skysight-inc/HackerNews huggingface dataset:
My brain didn't parse the "Xerox PARC" bit at the bottom and I just assumed that birth/death years and I got really confused as to how he replied to something posted in 2018.
>Probably a typo, but in large and slow moving bureaucracies, there is a lot of 'authorized unauthorized' "off the books" activity.

FTFY.

It's actually a pretty good way to explain speculative execution. You know you might need to so something so you just do it using the slush fund and if it isn't useful you toss the result and if it is useful you keep doing it while papers are shuffled around and authorization happens. Certainly not ideal but not unheard of either.
This. If anything, Apple has been guilty of shipping buggy _software_ earlier than it should, _not_ the hardware. And while Tim might be an expert at operations for shipping hardware, software dev is a different ballgame.
> It isn't funny or witty to point out that an Opel Corsa gets better gas mileage than a 747

Actually, if it's true that a car gets a better mileage than a big airplane (more in one vehicle = more efficient, people seem to believe) I would find that interesting. Similarly, I can see how OP thinks it's ironic that a very cheap machine is not vulnerable whereas a quite expensive piece of equipment is, making it seemingly less-well engineered.
Deadlines don't have to kill creativity
Russians acquire Washington DC radio station
Thanks - I've used sort quite a bit, and I like it. I wrote this partly to just fulfil my desire to sort by named fields rather than column indexes.
One of the features of iMessages is that they're encrypted and can't be unencrypted by anyone but the Apple-authenticated recipient. This has the downside that the only way to access those messages on non-Apple devices is to create some kind of man-in-the-middle attack.
Please don't troll here.

https://news.ycombinator.com/newsguidelines.html
Yes, the Raspberry Pi will issue loads before the branch resolves. But usually a processor's pipeline won't be laid out in such a way that the AGU won't have time to pass an address to the load pipe before the branch resolves and squashes the load. The Cortex A8 was an interesting exception but it was pretty deeply pipelined compared to most in order cores.
Could you clarify what specifically about Windows is causing you frustration? Are you forced to write code on Windows machines, do you do business work on Windows machines, pesky management that won't let you try other options?
I like how they call it a 'true' RNG... unless it's got a cesium core and a Geiger counter mounted on the USB, I'd hardly call it 'true' :). At best, it's good enough.
Sounds like a great name for a cinema in the DC area.
Foremost, it was written by a human and unintended language contradictions are common. With that said, what you're suggesting isn't necessarily true -- the language can also indicate potential false positives, again because of the nuances of language.
It is. Same ballpark as PTI on microbenchmarks, but a little better on macrobenchmarks.
Debian was OpenSSL's RNG, not the kernel RNG. So, it sounds like your response is that we have to go all the way back to Windows XP to see an example of a "good" RNG going "bad".
See things like

https://github.com/aosabook/500lines

http://plzoo.andrej.com/

Or any somewhat readable, compact codebases. Redis, Lua, etc. Often they are pedagogical in purpose, but sometimes on accident due to ruthless factoring.

No one can "learn compilers" from reading LLVM source code. But one could get the idea in a couple hours of reading

http://www.iro.umontreal.ca/~felipe/IFT2030-Automne2002/Comp...

And in a couple more by porting it to a new language.

Think of building an exact scaled down replica of a plane or a ship before embarking on the larger version. Now build an even lighter weight model, just for learning how to build the model. This is a "fruit-fly" code.
Sandiegoframeco
If you look to video games for lessons in this, then sadly most people want their shinything on time, even if it’s broken. A lot of people don’t, but we’re utterly drowned out by the wallets of people who buy day 1, every day. As with security and lots of other issues around tech, people need to be educated. We need better laws too, but that also requires an educated populace.

People seem to treat software and now hardware in ways they’d never dream of treating a meal, a car, or any purely tangible object.
I think his point is that continuously adding entropy might make it easier for an active attacker to exfiltrate data undetected.

Of course, the malicious device will also be able to see
other sensitive information, not just x and y. But this
doesn't mean that it's cheap for the attacker to exfiltrate
this information! The attacker needs to find a communication
channel out of the spying device. Randomness generation
influenced by the device is a particularly attractive choice
of channel, as I'll explain below

He then goes on to explore a possible scenario in detail.

The point isn't that continuously drawing entropy is necessarily worse. The point is to illustrate that it's not as risk-free as we may think. Furthermore, it doesn't provide much, if any value. In other words, why bother with the added complexity?

And there is added complexity. Linux[1] and OpenBSD use ad hoc mixing schemes for injecting entropy into their PRNGs, with no proof of security. There are schemes with proofs of security, but they're more complex. More over, the ones with the strongest proofs are the most complex of all and often relatively slow, which is why Linux and OpenBSD have been resistant to simply using, e.g., Fortuna.

