skysight-inc/HackerNews huggingface dataset:
An indirect jump is when your program asks the CPU to transfer control to a location that your code itself computes: "jmp %register". Compare to a direct jump, where the destination of the jump is hardcoded into the jump instruction itself: "jmp $0x100".

Most programs have indirect jumps somewhere. Higher-level languages with virtual function calls have lots of indirect jumps, because they parameterize functions: to get the "length" of the variable "foo", the function "bar" has to call one of 30 different functions, depending on the type of "foo"; the function to call is read out of a table at some offset from the base address of "foo". Or, another example is switch statements, which can compile down to jump tables.

What we want, to mitigate Spectre, is to be able to disable speculative execution for indirect jumps. The CPU doesn't provide a clean way to do that directly.

So we just stop using the indirect jump instructions. Instead, we abuse the fact that "ret" is an indirect jump.

"Call" and "ret" are how CPUs support function calls. When you
"call" a function, the CPU pushes the return address --- the next instruction address after the "call" --- to the stack. When you return from a function, you pop the return address and jump to it. There's a sort of "jmp %register" hidden in "ret".

You abuse "ret" by replacing indirect jumps with a sequence of call/mov/jump, where the mov does a switcheroo on the saved return address.

The obvious next question to ask here is, "why don't CPUs predict and speculatively execute rets?" And, they do. So the retpoline mitigates this: instead of just "call/pop/jump", it does "call/...pause/jmp.../mov/jmp", where the middle sequence of instructions set off in "..." is jumped over and not executed, but captures the speculative execution that the CPU does --- the CPU expects the "ret" to return to the original "call", and does not know how to predict around the fact that we did the switcheroo on the return address.

How'd I do?
Yep, I have a shop and I get a fair amount of stuff done (when it's warm in there!), but not professionally at all. Still spend my days in this chair.
Sorry, I didn't mean to come across as bitey. It's just that almost everyone I've talked to who has made this decision and lived with it for over a year has come to the same conclusion: just use a random key and store it in a database :)
Tesla is at most spending 1% of their effort on union busting and 99% on building cars.

You think they spend over half of their time on union busting?
Upcoin – new better crypto exchange market – registration bonus included
Are Apple Ax processors affected?

Could their great performance advantage over other ARM-based be derived from a similar “check later” speculation as Intel’s?
There's going to need to be some kind of blockchain-style tech that allows the source and veracity of video to be determined.
http://www.dunwalke.com/10_Clinton_Administration.htm
If you control the AP, you should disallow client to client communication. Most AP's and routers allow this and it would mitigate this risk.
I think your comment would be better if you started if off with "I truly believe that Sessions is racist and ..."

And while it may very much be true that he is, you lose influence with a large number of people by making the War on Drugs strictly about race.

Why would Sessions want to give up "tools" that help him oppress people, particularly those that disagree with all the BS policy in place and being instituted?
Feel free to discuss in the website comments the questions you find objectionable. If you find questions/answers too biased feel free to suggest new ones and I will add them. After all we are all seeking truth!
Yes but that's always a risk, and I don't think that's any more of a risk with Tesla than it would be for any other manufacturer.

We know that manufacturing can be done at the scale they need, because many others do it at that scale. So in my mind, the odds that they end up with a non-functioning plant is pretty small. They have a lot of capital, and no shortage of people willing to invest.

Compare that with SpaceX. They tried to do something that only a few others have ever attempted (reuse rockets reliably and inexpensively) and the US government had basically failed at (with the shuttle not being inexpensive by any means). This was coming from a rocket company that had just had their first 3 launches end in failure, was nearly broke, and was the laughingstock of the industry.

