times per second, accidentally wandering into interesting glitchy sounds that I don't think you would create using higher-level audio tools, and not feel limited by the speed of the language or reliance on C libraries.

(Not that Rust is necessarily the best or easiest way to mess around with low-level audio generation, but it sure is a fun way to learn.)
But isn’t it still way too expensive?

Performance wise that P100 is close to GeForce 1080. That GPU currently retails for $550.

For the price of 1 month of preemptive google’s IaaS you can buy the GPU and use it for as long as you want only paying very small amount (depending on where you are $0.02-$0.1/hour) for electricity.
But this blog is written in 07/28 last year, Google reports this bug back in 06/01, right?
No, Spectre can only read its own memory, which makes it boring for programs, but interesting for stuff running interpreted code because it can suddenly peek outside, e.g. javascript.

Meltdown goes one step further in that it can read kernel memory (but not memory of other processes either, unless it was explicitly mapped in).
More details about mitigations for the CPU Speculative Execution issue
To replace all instances of opioids? No.

It does a very good job with neuropathic pain though.
Why was this down voted? Danjoc said exactly the same: I'm surprised practically nobody cares about this. NPR was running a story about meditation this morning. Here at HN, we're all excited about a new Linux laptop with defective Intel chip included. https://news.ycombinator.com/item?id=16073039

I guess this is why Intel can get away with it. Nobody cares.
Ok, so your saying Intel wrote a poor spec and implemented to that spec, so no fault of theirs because “we implemented to the spec”?
Designing Apps for iPhone X: What Every UX Designer Needs to Know
Colorado Senator Cory Gardner torches Sessions over pot reversal