skysight-inc/HackerNews huggingface dataset:
At least some of those resources can only deal with encrypted data to reduce the amount of leakage to acceptable levels.

Or maybe we can contain the problem by having a kernel that manages access to all resources, but keeps individual processes on nearly separate hardware.

As you can probably tell, I have no idea what I'm talking about here, but the more of these big side channel attacks that come out, the more I'm feeling that there is no way to securely share a machine among multiple processes without just giving up and letting them all have access to one another.
What you need is the conda package manager (from anaconda python), in my opinion. Docker is very powerful, but is useful for other purposes (e.g deploying code) than simply grabbing a bunch of python modules and running analyses in a notebook.
Kansas and California both have equal representation in the Senate, which every federal law must pass through; there is no taxation without representation comparison to be made here.
I do not get it. Because in antic Rome it was acceptable (or common) for men to have homosexual relations with young boys you are still making the link between these words today?

"heretic" and "science" or "monk" and "psychopathic torturer" are synonyms as well?
"Without performance loss" sounds optimistic, but most things that people would be doing with a Mac likely aren't syscall-intensive enough to show major effects, especially on modernish chips with PCID. Most of the more impressive performance drops from the Linux patch are with things like heavy database workloads.
Everything we know About Anthem
Do you truly believe Apples sophisticated security enclave with computer-like capabilities (and probably running a full OS) will have a manual and white-paper? This is the exact opposite of what Apple will do, they will lock it down and put it behind patents as they do best.
Or NSA had them do this intentionally, and thus, its not a bug :)
Trump Admin Proposes Massive Expansion of Oil Drilling, Including FL and CA
Look, if you want to be snide then it's just as easy to say that Medicaid won't be around because expanding it to non-poor people will cause it to go broke. Either that or the desire to cut health care costs from both sides of the spectrum will cause the program to go broke.
This is good advice. XYZ is a significant spam signal & likely to result in non-delivery of email, which seems especially important for an email notification service.
At my last job, my (Data Science) team all deployed production code including our models. We were using Scala, which made it fairly easy since we could essentially just build fat JARs and upload them.

In contrast, I've found trying to do the same thing with Python nightmarish - simple things like having Pandas .20 on one machine and .21 on another will result in silent changes in how some metrics are calculated.

Anaconda mostly, but not entirely, solves that problem with its superior environment management (significantly better than pip IME.) But given that it's imperfect, I'll probably look more into Docker soon.
I mean, it's not like a Master Lock is hard to pick or shim. Good comparison ;)
so it is a flaw in the spec then.
I find it interesting that Apple is back to high levels of customization in its PCs. If I'm remembering correctly, one of the big motivators to move to x86 was to be able to use more commodity stuff through out the system, rather than the all the custom work required to design PowerPC system. I recall initial speculation that Apple's x86 machines would be pretty much fully custom chipsets and designs that just happened to have an x86 CPU, but then when the release systems came out, they used Intel chipsets and were pretty ordinary from a PC hardware standpoint.
Have a look at pipenv - [https://docs.pipenv.org/], it provides deterministic builds and sane package management for python and is the officially recommended Python packaging tool now. If dependency management is your major problem, Docker might be an overkill.

P.S. -- Even if you are on Windows, whole SciPy ecosystem can be easily installed with pipenv, no need of conda for that now.
Could you somehow mark cache lines that are filled by speculatively executed instructions so they only become visible to normally executed instructions when the speculative instructions are committed?
I guess that would require a lot more logic and more cache tag bits.
You’re thinking of reddit.com/r/rustjerk
Why do you keep insisting it comes down to him to audit the entire Linux codebase? The advantage of it being open is that there are millions of potential eyeballs out there all with different areas and levels of expertise.
I thought about that too... AFAIK currently paging system is not generally accessible to userland programs like browsers. They would need some way to setup different contexts for untrusted javascript code and the internal services that the javascript can call.

Also maybe the context switching would need to be made faster, because you would need to do that whenever eg javascript calls browser interfaces.
"Fork is the direct cause of the stupidest component I’ve ever heard of in an operating system: the out-of-memory (aka OOM) killer."

Well, technically, no.

Originally (1st Edition?), IIUC, fork() would fail if enough memory to copy the process wasn't free. Then, when fork() was changed (4th Edition?) to read-only share the address space, that wouldn't happen, but the exec() might fail if there wasn't enough space to set up the child. But those were all doing segmented memory so they're completely irrelevant to modern systems.

The OOM-killer comes with (IIRC) BSD's paged virtual memory. Some bright spark (yes, I have hated this design since I first tripped over it in the early- to mid-'90s) had the brilliant idea of supporting sparse matrices by not requiring allocated memory to be backed by valid pages, either RAM or disk.