But Musk doubled down, and poured a ton of his own money into the company and they were eventually able to achieve their goals (more honestly, i'd say they have currently achieved about 70% of what they wanted, but most of the other 30% is still possible, just taking a lot longer than they though). And while you could make the argument that Musk wouldn't do something like that with Tesla, I think it at least shows that he's not one to give up when things start looking really really bad.
I'd prefer to rely on archaeological evidence rather than retroactive first principles; for example http://www.culture24.org.uk/history-and-heritage/archaeology... which shows a panelized wheel. I see SciAm have an article on the difficulties of a useful wheel too: https://www.scientificamerican.com/article/why-it-took-so-lo...
Correct, and in specific, the supremacy clause of the constitution guarantees that federal law overrules state law. I don't see any state AG's having much luck suing the DoJ against this as it is clear as mud:

https://en.wikipedia.org/wiki/Supremacy_Clause
I agree with you, but it's interesting to see the "worse-is-better" philosophy applied outside of tech.

I would hope that most readers of HN who build systems for a living see the value in your argument of separation of concerns and clear interfaces: Congress makes laws, executive branch enforces those laws, states make their own laws within the latitude they have.

That said, in life like in software, when subject to resource constraints and a deadline, it's so much easier to just slap in some hardcoded conditions or let this module take on a little more responsibility than it should. I think that's what happened here in the Obama era, and like C, we had a pretty good outcome from it. But again, like C, if we let it fester too long it can cause no end of pain down the road.

So I'm actually happy with this outcome - Obama hacked in a proof of concept that seems to be working, and Sessions (though perhaps not his intention) is tackling the tech debt. I don't see this going any way but marijuana being legalized federally down the road.

(All that said, the current "system" is not great in terms of separation of concerns. It's my understanding that Congress didn't say marijuana should be illegal, but the DEA, right? The DEA should totally have no say over it.)
At the risk of being a HN self-parody, I’ve also been wondering what this means for the Mill...

https://millcomputing.com/docs/prediction/
Generating Sequences with Elixir Streams
Given the frequency with which old guard Republican politicians get caught soliciting liaisons in public mens rooms while openly supporting legislation that discriminates against the LGBTQ+ community I'd drug test Sessions before I made any assumptions about his use habits.
>cigarettes and alchohol have massive black markets to bypass heavy regulations.

Are you speaking on the US or worldwide? A quick search doesn't produce any reliable statistics that indicate this. I have never once heard of anyone purchasing alcohol on the black market. Cigarettes, sure, but even then it's typically only very low-income folks purchasing cheap, illegal tobacco that is generally not of great quality. This is in stark contrast to marijuana where high-grade product can be purchased on the "street".

I suspect that once(if) pot goes legal the black-market will consist mostly of cheap, poor quality marijuana. This should take a nice chunk out of the profits that gangs see from marijuana distribution.
At this point, everyone who is paying attention knows Tesla’s estimates are optimistic, including Elon Musk.

And no, there’s nothing illegal about being bad at estimating.
I've been using this for about a week now. It's exactly what I was looking for: a simple notification that reminds me to go read my comments.
What makes you think the Mill would be immune to these issues?
You should note that that is from the "What to submit" section, which has no bearing on comments. In that regard this whole submission may be off-topic, but comments on a submission are inherently on-topic.

But also see:

Please don't complain that a submission is
inappropriate. If a story is spam or off-topic, flag
it. Don't feed egregious comments by replying; flag
them instead. If you flag something, please don't also
comment that you did.

Just flag and go away from the submission.
It harms the pharmaceutical industry, the private prisons and police budgets, to name a few examples.
Yes, the 2nd Amendment, however that tends to not work so well.
This is what I'm talking about:

http://www.separatinghyperplanes.com/2014/12/no-you-cant-con...

https://www.vox.com/2014/4/9/5597392/fancy-math-cant-erase-t...
Yeah, I thought both looked a tiny bit off. I think it has to do with the reflection in the eyes which is a tiny bit inconsistent, among other things.
What's nice in theory is having net neutrality established through legislation rather than regulation. Same thing here.

I cringe a little every time something I might want gets implemented merely through the benevolence of those in power because those people change.

