skysight-inc/HackerNews huggingface dataset:
Oh, I agree with you; the state of computer security is really depressing :(
I know they don't have to share the details, but the "patched" part is not really clear. Did they update to a new image / more recent kernel / anything else? Much like the redis post linked in HN before, we don't know if the impact is because of the "pti turned off/on" change, or are there more moving parts involved.
Tesla was lazy? Can you call a man lazy, as an extreme example, who slept 16 hours a day and output half of what Tesla did?

Da Vinci did the same shit with tangents/investors, and slept multiple times a day. Was he lazy too?
That only matters if not everything is in the same sandbox. Many non-cloud servers probably either only run a single service, or they run all processes as the same user, which means that a sandbox escape doesn't really matter. You can't lose any security layers you never had in the first place.
OSX? So you don't even need a password?
AWS provides the ability to guarantee you don't share physical hardware with other customers with "EC2 Dedicated Instances" (https://aws.amazon.com/ec2/purchasing-options/dedicated-inst...). I'm not familiar enough with other cloud provider offerings to say if they do or do not have similar features.
In the case of government, everything is weighted against the lender.

For instance, what the US government did in 1971 ? Government: "We are going to pay X in gold for every one of Y you have", Investors: "Okay, pay up", Government: "We were going to pay but instead confiscate all of it" ...

That's supposed to be the most reliable government on the planet (and it wasn't the first time it did that, and it won't be the last).

The sad truth is that when you calculate things out, bonds by large corporations (average of S&P500) are in fact more reliable than bonds by the US government, and whilst I haven't checked, I strongly suspect bonds by every other government. Mostly because corporations can't just choose to cancel contracts and bonds, and therefore don't. So they're mispriced. In reality the risk of the US government is, given the published default risk, A2 or A3 rating at best, and should therefore carry interest rates lower-bounded by that grade, or about 4%. And of course the "risk-free" interest rate should be added to that, to make something like 5.5% or so. That is, of course, only for Federal bonds. Actual interest rates are something like 1%, mostly because the "independent" government agency called the FED "chose" to buy government bonds at that rate.

So you see, the government has already done a great deal of what you're saying, and lowered the interest rate it's paying a great deal, in a very unfair way. Essentially, in the long term, and assuming the previous century will be similar to the next, you should expect to lose something like 40-60% of the money you lend the US government (because of the next default). And if you reinvest dividends, or keep the proceeds in dollars, of course, 100%.

The issue is that if you don't give people any incentive to be economically productive (because that's exactly what interest rates at 0% do) then ... they won't be.
The Meltdown patch also introduces a serious performance hit for DNS servers and resolvers.

Before giving figures, I want to run the same tests on a more recent CPU, but my current benchmarks are not great to say the least.
Hydrogen fuel cells would also make refuelling much faster. In the video they claimed an hour recharge time for the small plane. While you can get more parallelism as you add more batteries it still seems like making it much faster would be beneficial.
May be time for OpenBSD people ( if they have the resources ) to build a CPU from ground up with RISC-V?
That's a valid concern, but it is solely founded in a capitalistic point of view. For some people there is no more to life than raising their personal net worth, others have other aspects.
Erik Meijer gave a talk about this at KotlinConf last year https://www.youtube.com/watch?v=NKeHrApPWlo
Increased amygdala responses after psilocybin for treatment-resistant depression
Spectre works across address spaces, user->user so how does a microkernel help?
Doesn't that defeat the purpose of Docker?

