skysight-inc/HackerNews huggingface dataset:
Pensions make a lot of sense ... they spread out the risk (notice this also means they spread out the rewards :). Now, the actual level of pensions is a different matter ...

Notice, also, that if you only give pensions for 'full' service (say, 20 years) you create a big incentive for people to stay exactly 20 years ... both people who should leave at 18, but stay 2 more years 'doing time', and people who get screwed because their boss knows they have to stay 2 more years (kind of like H1 abuses). There's no good reason to not make them increase linearly with time.
The MMU isn't part of this attack, and there are ARM cores with MMUs that are not affected. Cortex M cores are in-order CPUs, so they do not have branch prediction or perform speculative execution which the attacks rely on.
Update: performance.now() will generally get you ~20µs precision now: https://blog.mozilla.org/security/2018/01/03/mitigations-lan...

Also I neglected to mention other frame rates; 60fps is the most common, but you do get some 144fps devices, where you’ll be looking at about 7ms delays rather than 16ms.
My journey with Rust in 2017 — The good, the bad, the weird
To get you with Spectre, the attacker must be able to run code on your CPU.

This affects browsers with Javascript enabled because your Javascript engine runs foreign code on the CPU. The bad guy puts nasty code in a page, you visit the page, the code executes on your machine--boom.

And it affects public cloud web servers because multiple cloud servers (virtual machines) run on one CPU. So some attacker might be able to jump out of their VM and read your VM's memory.

BUT, on a dedicated hardware web server, there shouldn't be any foreign code running--no foreign VMs, and no browser.
This project would really benefit from some examples.
Let's say this were a company that you're very sympathetic toward. Or not. In either case, couldn't it still be a honest bug (as in, an "honest mistake"). They should still take their responsibility, held responsible, in court if necessary, but let any one of us who is without bugs, throw the first stone? Or is Intel somehow special? I sincerely ask you.
"Digital audio workstations have become increasingly sophisticated, able to emulate with "plug-ins" the capabilities of sought-after analog studio gear of the past. It has taken a bit longer for virtual instruments to meet this same standard, but they may be nearly there."

Hardware is much more hands on, with real dials, switches, and other means of physical interaction which screens and mice don't come close to matching. Hardware does exist through which musicians can interact with computers, but it's usually MIDI, which has its own limitations compared to fully analog gear.

With hardware you generally don't have to worry about software or OS updates, and the hardware generally continues to "just work" for a long time.

A lot of uncommon analog hardware is very unlikely to ever be modeled in software, so the way it reacts when manipulated may never actually be matched in software (even when the potential to do so is in principle there if anyone ever bothered to create a high quality model of it in software). This extends to how it sounds as well, for the same reason.

That said, modular synth software like this is still great, and may be the next best thing to using the real thing. It's also a great way to learn and get a taste for what's possible before committing money to buying any hardware.
Show HN: TopHN – When you have time for only one Hacker News story
Actually, Peter Thiel uses a lot of analogies with the game when discussing business strategy
That article's only evidence is some sparks flying that look exactly the same as the welding in other mfgs videos.

The link to the cheap spot welder is a bit over the top as well.
> we are disabling or reducing the precision of several time sources

I am really happy to see this happening at long last. One can argue that almost every x86 SW side channel attack (Spectre and many prior ones that, for instance, leak parts of cryptographic keys from variable-time SW implementations) are being aided by userspace processes having access to high-frequency/high-res counters for which, in almost every case, they have no legitimate need. Perhaps future silicon should block direct access to the TSC & friends, except for processes that have a privileged flag set (hardly a new idea; IIRC some IBM PowerPC chips from the late 90s support that).

OS-level timing calls such as gettimeofday() could be degraded to a few microseconds resolution by default - poor enough to obscure delays caused by the state of various HW caches, branch predictors, etc.