Similarly, if you give up on constantly trying to inject data, then multiple CPU implementations are easier--just keep a simple PRNG state per CPU, without any fancy waterfall schemes.

These days collecting, even without a hardware RNG, 128 bits of entropy should happen in very short order. Estimates are of no matter, you either have it or you don't, and there's no way to prompt a user, "Do you really want to proceed?" If you can't collect 128 bits of entropy by the time /bin/init loads, you're probably screwed. The best example is a VM--if you have no access to a TRNG or to the host's entropy source, you shouldn't expect the situation to appreciably improve 10 seconds or even 10 minutes later. At the very least, you should assume you're screwed and that the environment isn't a place where you should put services and assets that depend, directly or indirectly, on secure entropy generation.

The logic is, why? Why bother? Especially in security, we normally shouldn't be doing things without well-quantified justifications, especially considering that engineers invariably underestimate the cost of complexity, particularly in the security domain. History has shown that not only do these behaviors create a false sense of security (they're often inadequate in ways we never initially understand[2]), but they can make matters much worse.

[1] At least I think it still does.

[2] No coincidence when the reason for adding them is to solve some ill-defined and poorly understood problem. If you can't quantify the solution you should be wary of relying on it. If you can neither quantify the problem nor the value of the solution (as in the case with constantly adding entropy), it's arguably poor judgment to apply the solution at all.
That's hilarious. Elsevier will lose this fight for sure...it's exactly the type of thing Germans will stubbornly dig in their feet out of principle for.
> There's no reason to predict a branch if you're not going to execute speculatively.

Not quite. Branch prediction is typically used on non-speculative architectures in order to avoid pipeline bubbles. (You could argue that pipelining is a form of speculation)

Here is the branch prediction documentation for one of the processors they claim is not vulnerable. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....

Whether or not they're vulnerable has more to do with how their pipeline is structured. It's possible for an architecture to be vulnerable if a request to the load store unit can be done within the window between post-branch instruction fetch/exec and a branch resolution. Eyeballing the pipeline diagram from the above docs, it looks like you can maybe get a request to the LSU off before the branch resolves. dramatic music
Ok I think I understand the subtleties of these attacks now. But: can anyone tell me why the accessibility check for protected memory doesn't happen before the cache loads the contents of RAM? If that happened then none of these attacks would be possible.

I got my computer engineering degree in 1999 and ended up going the computer science route making CRUD apps all day. I feel in my gut that some engineer, somewhere, MUST have asked this question at one of the big chip manufacturers.

Am I missing something fundamental? Is the access check too expensive? If it isn't, then can the microcode be updated to do this, or is caching/accessibility checking happening at a level above microcode? If that's the case then it would seem that pretty much all processors everywhere that do speculation without protected memory access checks are now obsolete.
+1, and add theming and dynamic resizing of GUI elements to that. In the old days a window was not much more than a rectangle buffered in some structure in memory, nowadays a hell of complexity and CPU cycles are required to deal with different fonts, themes, widget sets etc.
Is there an nginx/Apache equivalent that can be used for hosting one's own content?

From what I've read I could just run the ipfs-daemon on my VPS/hosting server, but is there a user friendly way where I don't have to manually add every file everytime? How easy is it to host a web page with it?

How will does IPFS handle NAT? Could I host my own pinning server on a Raspberry Pi on my home network?
Not quite. An instruction that takes 1us is much less likely to start and end in a different 20us clock cycle than a 10us instruction. Simple repeated sampling combined with statistics still yields a timing attack. It'll be slower and less deterministic, but it's still a problem.
Great start! Keep it up, stay curious & continue learning. Try to learn a bit of javascript with a fun game tutorial like this: https://codecombat.com
I agree with most of what you're saying. In this case, I think it's an intellectually meaningful position to point out the fundamental problems with the premise of the initial article. The idea of summing "global debt" as though it means something really is something worthy of that sort of critique and dismissal.

A bad comment would be "this is dumb" or "total debt is a stupid concept". The OP in this thread gave an intellectually clear and logic basis for dismissing the article.
Woah chill out. I don't think it's that big of a deal to ask a question, especially for newbies who find documentation intimidating and tough to get through.
What are the exploits enabled by this? Seems like mostly security-related attacks on encryption keys and such.
Note also that the host OS (the one running the hypervisor) was already patched in all cases. These tests only reflect the difference between a patched and unpatched guest OS. The total performance reduction is likely greater.
Your product and pricing page are super confusing to me. You talk about "users" but don't you mean "employees".

The product I am looking for is one where I manage all of my employees access to all of our relevant SAAS applications. Employees log onto this 1 single service and then can log onto all of our tools federated by this 1 service. If an employee leaves, then I simply remove them from this 1 centralized service and they are removed from all of our SAAS services.
First Amazon Alexa-Enabled Digital Glasses to Debut at CES
Thank you so much for taking the time to answer my questions. Looks like I have some reading up to do.