If you don't require allocated memory to be backed, you can allocate a giant block of memory; if you never touch most of it, everything will be copacetic. It's good, I was told ca. 1992, for scientific programs in, like, FORTRAN. Yay. Unfortunately, lots of programs started using the feature, including the X server.

(Why do I hate with the fiery passion of a thousand suns the perverted genius who came up with this? AIX 3.2.5/4.1. Running the machine out of memory (remember, allocations don't fail, everything chugs along until some proggie touches an address and the OS can't realize the page) would kick off the OOM-killer, which would immediately hit inetd in the head with its little silver hammer, resulting in a machine that would still be working, -ish, sort-of, but unless you were logged in somewhere already to reboot it, you would have to go visit the physical console.)

Turning off the OOM-killer and overallocation policy was possible, but not advised, since many programs, including the X server, would suddenly use a truly atrocious amount of memory.

TL;DR: Memory overcommitment doesn't have anything to do with fork()/exec(), but rather is a deliberate design decision made with the addition of paged virtual memory, to support a limited class of applications, that probably didn't work very well even for that class.
Great reality check. I'll remember this point every time I read an article spouting the "there MUST be life out there because there are SO many planets" line.
> I think the only real fully-encompassing solution to this is a redesign in how we use computers.

You can do a lot by separating these speedup mechanisms across security boundaries. The biggest factor that makes this hard to mitigate is in-process security boundaries. Total isolation between processes is neither necessary nor sufficient.
> What. The. Fuck. How am I supposed to recover my data e.g. if the mainboard gets fried or the machine has to go to service?!

Either switch off the feature or use backups.
Not a bug, but a feature.
Can you show us some of those good results?
> hyperloop

This is vaporware at this point.
So true. I recently started using it while learning common lisp and it is really fun and really frustrating
Detroit requires all late night businesses to install cameras monitored by cops
There is apparently a checkbox to autmatically insert an unsub link. I will see what this looks like.
> In my opinion, though, subtractive synthesis is the easiest to "get".

Interesting, for me additive is the most intuitive. I find it easier to visualize sums of sine waves than subtracting harmonics from a more complex waveform (such as a sawtooth), particularly when considering the use of notch or bandpass filters. But that may have a lot to do with my education, which featured a heavy dose of Fourier Transforms and associated techniques.
What the heck are "data files"?
Yep! Makes sense. For the sake of completion, just tested it and all is well.

I can see myself using this framework. I've used min/skeleton/others before, so it's nice that this has parity (or close) to those frameworks while using less space.
I promise you NSA's machines run on Intel chips too
Yes, there's a database (pgsql) for persistence, though no 'session state' is stored there. All of the middleware/services are stateless.

And yes, I realize now that I could accomplish much the same thing without using JWT (a decision made some time ago, when everyone was raving about JWT), but I've got bigger priorities than ripping up my auth system (which to the best of my knowledge is working acceptably well) ATM.

But I do plan to take a look at it and perhaps migrate to something else in the future :)
Most of what we do is pretty parallel: web hosting, servicing requests, databases, hosting tons of VMs and containers, etc. I don't buy it.

My guess on Phi is that it wasn't a big win over fewer deeper cores and so there was not much market. This might change things a bit.
noob question here. Why isn't normal data readable? Why is only predicted branch executions readable?
The attack is pretty brilliant; but it's also not quite novel. Cache-timing attacks aren't new; certainly CPU suppliers should have known the general issues at hand for... at least a decade? See e.g. Colin Percival's somewhat related attack on hyperthreading way back in 2005: http://www.daemonology.net/papers/htt.pdf

Actually exploiting the information leakage isn't easy; and its compounded by the secrecy surrounding cpu internals. So I think they definitely deserve some blame here. Yes, the PoC is new. But the attack surface was widely known more than a decade ago, and they chose to punt the issue onto software; a solution that was unlikely to really hold water.
Could you say more about why robotics today? It has always seemed very mature and saturated to me. I went into the automotive/manufacturing industry after getting graduate degrees in controls and recently shifted toward software and simulation work at the same company. What business problems are out there right now creating new demand for expertise in this area?
How does this compare with the dynamic height restrictions advocated by the Strong Towns blog?

For more about the problem:
https://www.strongtowns.org/journal/2016/10/23/portland-hous...
Ironically, a chip company, whom deals in ones and zeros all day long, committed a very serious logical fallacy: appealing to the common practice.

One way to interpret the statement is that the chip design which they utilized is widely available and understood by everyone in the chip community to be good chip design, thus we aren't at fault, because everyone is doing it.

To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice.

They should fire their PR team.
Cloud vendor Scaleway reports that Intel has promised them a microcode update: https://blog.online.net/2018/01/03/important-note-about-the-...