But anyway, thanks for the info :)
Testing the effects of hiding downvotes in r/politics
Is there not some sort of OS embargo consortium that could be created to resolve this?
A short title, freely available here:
* http://www.teslasautobiography.com
* https://freeditorial.com/en/books/my-inventions--2
> I've been able to use Linux naively

Hehe
You can't just mitm when the JavaScript is served over https, unless you also can install your own certificates on the machine you're trying to hack. But when you have permissions to install new certificates you probably don't need the hack in the first place.
Full Recon of Linkedin
213-214-0001 Sizzle Call Marketing System Free Landing Page «
My MacMini6,2 (2012 Server) has two SSDs RAIDed together. High Sierra beta worked fine and upgraded fine to golden master and subsequent. When I decided to reinstall my OS from scratch and reload from backups I discovered to my horror that mine was not a supported configuration and there was no way in hell I would be getting back to where I started from. This happened on the 20th November. I finally managed to boot my system again on the 20th December. After failing to re-enable RAID I broke my system into individual root and /User partitions on separate drives (or tried to) and discovered that APFS (Encrypted) and /etc/fstab don’t get along. I re-defined my home folder to be on the second drive but cannot log in until I’ve logged into a utility account and mounted the encrypted partition separately. Currently permissions are so fucked up I can’t even stream music from iTunes. On Monday I’m gonna nuke it again and try another route from scratch.

Throughout this Apple Support has been anything but (aborting when for some reason my Mini’s S/N failed to match their records for Server machines, and thus bailing on me on the premise that I shouldn’t have RAID anyway so basically screw me.)
they previously broke the KRACK embargo (among others): https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbh...

it's no surprise they're not high up on the list of important people to tell
Refactoring Legacy Code – Episode I
With AWS, and I assume most other cloud computing providers, you can pay extra for you instances to run in a host without someone else's VMs. You probably should be doing this for any servers were you handle sensitive data, but it is a place were many will be cutting corners.
Still, the issue remains: if you have a message to spread, how would you go about spreading it? The brute facts are, not putting copies of the message in those evil centralised social networks means the message will be invisible to many people, in some cases the majority of the target audience.

I'm all for getting rid of YouTube, but I'm not sure how we should do it.
Pipelined processors would slowed down considerably without branch prediction: every branch (= loop iteration) would stall the pipeline and instruction prefetch. 20-25% of instructions are branches, so this would mean a 5-10 clock cycle pause every 4 or 5 instructions.

(Simplest cores have only static branch prediction though)
The Just Simulate It principle is super practical. I once sat through a talk by a principal engineer who’s talk was based on that premise.
Intriguing blog post, but the analysis appears overly simplistic.

I'm going to go with the assumption with that individuals and private companies are rational. Therefore, they do what's best for them. Then the question becomes why a majority of individuals and private companies pick the synchronized schedule?

I believe that should be the angle of investigation, rather than creating theories about the grand mistakes the society makes. Everybody has more or less a brain you know :) And they can choose what's best for them. The question is why does the majority of people and firms choose the synchronized schedule?

There can be many reasons. I don't claim to know the answers. We can posit some theories, then test them through reasoning.

Number one reason might be: society needs a clock so that families can sync up. Drive kids to work. Help them with their homeworks. Cook. Eat family dinner. Both mom and dad go to work at the same time, so that they can be at home at the same time. You cannot delegate your interactions with your spouse or the kids :)

Single people and childless people do have more freedom. I remember the days where I used to go to work between 10-12am. Then leave around 7pm. Many of my single and childless friends are on a similar, shifted schedule.

So there you go. You can posit many other theories: E.g. market prices may not be dynamic enough for efficient allocation. That too might have a good reason (dynamic prices incur communication costs & may create confusion). So lack of incentives, too, must be a playing a role.

Weekday-weekday synchronicity too must have good reasons. Work gets done a lot better when your colleagues are around, you know :) Remote working hasn't caught up with the quality of face to face interaction.