Ultimately there is little reason to give every website js program access to a nanosecond-level counter by default, and many defense-in-depth reasons for not doing that. So kudos to the firefox team here and hopefully chrom[e|ium] quickly copies this.
According to this comment, it has been theorized for quite some time:

https://news.ycombinator.com/item?id=16066165

With this particular computer scientist, who talked about this problem before, referenced in Google's paper:

http://www.cs.binghamton.edu/~dima/
Daily
DO ::
Stay present
Exercise Everyday (intensity/duration may vary, but never ever miss).
Coding every day - Python
Create a passive income.
Eat less sugar.
Be for the most part silent, or speak merely what is necessary, and in wise words.

In every affair consider what precedes and follows, and then undertake it. Otherwise you will begin with spirit; but not having thought of the consequences, when some of them appear you will shamefully desist.
Read a book for 30 min daily.

Provide things relating to the body no further than mere use; as food, knowledge, clothing, house, family. But strike off and reject everything relating to show and delicacy.
Make purpose-driven Internet life.
Less consuming, more creating.
Less time reading random stuff online and social media, more time writing and learning.
Continue my porn-free streak to prioritize real life sexual experiences.

Schedule every minute of your day.
Be generous and kind.
Be Alpha male.
Avoid swearing, if possible, altogether.
Avoid public and vulgar entertainments.
Avoid a frequent and excessive mention of your own actions and dangers.
Keep yourself pure from familiarities with women.
Drink less tea.

Be one man, either good or bad.
Aim for perfection.
Do it now.

Always do stuff adding value to life.

DON'T ::
Don't waste money and time.
Don't focus on others life.
Don't watch or read movies, nonessential books, sexual material and porn.
Don't be excited or rush.
Don't exhibit or paralyze patience.
Don't compare yourself.
Don't allow your laughter be much, nor on many occasions, nor profuse.
Don't repeat.

No haircut or shaving on Tuesday and Thursday.
Don't speak loud.
Because most people don't know what any of this means. To nearly everyone else it sounds like Intel was hacked. But so what? Nearly every company has been hacked in the last three years, so it just doesn't seem like such a big deal.

Obviously this is completely wrong but it's how the general public and walstreet will interpret it.
Here you go mate! https://outline.com/yHTRHn
> I want the most vile pieces of shit to have their chance to speak... so that I can talk to them. I can talk to those who will listen. I will combat their ideas.

While this idea is admirable, fascist/Nazi dialogue has shown again and again that fascists are not interested in "fair" debate. All they want is a larger audience so they can pass on their views -- and look at America. Do you really think that the hundreds of thousands of people debating Richard Spencer[0], Steve Bannon[1] and Milo Yiannopoulos[2] has stopped the spread?

No! In fact, it has enabled them to spread their sources of propaganda further into the world. Now even centrist friends of mine are linking to Breitbart as if it is a valid source of information[3]. Some viruses and infections you can only kill through isolation. Fascism is one of them.

[0]: In case that you have any doubt that Spencer is a Nazi:

Instead of asking how we can make reparations for slavery, colonialism, and
Apartheid or how we can equalize academic scores and incomes, we should
instead be asking questions like, "Does human civilization actually need the
Black race?" "Is Black genocide right?" and, if it is, "What would be
the best and easiest way to dispose of them?" With starting points
like this, wisdom is sure to flourish, enlightenment to dawn.
-- Richard Spencer, "Is Black Genocide Right?" (2012)

(https://rationalwiki.org/wiki/Richard_Spencer)

[1]: Bannon has voiced support for UKIP and Front National. The former is an close offshoot of Britain First, one of whom murdered a British politician a year or so ago (He had a golden eagle statue and a shrine to Nazi literature). The latter was literally founded by a member of the SS, Pierre Bousquet. FN has also been known to murder French politicians. (https://rationalwiki.org/wiki/Steve_Bannon)

[2]: https://rationalwiki.org/wiki/Milo_Yiannopoulos

[3]: https://rationalwiki.org/wiki/Breitbart.com
The point is; if this mission to create a Google-less alternative is so important and necessary, why not join force with the people who are already working on said alternative? Surely, having all these developers working on one project would be more effective than having all of them working on multiple similar projects?
Tesla Falls After Musk Delays Model 3 Production Goal Again
Let's not call that "inflating numbers". No company will publish a detailed report on their users, costs and revenues.

