skysight-inc/HackerNews huggingface dataset:
That sounds kind of like how it works in Washington. Public utility districts can "construct, purchase, acquire, develop, finance, lease, license, handle, provide, add to, contract for, interconnect, alter, improve, repair, operate, and maintain any telecommunications facilities within or without the district's limits", but only for their own telecommunications needs or for "the provision of wholesale telecommunications services within the district and by contract with another public utility district".
Peter Thiel Is Exploring the Creation of a Conservative Cable News Network
It should at least tell you that your voice input is being sent to amazon for processing, that's not immediately obvious and many would probably assume it's only required for certain functions.
While high-fructose corn syrup is a widely-used sweetener in the US, I don't think most people would call it sugar.
HockeyApp is now free for all developers
Definitely check out the OnePlus 5T. Sweet phone, very good price, and uber hackable by its owner (if said owner wants to).
We Have Reached Peak Pharma. There’s Nowhere to Go but Down
This is worse, far worse --- it basically disables prediction for indirect jumps and calls, plus adds another few extra clock cycles to each one of those for the "retoline" instruction sequence.
I would say your analogy applies, but in a different way: walmart and home depot arrived and mom&pop hardware and general stores didn't all disappear, but their numbers did diminish. Where 8 minimarkets were open, half may have closed (YMMV).
The argument for not making that kind of stuff illegal is it exposes the scammers pushing overpriced stocks to the public and so protects the investing public.
>As always, AMD strongly encourages its customers to consistently undertake safe computing practices, examples of which include: not clicking on unrecognized hyperlinks, following strong password protocols, using secure networks, and accepting regular software updates.

Ummm none of these things will stop this attack.
Well, then I guess the CEO is going to prison, and someone at the SEC is going to make their career on this.
They'll probably nail him, but not the Equifax C-suite.
That a service is essential isn't really all that much of a talent draw though, is it?

There are plenty of services that are needed that high value employees aren't rushing to get in to.
AWS Reinvent conference and the Rails Conference if those are your strokes.
My limited understanding is that the vulnerability is due to kernel memory protections not being applied during speculative execution, when the CPU is trying to second guess what the next instructions might be.

Unless you are in PR, any reasonable person would expect a CPU touted as having kernel memory protection to protect it under all circumstances. I'm sure that the people who wrote the speculative execution code would have included that protection had they thought of it, and all developers would class it's omission as a bug. So yes, this is yet another example of awful PR, trying to cover up a serious mistake with careful language that makes it seem not their fault.

My policy when I make a mistake is immediate disclosure, along with two commitments: to put the mistake right, and to amend processes to prevent similar mistakes in the future. It isn't clear how Intel can put this right, but perhaps a good discount on replacement parts might help. And they can certainly implement processes to catch such omissions in the future.

So this press release (particularly combined with reports of execs selling stock) are appalling. Intel have badly damaged their brand, and I'll never buy another Intel processor again.
Have to mine those coins!

Ditdn't confirm they are mining coins, and also didn't have that problem.
Free Speech (using capitals for a reason) is a US centric concept whenever it comes up here and you're from SF (according to Twitter).

That just doesn't apply here. This Free Speech never existed in the Germany I grew up in and it's not something that I ever felt needed. The incident here is a mistake, a strange overreaction - maybe even by Twitter? - and hopefully will be corrected promptly.

So while I understand that you might be unfamiliar with the underlying laws in Germany: I wouldn't want to trade them in.

Edit: I fully support the restriction of Free Speech and prosecution of hate speech. I'm not a fan of the new 'delete content online' NetzDG thing
Interesting that they left it this late.
Washington's growing obsession: The 25th Amendment
Update: AMD has an official statement with a clear outline of the discussed vulnerabilities: https://www.amd.com/en/corporate/speculative-execution
I'd watch yourself in certain parts of the Internet or certain meet-ups if you throw those words around about the 911.

I was responding mostly to the absolute statement "best two seater sports car ever made". I think the Miata is a great car, probably the best intro sports car if you are into grassroots racing or similar hobbyist activities, but I'd take the Z3 over it for most purposes.
Fred Bass, Who Made the Strand Bookstore a Mecca, Dies at 89
that was never the goal of the GTR though

it's more of a cost-efficient, tuner friendly car that's loaded with tech, that can take-on pretty much anything, while offering the reliability of a Nissan.
Interacting terribly with CPU branch prediction is the whole point -- Spectre attacks work by messing with the branch predictor, to misdirect speculative execution onto paths that reveal information useful to the attacker. So, the point of this whole crazy dance is to effectively disable the branch predictor.
What is the reason that Intel would allow speculative instructions to bypass the supervisor bit and access arbitrary memory? That seems the root cause for Meltdown.