The reason I ask about this is because my long term thinking is that while motion controlled virtual reality is fun and going to be good for exercise games and training, I think human-brain-computer interface represents the most promising of the interaction methods (nothing says you can't be hooked up and still typing, using a mouse, or motioncontrolling either).

You mentioned the medical desire of seeing deeper brain waves, but I just want to control a computer, so given the current state of the EEG's are they useful yet as a practical operating system control input?
I found this project to be easy to use, it produces SVG output with d3:

https://github.com/magjac/d3-graphviz
Bitcoin Miners Are Shifting Outside China Amid State Clampdown
Alexa will come to headphones and smartwatches this year
...And expect that collapse to be sudden (relatively speaking) and take a baffled majority by surprise. Then expect conflict, trending more and more to desperation and violence.
Thanks for the ideas! I'm curious, for the CRM for startup founders, what would be unique about this product vs other CRM tools? In other words, why couldn't a startup founder use an existing CRM?
The market, afaict, no longer properly associates a game with its publisher/developers in the general case. In which case, companies don't have to try very hard to get out of problem release: few even know who they are.
not to mention the fact that twitter is basically millions of monkeys banging away at keyboards, eventually they will produce some great works.
Engineering Mathematics and Advanced Engineering Mathematics by Ken Stroud

Lots of worked examples. Very easy to follow and really helped me "teach myself" calculus and advanced calculus.
The private key used to sign code? No, that wouldn't be in the console at all.
You can wait for a random period on the scale of the clock then measure and take statistics on the results. It will slow down the attack but not stop it.
I disagree because it's not even just about grants. At least in Europe most researchers are government employees so I don't care if your grant money is private, open access is still a basic requirement. If you want to publish research that requires me to pay 30$ an article to access you better not be doing that from a publicly funded job.
Thanks, this was the missing piece in my understanding. I was wondering how only knowing only 1 bit would be useful. Suppose the attacker wants to read this entire address (0xabde3167) using this method. Is it guaranteed that over multiple runs, this address would be the same each time at that point in execution?
Vfx & animation is one place people do this, and what I’ve done. Advertising is another one, but probably more hit & miss, I think there are only a few people who figure out how to spend much time doing the fun stuff. Another avenue is selling your generative art, but having tried a little bit, breaking into the art market can be pretty tough. Some design work can let you practice generative techniques too.
Frankly, the firehose will be considered priceless in 100 years. The accounts and tweets that we care about now will also probably be the least valuable. Historians and archaeologists will generally take one grocery list over a thousand sweet nothings from politicians and celebrities.
There's an analytical and prescriptive component to "Modern Monetary Theory." People like Cullen Roche have argued that the analytical side is correct, but don't share the prescriptive views. He calls that Monetary Realism.

Whether the debt is a "good thing" or not must be separated from whether the analysis is true.

Furthermore, it is possible for the government to simply print money without debt.

It is also possible for the federal government to acquire zero-interest loans, given that everyone knows it has the magic printing press, so long as everyone is convinced that it will honor the bonds.

That is why it is able to force bond yields to extremely low levels, even during a major recession.
I use cscope in conjunction w ctags. cscope (which will launch an editor, appropriately ) for a top-level overview/dive, and ctags (from w/i my vi instance, whether vi was launched from cscope or not) when I’m zeroing-in on a problem and can chase down thoughts and maintain my way back out because navigation is pushing/popping on a stack. No need for either/or; use them both.
Turn your Apple Watch into the ultimate productivity device
And this all seems in line with what the expected slowdown would be. Non-pipelined calls will have more syscalls and therefore a bigger slowdown. Glad antirez took the time to do the benchmarks.
Currency doesn't have to be backed by debt.

Debt-backed currency has the fundamental flaw that, because debts charge interest, the total amount of debt will always exceed the money supply. Our currency is structured so that there are never enough dollars to pay off all debts at any given time. Fundamentally, a portion of all debts MUST default, creating a net effect where those who have enough capital to lend will, over time, acquire more and more real property.

Our currency is built to transfer wealth from the have-nots to the haves.
I have read about the caste system and issue in India. I have lot of Indian friends in US, but I never feel that there is any caste system among them. Is that just my experience (maybe my ignorance)?
Interesting method, but yes; wouldn't HTTPS mitigate this script from being injected? Trying to get awareness for my own original miner written from scratch https://www.sparechange.io/ Interesting learning WASM.
If you ever asked yourself, what did suddenly changed the importance of neural networks (ahm... deep learning), this is a great run down. The turning point in my view was 2010 paper by Schmidhuber where he conclusively proves that deeper networks have been learning all the time and excelling compared to SVM/k-means. They were just too slow so needed to run for 24+ hours. GPU made this 40X faster and suddenly deep networks were getting trained in couple of hours.
> There is no fundamental reason why speculative instructions should be allowed to mutate the cache.