This should be decided through legislation, or possible through judicial neutering of the commerce clause. But the commerce clause knows no bounds thanks to the decisions made regarding the ACA, so here we are.
I think we will get it everywhere soon.

And no, that's not a solution. Well at least not everywhere. If the clients aren't completely isolated I can for example poison your DNS and redirect example.com to my computer's web server.
So Cat and Mouse is layman’s term for Adversial network?
This sounds incredibly bad.

For most more complex programs and libraries, you have no control over when they malloc(). If you spawn a thread and run any library function in it, it may malloc().

Doesn't this mean that any program written in any programming language that supports multiple threads and spawns subprocesses is broken (it is racy for deadlocks, if the spawned process also wants to malloc)?

(EDIT: I misunderstood what the parent said, so it's not so bad. See my comment below.)

Is this problem discussed anywhere? Are there known ways how people handle this problem?
Science has a solution for that constant ringing in your ear
We do exactly the same, it's a great feature to have in JWT's.
You might be able to use this same technology to counteract this from happening.

If you generate content you would have a base to test an AI to spot actual fake content. You could use video's and pictures like these to test a learning AI to spot discrepancies, then report findings in detail.

Makes me wonder if there is a future in forensics for this type of technology.
ARM-based startups like Qualcomm, Broadcom, and Apple? Who are these ARM-based startups you speak of?
It certainly goes a long way towards redirecting money to favoured state companies and building protectionist barriers, yes. Whether it provides any actual security is another matter.
They are not free. This is the THE reason I use Spotify over any others.
Ableton Live in conjunction with the Push is a fantastic, very tactile, very musical solution to this. The Push is a very well-designed hardware instrument that, because of its tight integration with Ableton, has much of the flexibility of software. It's a really interesting approach and very productive from a music and creativity standpoint. This YouTube video gives a good sense of it:

https://www.youtube.com/watch?v=0CdMvkBOUgs

I believe quite strongly that for most people, utilizing hardware of some kind (pad controllers, keyboards, etc.) is essential for making music. Music is generally made by playing instruments. It is the small errors, the groove, the emphasis, the spirit/heart/soul of playing an instrument, that makes music feel alive and interesting and vital. If you're just clicking around with a mouse, you're programming it, and programmed music sounds programmed. Overly precise, inhuman, etc.

In Glenn Gould's debut on US television, conductor Leonard Bernstein talks about - and then demonstrates - the difference between rote, mechanical playing of a score (i.e. "programmed music") vs. a performer's interpretation of it (i.e. the heart & soul that I'm talking about). The discussion starts around here:

https://www.youtube.com/watch?v=9Nx09pigZRI&feature=youtu.be...
> If I say I want $120k, I won't get a job.

I do actually know devs who make this much with ~5 years of experience, but they made the conscious decision to forego the large consultancies for smaller shops with less overhead.

One observation I made in Scandinavia is that the billable rate for tech professionals (including designers) appears to be more or less static. Customers pay roughly the same hourly rate regardless of whether a dev / designer has 2 or 20 years experience, so the most consistent path to higher compensation is to drop layers of support / management (with freelance being the highest).
Quite the contrary. I am glad he is doing this. It is a huge tactical blunder that will force the states' rights issue into court and either result in a victory for the states or massive public discontent about federal overthrow of popular state policies.

Either way the federal government is going to see their influence eroded here.
"2 versions of the same code" is not a very precise description. Either it's one chunk of code or two chunks, or one chunk that extends the other chunk in some way.

What we ended up in my case was one chunk of code (server) that extends a shared chunk (server/client), with plenty of server vs. client branching inside the shared chunk, either on a boolean flag or the presence of some data structure that only exists in one environment.