Etc etc. The article misses many obvious things, imo.
Modern Linux in an ancient PC
Thinkpad T42p with Pentium M 1.8GHz, 2MB L2 cache

https://imgur.com/agxy8e7
I'm using https://github.com/containous/traefik with Swarm for termination, Let's Encrypt and routing with success. Configuration is handled with service labels.
For those without a technical background: https://news.engin.umich.edu/2017/12/new-quick-learning-neur...
But does this work require full refreshes of 80x24 screen or larger?
Yeah, and Call Manager has a bug that lets incoming callers transfer themselves to intercom. Keep an eye on that Cisco phone on your doctor's desk while he discusses your HIV test results with you. I could be recording it.
My God. How did I miss that? Thank you for pointing out the blindingly obvious limitation in my thinking about cars vs autonomous cars. (This is a perfectly genuine response; zero sarcasm.)
This seems like it might be a lead:

> Apple completely rewrote the window server in Metal 2 for High Sierra and seems to have done a very poor job of it.

I've run into tons of those issues with my 2012 MBP. Slight tangent that might be useful to someone.

If you experience jerkiness, lagginess, slow display updates, just general slow feeling, one thing to try is the NVIDIA Web Driver video drivers, rather than the stock ones.

It resolved all of the slowness for me, maybe just applies to slightly older macs but made a big difference.
Linux?

:)
No one seems to have told the other BSDs, either.
Secret hint: if it's an older mac, try the NVIDIA Web Driver for the video driver.
It works across address spaces only if OS scheduler runs affected processes on the same CPU core, so hardware state of branch predictor is shared.
If a recent CS great doesn't have common sense, they chose the wrong career path. That individual would probably be equally bad in other industries though.
I noticed the same anomaly. Maybe the X axis is labeled in the author's local (US Eastern?) time?
Why the North American west is on fire
Ageed! It was too painful to read on my phone. Dark red on black is a questionable design choice. I appreciate the desire to standout, but usability should trump style.
That only works if messages are independent of answers received and are all known at the same point in time. In most games this typically would not be the case, you'd use a message to cram as much state change into it as is known to keep the game moving fluidly. Packing more than one such message together would serve no purpose.
Try the NVIDIA Web Driver for video. The new Metal-based window manager doesn't play well with something about the stock video driver. NVIDIA's is faster for me.
Would love to see an analysis on QuantStamp :)
Facebook Can’t Be Fixed
Thanks to CoreOS containerLinux, you don’t really need Puppet or Ansible. You specify your Ignition config, and just drop it as a tiny partition on the servers, and drop the OS onto a separate, adjecent partition, and then have local storage even separately. Commonly you use PXE to avoid having these locally.

Then everything you do on top of that is handled by the container scheduler, and your containers.
When Ireland’s publicans staged a bank run in reverse (2015)
They are benchmarks, just not microbenchmarks. Actual application performance is the gold standard for benchmarks.

https://en.wikipedia.org/wiki/Benchmark_(computing)#Types_of...
Likely by processing different data at different times.

E.g. big aggregates and time series are likely updated on a lower interval whilst near-time event data is probably stored in fast recall storage so that you can satisfy near-time queries immediately.

Otherwise, their long view queries are always sampled. They control the fields available so they can make sure samples are properly stratified in order to be representative.

IMO, it's just good old fashioned good engineering. It could be done with no special tech whatsoever. E.g. sharded Postgres DBs and network storage would do just fine.
So it's possible and it's just a matter of optimization. Pens and typewriters leak data acoustically, so let's replace cameras with microphones to reduce costs. Tiny microphones with antennae can be mass produced cheaply and they are easily hidden. Delivery can be automated too, but it's much easier to embed the spy devices in common products people frequently buy.
China's social credit system makes the black mirror feel benevolent
Google answers your questions about Meltdown and Spectre vulnerabilities
Not a single screenshot of the debugger in action.
but power is not immune from this right ?
Amazing. A minor quibble: dragging back and forth over a number in the text to change it is not intuitive. (Not that I could think of an intuitive but elegant solution either)
I wonder why the ACM hasn’t chosen an alternative governance model, like a DAO.
This is classic antisocial engineer thinking. The principal benefits of synchronicity are all social: it enables human contact, live conversations and shared context.