"According to the latest update from Intel, a microcode is required to completely fix the bug. The microcode release date is, at this time, scheduled for an undisclosed confidential unacceptable late date"
I've written about this at length here: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

(It's also the first link in the README for the project this Show HN is linking to, FWIW)
I'm happy to hear that my struggles with doing data structures in Rust were not my own specific failings. A tiny bit of vindication there.
That link no longer loads for me.

AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.
Wouldn't you get aleph_1 divisions, if, by methods left as exercise to the reader, making a cut for each real number? For example, how many angles are there in a circle? But the real kicker is, that taking the 2D surface of a ball, certainly the area is finite even if there are no bounds at all.
> but isn't that straight-up corruption?

My understanding is that check-in agents are given pretty wide liberties and that doing this sort of thing isn't really against the rules - I even do this with clerks whose nametags say "Manager". Employees are encouraged to give above-average service to customers who will bring long-term value to the business, and a customer who treats the employees well with token-but-meaningful tips is a good customer. I tend to strongly prefer return-visits to companies whose employees have done such things for me.

The trick doesn't always work - if no rooms are available or if they suspect they'll probably be able to sell the room at full-rate they don't oblige. This said, every agent has graciously apologized and returned the "tip" (=bribe) or given well above the $ worth of other kickbacks (restaurant vouchers, free wifi upgrades, etc.).

For the company it makes sense : it doesn't cost much more for a guest to stay in a suite versus a regular room, and the extra wear on a "luxury" car doesn't cost that much more than the wear on an "economy" car. May as well give it to a customer who's showing appreciation and will likely be extremely happy with their service and probably come back.
Yes, this is mainly about classism where race is but one component in establishing class. Medical care, education, justice are not rights in Conservatism, they are products. And classism ensures that elites get better access to those products because they can pay for more or better versions of them. Attacking decent cheap products, can make them more expensive and exotic and thus in the hands of mainly elites; or it can remove them from the market entirely leaving only the more expensive established products, again mainly in the hands of elites.
I read the Telegraph link, it says at the end there's not yet enough evidence to support the claim that the ape-human split occured in the mediterrainian rather than Africa as generally accepted. (Aside, this is a suprisingly nuanced take on science for a newspaper)

However, even the person proposing this theory is suggesting that if they didn't die out completely, then afterwards the descendents probably moved to Africa. If accepted, your claim that "Europe was the birthplace of mankind" is subtly diffferent from the original claim of this thread chain, which was "We are also all African descendents; it's only a question of how far back" which if we accept the new theory is true twice, African before the split and African after the split.
it's interesting that a default argument vs Intel is very unpopular vs Apple. i don't see any reason what that should be; if anything, both should be under the same scrutiny for doing basically the same thing.
But the rest of the world doesn't recognize FDA approval (and the FDA doesn't recognize any other country's approval process). So the cost of certification has to be paid again for every country its sold in.
Extending Ethereum with private and powerful smart contracts
Based on my understanding of the issue, the main difference between now and then is scale. Pre-iPhone, Apple didn't have the scale to make their own chips economically; now, with the massive success of the iPhone, they're able to do this.

Their major value proposition is that they're able to build software-differentiated hardware, so building their own chips is extremely valuable to them.
In one HN thread I've seen one person is talking about the benefits of tipping officials, and another commenting on how we've all broken laws anyways and that prosecution is mainly based on not "pissing off" the government.

When did my country become third-world?
Singularity [0] is a related alternative.

[0]: http://singularity.lbl.gov/
graphql-autharoo – Auth helpers for your resolvers
Yes, but then again, they could also be running with mitigations, like the HAP bit for the ME.
>> We don’t describe speeders as “illegal drivers.”

that's not apples to apples. "illegal driver" would be someone who is breaking the law by the very fact of them driving - ppl with no DLs for example. same with illegal immigrants - they are breaking the law by the very fact of being present in the country they are not permitted to be in.
Rust: Ashley Williams Joins the Core Team and Taking Lead of the Community Team
So it's a bug in the specification.
The community seems content with fixing the issues through third party projects so far.
Trickle down ancestry?
That Stopped during the rise of the iPhone and iPad when they made the A4 chip. Once they figured out how to vertically integrate that during Jobs. After the death of Jobs and the appointment of Tim Cook we just see that vision taken to the end of which we have now.
Seeing Intel's patches on LKML they seem to suggest that retoline is actually preferable over disabling the branch predictor [1]

[1] https://docs.google.com/document/u/2/d/e/2PACX-1vSMrwkaoSUBA...
I’ve seen a lot of posts recently discussing humanity’s concept of the size of the cosmos throughout history, but never a timeline of discoveries and the prevailing estimate du jour. I would love to see something like that and Wikipedia doesn’t do it justice.
Ripple is certainly an interesting technology to have emerged in the Blockchain sector and one of the few which has serious commitments from outside relevant parties.