There is: hundreds of instructions can be in flight speculatively at the same time, especially if you take hyperthreading into account. Good luck rolling them all back.

The question is not whether the cache should be mutated during speculative execution. It's what kinds of speculative execution are allowed, and in some cases it's not even clear if fences should be placed by the programmer (whack-a-mole style), the compiler (not sure how) or the processor (probably not). It's non-obvious enough that how to solve it is to some extent a research problem.
Time to start ScamCoin. Every transaction on the network will be considered a donation of which you may or may not receive some worthless ScamCoins in return.
The problem isn't really the speed of the memory but its size. The planar nature of memory and the speed of light impose a latency of access on a pool of size N proportional to the square root of N. The L1 cache on your CPU has kept up in speed with the processor and is the same size as the memory computers had when computers could access their main memory quickly.
K'NEX computer
No-ads-YouTube.com plays YouTube without the Ads
Yeah, I run into this problem all the time in the space. You build something really awesome, an either doctors don't care, it doesn't fit the workflow, or it turns out to be minimally useful in practice. We abandoned most NLP efforts and dump tagged terms into algolia for a lot of use cases and it works well enough to fit a prescribing workflow. The docs already know what their searching for, they just need to know its in the catalog and like the autocomplete.
Section 2.2.1 states:

>"An attacker discovers or causes the creation of ‘confused deputy’ code which allows the attacker to cause speculative operations to reveal information not normally accessible to the attacker."

Can someone say what ‘confused deputy’ code means here? This is not a term I have ever come across before.

The authors then go on to state:

>"If the attacker can identify an appropriate ‘confused deputy’ in a more privileged level, the attackermay be able to exploit that deputy in order to deduce the contents of memory accessible to that deputy but not to the attacker."

Here the reference is to an "appropriate 'confused deputy.' Are these just weasel words? Can someone shed some light on "confused deputies" and what makes one "appropriate"?
Good point - I guess it's more or less impossible to do this test on the public cloud, now (at least on the big three).

It'd be fun to set up the hardware and do a full matrix benchmark of patched/unpatched host and patched/unpatched guest.
You have a point but this is mitigated by the fact that most Americans have very little saved for retirement, just eyeballing the numbers it appears a tiny percentage of people are able to put away a substantial amount for retirement.
http://time.com/money/4258451/retirement-savings-survey/
Ask HN: How many people on your team are working on internal tools?
I do wonder how much work is spent on internal tools (debugging, various scripts, etc.) by the team your're working in, or by your company. How many people, how much time, etc.?
Hmm... just downvotes and no replies to a comment with sources. Not exactly a high level of discourse.
> Imagine that you are a business that operates in Bitcoin and pays employees in Bitcoin.

Then you use a single, non-Lightning transaction with an output for each employee, and the fee for that transaction is most likely less than half a percent of the total amount being transferred[1].

[1] Actually just 0.35% ($170 fee / $48k wages) assuming a fee of 520 satoshis/byte, 34 bytes per output, 140 bytes of fixed overhead, $15k/BTC, 60 employees, and an $800 after-tax biweekly paycheck per employee ($20k/year). The ratio improves for higher wages since the fee is unaffected by the amount being transferred.
Previously Apple shied away from announcing products they were ready, and tended to ship products that were reasonably bug-free and highly polished.

Apple seemed pretty unique in this, in the industry.

Lately Apple is more like everyone else -- announce early, rushed to meet dates, not so polished and much more buggy.
So, your argument is that you are also a white male, like most other brogrammers, but you understand discrimination because you were treated nice while being anonymous online?
Because of interest, net debt obligations are always greater than net amount of issued credit. There is never enough money in existence to pay off all debts at a given time... unless more debts are created to pay them off.
1) Think from their perspective. They have very little upside for integrating with cryptocurrency platforms. It adds nothing to the bottom line. If anything, it subtracts from their bottom line, due to the added compliance work required to prevent crypto money launderers.

2) Stop saying crypto is decentralized. The vast majority of cryptocurrencies are mined by a small minority, and most participants have zero say in the direction of each currency. Yes, you can have a "decentralized" architecture, but not "democratization". Crypto-space ended up with an oligarchy.
A friend's software company has seen very low turnover by increasing retirement benefits by an order of magnitude and sinking them into SEP IRAs.
I had a depressing feeling this was coming.

Are cache timing attacks just inherently impossible to stop? It’s sure starting to look that way with the last couple years of security research. Seems like every mitigation that gets thrown up is knocked down immediately.
Apple is still selling "new" Mac Pros with Xeon E5-1650 v2 CPUs for $3K. I just picked up a like-new refurbished HP workstation with the exact same CPU for $350 on NewEgg.