No one cares that a million toilets have to flush at the same time. We invent bigger and better sewage pipes, some people get paid to build them, and everything's fine. Lots of people like to watch the new Game of Thrones episode at the same time and then talk about it with their coworkers at the office the next day.

It really is a minority of people who think otherwise. I run a heavily asynchronous, remote company, with fully remote customers, and mostly remote employees. I bias toward hiring locally just so I have someone to talk to.
I don’t know, I think the iPad as a serious content creation device, something an FTP client would help with, never really materialized. Apple keeps trying but it’s not there.
I don't think the point is capitalistic - others (above) have made similar points to this one. Many business and social activities are enriched when most participants are present.
The Meltdown attack requires an attacker to have a piece of code executed on your server. Epic's servers are used for login, where people send you data, and for game logic, where people also just send you data like "player x moved his avatar here, player y shoots etc". If all the server does is execute the code which Epic wrote themselves and already trust, why would it need to apply the Meltdown patch?
If I recall correctly from older posts (I played Fortnite for a while), they're using AWS.
I still hold some bitcoin but I recently sold some to pay off my mortgage. However I used to hold it because I believed in the technology, I liked free/cheap transfers to anywhere and it seemed revolutionary at the time. Now I hold it because it could go up in value, I no longer think it will change the way banking and finance is done, it's not the panacea many hoped for. What we are seeing is more and more cryptocurrencies being created, with the main aim being to enrich the creators. Ethereum was novel at least but the hardforks to protect users from their own stupidity, the stupidity that locks up others coins and the general unreliability of the software used to create contracts means it is nowhere near as developed as the bitcoin codebase.

I always placed value in bitcoins scarcity and I still believe that accounts for the vast majority of its value proposition. Seeing ripple and ethereum, which are both essentially unlimited in quantity, hit these high prices, while also being pre-mined or centralised, clarified for me that the cryptos are in a huge bubble and could go much further but eventually a total lack of real world use is going to come calling and very few will survive, my bet will always be on bitcoin as a store of value but also litecoin for day to day transactions.
Just go to their website... https://x64dbg.com/
It's pretty good, actually
I personally found Dr. Pancake's background fascinating although I agree what was posted is not terribly relevant to the job.
This is local news so what they mean is that this is the first plane in the country with those characteristics. The internet makes local news sites global and it probably never even crossed their minds that someone not local would naturally make that interpretation from the headline.
I doubt that any CPU manufacturer is going to go first in crippling its memory subsystem.

I think realistically the only safe and not completely performance crippling workaround will be, at the very least, to run any untrusted code under a separate address space (assuming that the cpu is immune from meltdown). That doesn't necessarily require a full blown separate process, but something like memory protection keys might work.

The alternative is full static analysis and source level annotations, which realistically is only going to be done for very few programs and will still be error prone.
AMD has confirmed it isn't affected by Meltdown.

https://lkml.org/lkml/2017/12/27/2
No word about mainframes yet. Are s390 and s390x still in-order? Given their high clock speeds I'd hazard they don't do much speculation.
Because having a mix of libraries/modules which some export defaults and some don't makes it cumbersome to require them here and there: I have to remember which was exported as default and which had the class inside. Also it makes more obvious visually which variables are modules and which are classes/functions. For my projects I avoid default exports even when a module only has one class (which happens frequently).

Additionally, ES6 default exports don't mix well with commonJS, sometimes I have to add require('foo').default for no apparent reason.

> Also with npm scripts, local deps that expose executables are added to your PATH

I think it didn't work reliably on windows or cygwin or something. I just tried and it works everywhere. Good to know! The only gotcha is that ";" and "&&" must have spaces around.
Is someone more informed on the workings of the Linux kernel (specifically redhats flavour) able to point me in the direction of some more detail about this:

Due to the nature of changes required, a kpatch for customers running Red Hat Enterprise Linux 7.2 or greater will NOT be available

Just wondering what changed between 7.1 -> 7.2 that made this something that couldn't be updated live and there doesn't seem to be a ton of obvious extra information about the nuances of this change around.
Aren't they still vulnerable to Spectre?
> why would it need to apply the Meltdown patch?