I have never seen the use case that many people flippantly claim is so easy, which is the "one chunk" concept, nor have I seen a chunk of server- or client-only code extend shared server-client code in a way I would describe as clean. Stuff tends to get messy when you have to deal with the space between the server and the client, like cookies, asset loading, or third-party services, or when you have to do fancy UX tricks. Then users who are used to "traditional" websites do things like refresh the page at weird times, click buttons more than once, load the app from the wrong URL, use the wrong browser, click things too fast, leave a tab open too long, and so on. And then, as others have mentioned, you have sensitive logic that needs to live only on the server for business reasons. Then the framework you're using moves too quickly or not quickly enough to support a browser feature you didn't know you needed until right now. All this stuff only comes in later, once the app meets the ground, and is rarely discussed in initial architecture meetings. The only way I could possibly see these solutions as cleaner than the old "two-chunk" way are if I were to automatically dismiss all those pragmatic concerns or consider them to be cleaner simply by virtue of the fact that they're different.

It's frustrating to me because I see so much optimism on online forums about "Universal" JS as this earth-shaking sea change on the verge of happening, even though honestly it's been 10 years since NodeJS came out and first made Universal possible. It makes me feel a bit like an old fogey for throwing up my hands and saying, "Let's just let it go and stick to the original design of the web," meaning, two chunks. But that's the only way possible for me to deliver the real requirements I have on projects without driving myself crazy.
A bit late but if you want to we can discuss by email (my address is in the profile). I might not be able to help much but if you have no lead so far, a native Vietnamese is better than nothing :)
Have you heard of prosecutorial discretion?
Those mentioned are surely just convenience features ;) to believe that a single intelligence agency might exploit them in some way is clearly a conspiracy theory! ;) ;)
Graal can be used with "traditional" HotSpot, in which case the user would observe no particular difference in (download/disk) sizes.

But this article is about SubstrateVM, which is a JVM that links itself with the program being run and throws out the rest. You can get very small program sizes this way, comparable to Go.
From what I’ve heard of Apple TV, it does not compare favorably to a $35 Roku stick.

Point taken about cable tv boxes though. The cable company keeps offering to pay me to put one in my house. I fell for that once. Never again. (It is not worth the closet space or hassle of returning the equipment after a few years.)
> against this as it is clear as mud:

Mud is opaque. The phrase "clear as mud" means "not clear at all", or "baffling".

(I only point this out because there are peoplereading HN with English as a second language, and some of them are interested in idiom. I don't care how you use language, and I'm not trying to "correct" you.)
Mill has no speculative execution.
ARM’s white paper details a variant 3a that affects some of their cores that are unaffected by var3 (and vice versa)
people have already chatted with an AI without noticing it was an AI an not a person

I'm sure this have worked in some limited context where the human was not actively trying to figure out if it was a human or AI. I mean, I have sometimes at a distance mistaken a mannequin for a human - that does not mean mannequins are now indistinguishable from humans.

In the Turing tests the judge is active trying to discern if they are talking to a (adult, literate, mentally sound) human or an AI. AFAIK no AI have ever passed this. (Of course it is easy for a human to impersonate a bad AI by answering erratically, but that doesn't really prove anything.)
Ah right, of course. Sorry, in the midst of doing a pile of stuff I should not be commenting on this without studying it further, I figured that the first level read access would allow you to dig up the secrets required to give you write access which would then allow you the free run of the whole system, but if you are still on the other side of a virtual machine then that won't do any good unless that virtual machine can be escaped as well.
This reads like a strong warning to the already cautious payment processors that legalization hasn’t eased any of the uncertainty around processing payments for dispensaries or made banking any simpler for them despite a massive market having just opened.
Funnily enough, I ended up not including a PS starting with "A sufficiently smart JIT, however..." ;)
The details that this attack depends on are outside the architecture of the system, in the microarchitecture. A cpu of almost any architecture can be vulnerable or not depending on how it was implemented, thus Ryzen is immune to the worst variant while both Intel and the fastest Arm cpus are vulnerable.