Is it that the current privilege level could be different between what it is now, and what it will be when the speculative instruction retires? If so then that seems a thin justification. CPL should not change often so it doesn't seem worth it to allow speculative execution for instructions where a higher CPL is required.
He probably means "in order to develop iOS apps"
The "speculation time" can be hundreds of cycles if you have a branch or memory read that takes a long time to resolve.

This problem is already solved with speculative writes to main memory - a speculative store buffer keeps a sequence of memory operations which need to be done when the operation retires. These buffers are very power hungry, because every future speculative read must check every entry in the speculative store buffer to see if it is re-reading a previously written address. That many to many mapping leads to an exponential amount of checking logic.

The same could be done for cache reads/writes, but I have a feeling it would quickly get very complex, large, and power hungry.
Who Took the Legendary Earthrise Photo from Apollo 8?
Simple explanation: one of the attack is based on speculative out of order execution to access memory you don’t own.

Though cpu cleans registry, it doesn’t clean up cache. So later through timing you can gain knowledge about something you shouldn’t know.

That is why, reducing timers precision can help
RSA encryption (https://en.wikipedia.org/wiki/RSA_(cryptosystem), used in PGP, TLS certificates, among others) is based on the fact that I know a pair of primes you don’t know, so even if somebody tried to keep such a list, it better be incomplete.
The laws around PII breaches due to carelessness are largely nonexistent in the US. Laws around insider trading have had more than a century to develop their pointy end.
Also see rendering 3D in Excel:

https://www.gamasutra.com/view/feature/131968/microsoft_exce...
Imagine the law suit if Google fails to detect this....
I wonder why it is that when I say "I don't think that X should be doing Y in this situation because Z," I so often get responses of the form "So you think that nobody should be doing generic-version-of-Y ever?" That's probably a flaw in my own ability to convey my points. Let me see if I can convey this one a bit better.

First, I think that there's a distinction between constructive, humble criticism, of the form "Why can't the CPU be designed in such a way that ___", and statements like "Well, a competent CPU designer would have done ___". That distinction is not just politeness (although politeness is of intrinsic worth); that decision leads to better technical outcomes. There might be a good answer, like "It can't be designed like that because of the following constraints" or "We tried it and couldn't get it to work"; there might just be an answer like "That's totally the right thing to do and we just cut corners" or "We never thought of it but our competitor does that and it seems to work for them, yeah." Unlike arguments about how competent people actually are, these discussions contain actual technical content, and help different people understand each other's points of view (which is the whole point of having an online, public, decentralized development community, is it not?).

Second, yes, I think that we should discount, though not by much, criticism from people who say "I could totally do that in a better way" and have not actually tried to do that (or have tried and failed to launch a product). There's a lot of things about building complex systems (like modern CPUs) that aren't apparent on paper, and only become apparent once you try to reach some challenging level of scale or performance. This is not at all to say that there's no place for outside criticism; often outside criticism can offer fresh perspectives, or suggest a way to simplify the system and avoid the emergent problems of complexity. And often there are people who are genuinely qualified and really could build a better system, but happen to be working on something else. But it's still fundamentally outside criticism. The only people who can really say "Yes, you totally could have done this instead" are those who actually did.

Third, in this particular scenario, it happens to be the case that ex-Intel employees with insider knowledge have called out Intel for cutting corners (see the "Update" section of https://danluu.com/cpu-bugs/), which seems like a much more productive basis to have a technical conversation.

And if those stories are to be believed and if they're relevant to this problem, the problem is not the competence of engineers - the problem is the competence (or the confused incentives, really) of management who are not telling their engineers to invest time into doing things the engineers know perfectly well how to do, or are telling their engineers to invest time into building other features that make those things harder. (For instance, quite possibly some part of management got worried about benchmarks of syscall performance and told their engineers to prioritize that over making sure that there aren't side-channel leaks between rings.)
Join Human Dx to empower anyone with the world's collective medical insight
Best Electronic Gadgets to buy this Year 2018
Yuval Yarom's contribution (Flush+Reload) seems quite understated, considering how important it is to the attack.
Except they just said this attack is virtually impossible (certainly hasn't been demonstrated) on AMD. So I interpret this as general advice.
> You can't actually demand anything close to your value because somebody else will undercut you.

I'm confused by this part. If a person can undercut you, they can do what you do for less money. That means your value was not as high as you thought.

We might be using different definitions of value. I'm using "replacement value", and I think you are using something like Marx's "use value".
Well no shit. The point is to find the cause for curing him, not to convince others to approve of intentionally inducing leukemia in HIV patients to get them on the bone marrow transplant list.

The hope is that it's possible to determine _what_ cured him so it could be possibly synthesized or extracted by other means that would not place additional strain on any transplant lists..
China’s ambitions prohibit the US and China from being partners (such that the US is with the UK and France).