This has come with compromises, and while I do applaud their business acumen and look suspiciously at their centralization, it’s honestly out of my mind how it could be valued at such a high price and I’m not so sure that market capitalization can be a valuable indicator, due to their centralized approach, both in functioning and ownership.

Let’s see where all this goes in the following months, it’ll be a fun ride
Quoting their docs: "Compute Engine doesn't bill for instances preempted in the first 10 minutes," so that scenario is harmless in most application designs where preemptible VMs would make sense anyway.

Disclosure: I used to work at Google on GCE, but not directly on preemptible VMs or this billing policy. I don't currently work or speak for Google.
This is on my list of tools to investigate next. Glad I’m headed in the right direction.
Just install pytorch.
Will a judge grant a warrant for what's basically a fishing expedition (it's not like they're looking for a named person), for thousands of hotels, every day? I'd be very surprised.
If it can read the right data (private keys, etc.), then it can write whatever it wants.
Why do HTTPS pages get a pass? Between CDNs and ad networks, there's a ton of code out there. At some point, we decided that a magical protective box could make it okay for random people on the internet to run code on our machines. We keep finding this premise to be flawed, with Applets, and with Flash, and now with Javascript, and we always say "oh, if only we had a better protective box, it would have prevented this specific form of attack". Maybe the premise is flawed. Maybe no box is strong enough. Maybe we should stop running code from websites.
Unfortunately he doesn't share the secrets to wealth in America. The main claim is innovation, which isn't a secret and, on an individual level, is certainly less likely to generate wealth than knowing the right people.

And he doesn't discuss the way that wealth has been confiscated in America, financialization, because he and his friends benefit tremendously from it.
Wasn‘t aware, thx!
I wonder if an optional microcode update disabling usermode access to cache flush and rdtsc instructions would make it impossible to do the low level timings required to make the measurements

(of course it would break other stuff, but maybe being able to enable these process by process might be appropriate)
Yes, but the point is that now we don’t have to build a full CMS. Off the shelf ones won’t typically work for the sort of content being edited (i.e. it’s not blog posts etc).
Also recommend this as a follow-on. I think it's an important point, and also well presented. The anecdotes make it memorable but it's concise where it matters.

After I read this last year it changed the way I interacted and observed things around me for a while. Poking/prodding more, and asking more "what/how" questions.
That is the odd thing about the history of life on Earth isn't it? Prokaryote popped up almost as soon as was conceivably possible. And then. Nothing. For billions of years. The plausible explanation is that you need Oxygen for Eukaryotes and that's how long it to change the chemistry of a planet. It just seems weird to me.
My principles for shipping a data pipeline
This is a super important point.

A complete layperson can use open-source software knowing that it has been looked at by at least some part of the community, conferring all kinds of security benefits.
XPS 13 developer edition 7th generation available
usually most popular coins are not profitable to mining due to increased difficulty. i would suggest to try http://whattomine.com/ to decide.
It feels like you should be able to make a version of branch prediction with speculative execution that behaves the same as the non-speculative-fo-real execution. As in accessing memory you can't actually access doesn't cause a load and does not speculatively execute further instructions with data you weren't supposed to be able to load in the first place.

This is after all what the real execution does; when you try to load from a memory address that you are not allowed to, it does not cause a memory load, it does not affect the cache and it does not continue executing instruction but instead generates a page fault. We skip the page fault thing in speculative execution, obviously, but we shouldn't continue normal control flow.

I'm sure that is a lot more difficult to implement in silicon and may end up negating the performance benefits of speculative execution, but right now it feels like not having the memory protection in place in speculative execution is a performance hack that exploded in all our faces.
No, it's perfectly fine to have an opinion about an ideology, like: "I don't believe in the Bible/Christianity, etc.". A statement like that only makes a judgement about yourself which is of course your right.

If you dislike something, there's usually a fear underneath that. People who dislike Christianity on a deeper level are probably afraid that if everyone was Christian X would happen. Sometimes that's realistic, sometimes it's not, but expressing your fear is OK and usually helps people understand you better than if you simply say "I don't like X type of people".

When you switch your focus to a group of human beings and say "I don't believe Christians are...", you're judging others. When we judge others we're probably bias in some way because none of us have enough accurate information to uniformly judge the millions of unique people that identify with a race or religion.

Just saying "I" first doesn't mean you can then say whatever you want. If the target of your judgements is a person or group of people, you're probably not being honest with yourself about what you're uncomfortable with and projecting your fears onto a group of people. That's typically what racism is about.

Instead, it's usually more accurate to express your fears about a particular non-human target (like a law, behavior, etc.) and leave people out of it.
Docker (Inc.) Is Dead