I'd presume that the slowest RISC-V designs are immune due to not speculating enough, while any high-performance implementation is vulnerable.
My perspective of it from the UK:

- $60k/year is a lot of money for most people. Median household income is £24k - and people are generally more worried about whether they're better or worse off than the people they know than in absolute terms. In the UK most good careers cap out at £50-60k - maybe £10k more in London. Growing up, I always considered 6 figure salaries to be out of reach.
- It's not necessarily about being _content_ with earning that much. Unless you're willing to move to the US (most people aren't), you have to find someone who'll pay you more than that, whether for programming or for something else. If you're unable to get more money then it's better to be content with what you're getting!
- A lot of people I know put a lot of value in work life balance. I have a friend who's under 25 but has already cut their hours to about 75% because they would prefer free time to extra salary. From limited experience this seems a bit at odds with US work culture.
- Yes, I think in large part it's down to less VC funding pushing ludicrous amounts of money into the ecosystem.
- The recent performance of the £ vs the $ has made a significant difference when comparing to the US.
Define "trusted"? Who do you trust to do your verification, and how much does it cost?
This is poised to be a giant states rights issue/fight and there's nothing Trump likes more than a fight
I'm not a person who would encourage marijuana (or other intoxicant) use, but the federal government should absolutely be letting the states set policy on that.

While this is not new policy (it only removes some conditions established by the previous administration) this is an example of the sort of federal overreach that real conservatives and libertarians reject.

For those who support heavy federal government involvement in healthcare and other social programs, this is an example of the downside of that approach.
dupe

https://news.ycombinator.com/item?id=16067758
> d I fear there's little reason to think that the "three variants" from project zero's announcement are the full scope of the problem.

Agreed. This is an entirely new class of vulnerabilities, and we're just at the beginning.
Totally agreed.

Yet (to continue with the metaphors) telling someone dying of thirst "You should've packed more water." isn't immediately helpful.

Please assume (and that is addressed to everyone who would like to comment) there is no other way, you are in that spot and you need to get that work done. That's what my question is about.

And BTW, I can't speak for other people, but in my case being in these situations where I have more work than I can complete within regular working schedule, is more often caused by me loving my job too much, then me, being forced to work longer hours.

Thanks for the links, will check those out.
If I were a US Attorney trying to bring pot cases in California, Colorado, or Washington I'd be very worried about jury nullification. Maybe I'd be able to solve the problem in voir dire but I wouldn't bet on it.
Leaks of this sort are almost always trial balloons. I'm sure this was an intentional leak. They're looking for a backlash, at which point they can quietly forget about it (if they don't want the fight) and pretend it never happened.
DVD Flick 2018 Burn DVD Download for MAC and Windows
> Eventually they did away with the comment system.

Sounds like that was a positive step, wasn't it? Getting rid of the system that allowed the company to comment on your review?
On the other hand one could frame this as the majority of states decided and those nine states are the tyrannical minority.
Taking population into account, that's not that unusual - the vast bulk of people ever alive also fall in the last 200 years.
It's also a scummy thing to do and sets a terrible precedent. Do you want friendly customers on your WiFi or do you want angry customers who feel cheated when they learn the truth?
Maybe, but unlikely. Life as we know it depends on some rare chemistry.

Carbon is the only atom [I know of] that can form long chains of double bonds (even triple though they tend to be unstable enough to not matter). Nothing else allows the chemical complexity needed for self reproduction.

Water is a weird molecule. Many chemical reactions happen in water that would be uncontrolled or not happen at all without water. The polar properties, the fact that is expands when it freezes (that is frozen water floats on liquid), and acid/bases are all interesting properties that are very useful for life. I suppose that something else could fill this role, but since water is common in the universe I doubt it.

Yes life elsewhere is unknown and so we cannot say for sure it will not look like our, but chemistry is a known.
How Drug Prohibition Caused the Opioid Crisis
CPU hardware vulnerable to side-channel attacks