They're using a "monolithic" cloud provider and don't have a choice in their current deployment?
Does Lyft Alleviate City Traffic? Looking at the VMT Efficiency Metric
Check disk space usage on linux with Ncdu
Not sure if this is satire, but this sounds a lot like finding obstacles.
Let me know if you have any ideas what other transforms to include inside the tool.
Twitter is the gutter press of the internet. All headline no content.
There indeed was a 4-hour shift that I somehow completely ignored when labelling my axis. I've fixed it now, thanks!
Just crowdsource a few billion $ for R&D and we are good to go.
And the guy complains in the same paragraph that there are embargoes and that he wasn't in on the embargo... If he doesn't want embargoes he should be happy to discover the vulnerability with everyone else.
This is a horrible approach to security. If you only secure against attacks you expect, you're gonna have a bad time.
Helm makes this easy. It’s great, just use the templating features and not the package management stuff.
This is correct - second order methods are great in theory, but they are generally computationally prohibitive for high dimensional problems.
I see. Then don't go "full ES6" but I prefer exporting an object with the class for reasons I've explained in a comment above.

But I do see ES6 modules in the wild, some of them I'm using with other languages. So I guess it's fine to leave it as-is. Or if you want to ensure maximum compatibility, use babel as I suggested but add the sources to .npmignore so they're not duplicated in the published packages.
That's still not answering many questions. I hope they publish a full analysis at some point.
Only the hacker needs to do it for there to be a problem
> Linux is, of course, great, but what hardware?

Plenty of threads on this forum (and others) to choose from when it comes to choosing hardware for Linux. The answers are often similar: Thinkpad T4xx, Dell XPS 13/15, System76. I don't see HP mentioned that often but I have a bunch of (older) HP laptops running here and there which do just fine, just stay away from their consumer products and focus on (used) business hardware. Purism is cropping up here and there as well, mostly due to their active stance against Intel ME.

In other words it is not that hard to find good hardware to run Linux on. Given the state of MacOS these days the experience is likely to be less trouble-prone than that of those staying on (or hopping on) the Apple platform.
Truth isn't just fact, it's also narrative. Trying to separate the two is impossible, therefore truth can often be political.
Yes i agree, synchronicity is environmentally unsustainable. Metro stations and train stations are designed for peak capacity in rush hour.

Office workers spend the vast part of the day at their workstation and sending emails.

Why not do that from home?

Most meetings are useless and we know it, why not do them in chat or video conference?

Open spaces are the worst possible environment to get anything done and everyone knows it.

But there is this mindset that in person presence is the only way to work and interact, Which is true for some professions, but not all of them.

Most people dream would love working from home.
Or use userspace networking stack (with cards which allow this) to reduce number of syscalls.
Not unsigned code, but Xbox One runs apps from the Store. There should be a fair amount of checks before an app lands on the store, but you can never be sure.
I think arguably, both options are correct.

It is probably valid for a game publisher to claim copyright on the game's music--assuming they created it for the game [as opposed to licensing it].

I also believe that a playthrough video probably counts as fair use in most cases.

Nintendo is known for having a 'bad' reputation with playthrough videos on YouTube.
Only for articles with pretentious titles.
22 jquery carousel plugins
> people ask why would someone use an orchestrator on a small cluster (dozens of hosts)

I’d love to know who these mythical folks are?

1) dozens of hosts (heck, hosts >1) is exactly why you need orchestration

2) while there are huge deployments across the globe, I wouldn’t consider “dozens of hosts” small by no means. That’s actually probably above average.

3) k8s is actually easier to maintain than you allude. I see these comments about Swarm over k8s generally from folks who never even tried it (or did so years ago), is that the case here?