I am making the argument that a company saying it has millions of users and is growing is not enough to judge of its current and future situation.
Seems like you didn't install it after all!
Ten Immutable Laws of Security (2000)
Oh that is quite a generalisation!
The attack is all about bypassing memory protection, which without an MMU to provide any, is moot --- code has access to all of memory to read normally anyway.
Hmm. Is OpenBSD patched for Meltdown? I don't see anything on their main site.
I'd say having worked on CPU architecture, regardless of the success or failure of it, gives Torvalds even more credibility talking about this sort of thing.

Having said that, though, I think calling it "crap" is a bit much. But that's still a pretty mild/weak insult in Torvalds-speak.
Go, Do anything, it’s great.

I’ve done painting woodworking, soldering circuits , and ‘hacking’ some furniture, it feels great.
If the claim being made is "well obviously they should have just done foo and it would have worked," there's reason to believe that foo gives you a significantly less competitive product, and the speaker is not giving any evidence for why it's possible to do foo and still succeed in the market, the only thing we have to go on is the speaker's experience in that market.

A rigorous argument for why foo can be done and doesn't kill your product would be fine too, but this email doesn't even attempt to do that. What can be asserted without proof can be dismissed without proof.
There's Grid https://github.com/paboyle/grid , which is a general data-parallel code in development with the help of Intel. And there's the USQCD software stack http://usqcd-software.github.io/ which has communications and data-parallel layers (and then applications layers which you don't need unless you're doing lattice QCD). That stack tends to be annoying to compile and can be tricky to use---I'd look at Grid.
Why is SAB different from other improvised clocks? Are other operations too slow?
If hinton pivots too like Jeremy Howard to cryptocurrencies, we will know a new ai winter is upon us.
This can be fixed with a more reliable integrator, at the expense of computational speed.
Any of the Chinese ones based on MediaTek SoCs. They're not only unlockable, they come that way by default.
Yes, I've read Manufacturing Consent :) Fully agree.
Which could mean huge sales for Intel, or even AMD, if Amazon, DigitalOcean, Linode and others want to rush to get that lost performance back.

Going to AMD would be incredibly expensive as you'd be replacing nearly everything, but if Intel gets new chips out in a reasonable amount of time, they might actually make a killing on this.
My post states that it's already been sold. I assure you I have no affiliation with this site or domain.
lol good exercise, I liked the idea
Every article Paul Krugman has ever written?
> Thus they are basically saying "you're fine if you don't run untrusted code" --- something which bears repeating since it is the only positive thing in this whole debacle.

Except for that whole web thing that has most of the world running untrusted code just about every minute of every day. Security hygiene doesn't protect you from this.
Firefox and Chrome have both started posting mitigation strategies. They're mentioned in other comments, some depending on making time functions less accurate since this is a timing attack.
Man, this is some really scary stuff.

Intel seriously needs to up their game because AMD is going to destroy in 2018 if they don’t. Like it’s not even a joke anymore. How does a multi billion dollar corporation let something so huge like this slip past? It doesn’t make any sense.
Thanks for posting this link. The original link works for me (probably b/c I use university proxy which provides access to the journal; without it I get the blank page too).
I do this a lot in unit tests where a pattern is repeated.
This is the article I read that talked about it. Sources are a the bottoms, and they seem legitimate.

https://hackernoon.com/spotifys-discover-weekly-how-machine-...
Well he was right about the Intel ME vulnerabilities
If you transfer back right away then you not only don't make profit but end up leaving money on the table due to the fees.

When difference is higher then your total fees, you can cash out for a higher amount of dollars for the same volume of bitcoin.
Maybe it was sucked up in miners fees?
LEDE and OpenWrt projects merge
Meltdown and Spectre attacks
That new residential neighborhood on Kiely Boulevard across the street from Central Park is where the prior Kaiser medical center was, going back to at least the 1960s.
Silicon Valley's First Founder Was Its Worst (2017)
In theory the dig once law/s will make a big difference, along the lines of what you're talking about:

https://arstechnica.com/information-technology/2017/03/natio...

https://www.fhwa.dot.gov/policy/otps/workplan.cfm
I am pretty sure the patch needs to be applied on the host kernel and not the guest.
disable javascript
> I want the liberty to compete with Spotify, Pandora, Google Music, iTunes, etc. without fear of debilitating litigation.