As a US citizen, I’d prefer we not sell off all of our assets for short term gain, only to be sharecroppers to China in the long term.

Warren Buffet warned us about this years ago: https://youtu.be/vx5XPvQO4pI
I note they didn't state anything along the lines of "Negligible performance impact. In line with other hardware manufacturers such as Intel, our security fixes rarely cause severe performance loss."
From the second paragraph of the linked PDF:

> Stokab was seen as a public infrastructure company by the City Council, much like a public organisation responsible for roads. As a consequence, Stokab was not allowed to sell active services, and was required to sell to any potential purchaser on a non-discriminatory basis
Of course. But it needs spelling out, because branch prediction is essential to good performance and why todays CPUs can be much faster despite not reaching higher clocks.
It's much more than just the cost of a few more instructions.
I just don't understand why Apple should care at all what people do on their phones. It's paternalism to the extreme.

Paternalism: the policy or practice on the part of people in positions of authority of restricting the freedom and responsibilities of those subordinate to them in the subordinates' supposed best interest.
High performance applications need to share memory between threads. That feature let you do it in JS, and is the basis of the future shared memory multithreading feature in Web Assembly.

So if you want the next Photoshop or Final Cut Pro to be browser based we’ll need to make it work securely.
Which is worse: a government with overcompensated secretaries, or undercompensated scientists?

I'm a government scientist. Maybe I'm biased. But it seems to me that if your government cannot compete for the best and brightest in your country, you are doomed.

Ideally, of course, we'd compensate both secretaries and scientists appropriately. But we don't seem to be able to manage that.
IEEE Milestone for the Development of CDMA for Cellular Communications
Spotify's is based on machine learning working on the actual audio tracks.

It seems to me that Google Play Music's recommendations are based on what artists you like, based on machine learning, but not using the actual music, just pattern matching with other people.

I use Google Play Music, and am actually considering trying Spotify to get better recommendations.
> Resolved by software / OS updates to be made available by system vendors and manufacturers.

Not unless you update every piece of code running on your machine to insert an lfence following every branch on attacker-controlled data.
I've worked with Eno (the OP) on the product that he's talking about (Cloud Foundry). It's worth noting that the first versions of Cloud Foundry were written in Ruby/Sinatra for the reasons that you're talking about.

We switched to Go because Ruby's concurrency model was obtuse/inefficient and scaling the codebase was challenging even with excellent developers and great engineering practices. The performance gains with Go were a really nice bonus.

If you're solving Google-style problems like writing a PAAS, then the benefits of Go outweigh the headaches. If you're writing a more straightforward CRUD-style Web API, then Rails might be a better choice.
They do, but not often. Maybe once a year or so.
Still happy that i went with ryzen for my recent machine. I was sick of intel behavior then, only more so now.
Show HN: Supercharge your email productivity with your voice ️
Actions speak louder than words though.
IIUC, these speculative instructions respect the current supervisor bit which was set by the previous faulting instruction.
That’s an excellent point, but I’d say that death during childbirth has always been recognized as a bad outcome. I’m not so convinced that the same can be said for the history of music before the modern mass market. I don’t think that the history of music is akin to the history of premedical chikdbirth; the history of music is in fact replete with positive outcomes we enjoy to this day.
What’s Up with Car Accidents and Black Mirror Season 4?
Instant upvote to anyone who forks it to append cat and giggle emojis to any post that references the chrome extension.

"Why is HNCutePlus on Hacker news?" giggles kittens
> Relatively few places have the ability to do ballot measures like this

By my count, 33 states make it even easier to build municipal broadband than Colorado, including most of the big ones (CA, NY, IL, NJ, PA, TX, MA): https://motherboard.vice.com/en_us/article/qkvn4x/the-21-law.... Most have no restrictions on such networks at all.
I'm frankly shocked Linus was anywhere near as restrained as he was upon seeing this monstrosity. Nothing of this sort should ever make it into the kernel without explicit and loudly announced opt-out switches. If anything close to this does make it in, even as an opt-in, this will easily be the biggest performance regression in recent (perhaps all-time?) kernel history.
What are Meltdown and Spectre the bugs affecting nearly every computer and device?
Yes, but not because of the use of non-primes, AFAIK. There also are ‘bad choices’ for the primes that one should avoid.

See https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Faulty_key_..., https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Importance_...

Also, for those that are concerned about doing statistical primality tests, there are fast deterministic tests (https://en.wikipedia.org/wiki/Primality_test#Fast_determinis...). Read https://en.wikipedia.org/wiki/AKS_primality_test for pointers to the algorithms to use in practice.
24 executives who are exceptional at chess
Can the user be expected to make the right choice there? I have no problem deciding if Uber, a local restaurant or a news site need my location or camera data. I have no idea why they would need high precision timing data or even what "high precision" is. Maybe it's reasonable, maybe it isn't but it's not as easy to decide from the user's shoes as location/camera.
No kernel modules can be closed source; GPU drivers are a common example of a closed source kernel module.
Doerfler's _ Dead Reckoning: Calculating Without Instruments _ (pages 47-73) deals extensively with this issue. https://archive.org/stream/deadreckoningcal00doer#page/46/mo...
Tesla has a market cap larger than Ford's, but is currently struggling to produce two orders of magnitude fewer vehicles.