Feel free to do so. Of course it will be an uphill battle and a very complicated process, but I guess that applies to competing with any kind of major service, regardless of its category.

> I want to enjoy music without ever sacrificing my security or privacy to DRM.

Again, you can. Buy music from the shop of your choice - it's yours. No DRM, no strings attached.

> Just because the music industry is in a significantly better position than others does not make it good enough.

I still don't understand what you're missing.
Agreed, not really sure what the point of the website is if it's just some sliders with nothing actually playing.
Intel was aware of chip vulnerability when its CEO sold off stocks
What bugs have you observed in the X399 Taichi? Coincidentally, I have the same board (since TR launch) and haven't even updated the BIOS -- it just works fine for me.
Not quite. If p isn't prime then 2^p - 1 isn't prime.
This is not true. Hate speech laws are designed to address speech that promotes violence against identifiable groups of people.

For example, Canada's hate speech law: http://laws-lois.justice.gc.ca/eng/acts/C-46/page-73.html#h-...

Section 318 says that you can't incite genocide. Fair enough right?

Section 319 says that you can't say things that willfully promotes hatred against an identifiable group. (Unless those things happen to be true, or even if you reasonably believed them to be true. Or if it was a private conversation. Or the things you're saying are in the public interest.)

This means it's actually really hard to convict someone of hate speech, at least in Canada. Under section 318, you have to get the governor general's approval to even bring the case.

I can't comment on the German law since I don't know German, but I'd imagine it's similar in nature.
I don't know to what confidence ssh-keygen and the like test their candidates, but it's not hard to make the probability for composite smaller than the probability that the computer doing a proper primality test is hit by an asteroid while doing the computation.
Most of the genius would be in the algo. The code would be simple enough. So I presume he or she has a finance background
An analogy that was useful for explaining part of this to my (non-technical) father. Maybe others will find it helpful as well.

Imagine that you want to know whether someone has checked out a particular library book. The library refuses to give you access to their records and does not keep a slip inside the front cover. You can only see the record of which books you have checked out.

What you do is follow the person of interest into the library whenever they return a book. You then ask the librarian for a copy of the books you want to know whether the person has checked out. If the librarian looks down and says "You are in luck, I have a copy right here!" then you know the person had checked out that book. If the librarian has to go look in the stacks and comes back 5 minutes later with the book, you know that the person didn't check out that book (this time).

The way to make the library secure against this kind of attack is to require that all books be reshelved before they can be lent out again, unless the current borrower is requesting an extension.

There are many other ways to use the behavior of the librarian and the time it takes to retrieve a book to figure out which books a person is reading.

edit: A closer variant. Call the library pretending to be the person and ask for a book to be put on hold. Then watch how long it takes them in the library. If they got that book they will be in and out in a minute (and perhaps a bit confused), if they didn't take that book it will take 5 minutes.
https://news.ycombinator.com/item?id=16067322
Show HN: React-Redux-Sass Starter Kit
Funny thing, for a family car I think the Model S is perfect, and every other electric car is too small. We're on our second Chrysler 300, just because I can't find another similarly sized, similarly performing car that's half as good for that kinda money. A model S would cost twice as much, although I'd sure love to have one!

The Bolt is TINY! Family car? For what? A family of dwarves?
Nothing much (in percentage terms) got invented until the industrial revolution. The question is why the industrial revolution took so long. If you are interested in this topic I highly recommend A Farewell to Alms [0] - warning controversial hypothesis, but it raises lots of interesting topics to think about.