How long does the market need to wait?
Yes:

https://support.google.com/faqs/answer/7622138#chrome
Why CIOs are best fit to drive disruptive growth?
3 or 4 people had bits of demo code up on twitter earlier today.

I implemented it myself simply based on the clues in the press release from AMD explaining why they weren't vulnerable. I don't even have a computer security background.
I thought it was supposed to be exploitable by javascript? If you can get to the machine and run c code, well, that doesn't seem like an exploit?
Enjoying this theme. Thanks for sharing. Makes HN more fun!
If so, I think the SEC might want a talk with someone.
“Win-win for both” is redundant.

(25 years after working as an editor and I’m still “that guy.”)
It doesn't look that hard, and in any case, we will suffer the mitigation consequences either way.
> The resolution of performance.now() will be reduced to 20µs.

That will reduce the data rate of this particular covert channel, not prevent the attack altogether. Even adding random noise would not rule out the attack.
3 Reasons Web Developers Need to Know Digital Marketing
Off-topic: let's say I have a really old (~18y) two-words-smashed-together domain name that I think would probably fetch a decent price and that I've considered selling. What are some reputable sites where I could obtain a reasonably accurate "valuation" of the domain?

Basically, I'd like to get a realistic idea of what it might be worth before going through the trouble of actually trying to sell it.
Close. #7 is actually not true (although a lot of hiring managers seem to think that it is). You are not required to hire the veteran per OPM regulations. They only get the point based boost.

In practice, the veterans benefit becomes meaningless once you advance in specialist grades (GS-09+). But it will get you the glorious position of elevator operator in Carlesbad.
I have the suspicion that this is likely the case for well over 90% of registered Apple developers.

I also find it incredibly disingenuous every time Tim Cook comes out at WWDC and announces how many billions of dollars Apple has paid out to developers, when the vast majority of that money is going to big organizations skimming gambling style microtransactions through massive mobile games.

It just feels like they're not being honest and selling luxury pickaxes to gold miners a decade after the California gold rush.
When I worked there a couple years back it worked out to around 40k/yr and had a very long waitlist.
I guess that is why they term it as mitigation, since they cannot fix it.
Presumably they are aware of this. If they reduce the data rate enough, the attack becomes less useful in practice. Presumably their engagements with security researchers and other browser vendors, along with internal experimentation, led them to believe that this resolution decrease offered significant mitigation.
I like the way you say moment as if the android kernel is some single thing not a hodgepodge of hundreds of different kernels across tens of companies.
> ...no problems with the bond/credit markets.

That's simply not true. Their last bond issuance was well into junk bond territory, its unlikely they could issue another round without entering into insolvency.

Tesla's only option, should they need cash, is to issue more equity, which has its own set of problems.
I try not to think of the ~1570 BTC I bought for $7/each and sold shortly thereafter. :/
The interesting thing about this is that Spectre seems to work in AMD and ARM as well as Intel. (Meltdown is the one that seems to be Intel-only). This contradicts what AMD said today and also contradicts the Intel press release.

ARM did a security advisory but nothing so far from AMD.
But in that world any other player would equally NEED Spotify's artists.
> Its ram usage would often clock in at multiple gigabytes less than chrome or firefox

Well that's funny, because Opera is based on the Blink engine (which chrome/chromium use as well.), so the memory usage should be very close to the same as Chrome.
I think this economic us vs them mentality is backwards. I'm a US citizen, but both China and the US are populated by humans. In a fair world, Americans should be able to make money in China while Chinese make money in America. If I sell AMC theaters to a Chinese citizen, and use that money to start a self driving car company, is that sharecropping or is it just a deal that both parties found personally advantageous? Does it make any difference to AMCs investment and hiring in the US? Is that Chinese citizen even that much less likely to spend the profits from AMC on US goods and services than an American citizen? Human innovation is not a zero-sum game and separating the world into competing nation-teams actually just holds both parties back, in my opinion.
Some researchers had independently create and demonstrated working PoC based on the linux patches they saw which read kernel memory from user space. At that point it was already public.

After that its all about PR and getting people prepared for the magnitude and impact early.

Also to let people know that patches that were already available can be used (restarting GCP/AWS instances, SPI on chrome).
> make HN cute again

Can we stop using “make X Y again”? The phrase it references is a racist dogwhistle. Let’s not normalize it.