0. https://en.m.wikipedia.org/wiki/A_Farewell_to_Alms
MacOS 10.13.2 fixed the Intel KPTI issue
No, much more likely that they A/B test headlines. It's standard practice among news orgs at this point.
Somewhere in this, is my ~50K of BTC. Mined in the extremely early days, well before that first bitcoin pizza, back when people were still enthusiastically trying to decide if this whole “distributed ledger” thing was implemented correctly and just how good of an idea is it at all.

I used a 32 node OpenMosix cluster/lab to CPU mine just shy of 50K BTC one lazy semester break after finding out about this BitCoin thing and thinking “this will make a neat distributed stress test” much more interesting than just running the usual CPU benchmark toy programs. I fired it up, let the shell scripts fan it out till every core in the cluster was busy, and checked back about two weeks later when the next semester started. I made a note of the number and my shell scripts, deleted the wallet because its just useless data on my preciously small university school student home directory. I moved on with my life and completely forgot about it until recently when researching some cluster history I recalled the OpenMosix work I had done at University, the various ways I had used it, and to my temporary horror, the BitCoin benchmark.

I’ve come to think of it a bit like a failed lottery ticket or a bad bet at a casino. I had no way of knowing at the time 10 years ago, that the couple of megabytes of space these files took up, could one day be worth half a billion dollars. That’s not to say i’m 100% zen about it, it does still hurts a little to think about sometimes though.

Edit: Corrected my time window, a decade does wonders for compressing the experience of time passing, thinking about it again reminded me that the bitcoin block reward meant I must have run it over the semester break, not overnight.
I didn't have Solid C++ background instead I have been working with python,java, javascript and ruby mostly Can I apply ? Thanks!
https://github.com/calclavia/DeepJ/tree/icsc/archives/v1
> CA electricity was privatized, and we got Enron.

Texas electricity was privatized, and they got inexpensive, dependable electricity. It also hasn't held back renewable energy construction, Texas has chosen to utilize its immense wind potential for example.

California by comparison has electricity rates nearly twice that of Texas. For 2015, the Texas number was 8.64 cents per kilowatt hour (ranked 10th least expensive), while California was at 15.5 cents (ranked 9th most expensive).
Aadhar Details Hacked
Yeah this bothered me as well. It's not just a matter of not clicking suspicious links or downloads, apparently (according to the Spectre pdf) there's a javascript vulnerability for this. What does a suspicious page even mean anyways, and how does the average user determine that before clicking?
They've been working on Stride, that might be why.
In my experience, that is the best available option, but it can still be non-trivial to set up, especially with gmail.

It's also not portable: I can't use it from another person's machine like a web client.
Will powertop automatically apply changes based on the state of the machine? I always thought of TLP as a daemon to do things automagically and powertop as more of a diagnostic tool. (e.g. on my machine with the power unplugged, powertop shows all green on the tunables tab).
It doesn't have to be sexy. It has to attract people that would buy a Prius or Leaf (and neither of those are the least bit sexy). It has to get good consumer reports ratings (the Volt does)..

I was actually surprised by the Volt, since a lot of my friends and coworkers bought them. Those people generally drove Mazdas, Hondas, and Toyotas.

If Chevy kept working on their eco-friendly image and continued to produce decent enough quality cars that get good consumer reports ratings, they'll probably do fine.
Because it won't change Intel's future value if buying decisions don't change. I don't expect people to shift away from Intel because of this so wouldn't expect revenues or income to drop. Unless they get hit with lawsuits (unlikely for a bug), this shouldn't affect their business too much.
If they could have done microcode patches they would have done, suggesting they can't.
Because that's the same thought process that seems to be prevalent among the very ISPs we're critisizing all the time. Should that kind of thinking really be copied? Why not use the chance and show how it's done properly?
Timer coarsening is a bad idea. Turns out [1], a simple timer thread is a good enough poor man's cycle counter. What are you going to do: ban variables? Even if you could coarsen timers, adding random noise just makes attacks take longer. It doesn't make them impossible; attackers can just collect more measurements.

You need to address the specific vulnerabilities, not shoot the clock_gettime messenger.

[1] https://www.usenix.org/system/files/conference/usenixsecurit...
TOP 4 best crash reporting tools for iOS developers