skysight-inc/HackerNews huggingface dataset:
I’ve been trying to learn all this stuff lately. One thing that bothers me though, that perhaps someone here can help with.

In Minkowski diagrams you set things up to have rays as diagonal lines. But this way of illustrating things suggests that light moves in time. But they should really not be interpreted as that since they essentially define the limit of the time dimension.

So I was thinking that I would like to have another illustration of things where light moves in 90-degree angles instead to fix this.

Are there some specific, established ways to do this?
Meltdown and Spectre Fixes Arrive – But Don't Solve Everything
Very good tips ;-)
Yeah, and there are reasons for that. Focus groups kill creativity with group-think, and TV reeks of it. Standards and practices and other varieties of self censorship mean TV shall fight forever with one hand tied behind its back.

The internet is frequently better than TV, because merit is free to boil to the surface without being stifled. It’s not that the internet is free of bland tripe. But merely that it’s costly to force bland tripe to the front, and when the state-sponsored tripe gets upstaged by something better, it’s harder to bury the higher quality content.

The problem with the internet is the firehose of The Long Tail ultimately does bury absolutlely everything (good and bad), so once again, over time everything is obscured by default, leading to micro-generation gaps (maybe spanning as little as two years) and reasonably large subcultures that never see the light of day.

On some level though, the movie industry has proven that profits don’t matter, since we see that for the last decade, profitable movies are mostly unwatchable garbage.

So, even if TV manages to be profitable, it can surely deserve the same sideshow status as movies. The only thing the internet paradoxically lacks right now (despite massive unicorn companies with nigh unlimited resources) is the unrestrained budget movies enjoy. And this is because the most captivating things on the internet are authentic in real time, and cannot be “budgeted” in a traditional sense.
Thing is that Bash is something you can assume to be reasonably widely available[0] — like Perl or Python — but I wouldn't expect to have to avoid any features from the last 10 years of either of those two. Sure, a certain grace period is to be expected but I think 10 years is way past that.

[0]: I know POSIX is supposed to be even more widely available but depending on what you're targeting then it may not be the best option [source: https://en.wikipedia.org/wiki/POSIX#POSIX-oriented_operating...].
I once drank water from a natural spring in Kolomenskoye Park in the middle of Moscow. Tasted great with no ill effects. Don't know if it's safe for chronic consumption though.
You don’t need to do such complex things. You can just require(‘child_process’).execSync(‘any shell command’) with all the user credentials.
What does this mean ?

ElasticSearch starts off as a small Java application that wraps the Lucene library.

Obviously heap will increase with usage and number of documents but I am still confused how it is in any way "expensive".
When I went to the boy's orientation last summer at UIUC, a lot of the parents were doing that --- like, maybe one in every other row. That was the moment it sunk in for me that Apple might have been right about this (if not right about the timing).
Yes, but to do that, your code needs to use the same branch predictor as the victim code. If the branch prediction buffer is per-core and not shared among multiple cores, then that means you have to run on hte same core as the kernel. If the kernel always runs on a different core, you cannot do anything.
One point of view is that because it's low level API. Flexibility has been valuated over easy of use. In general I think that offering low level API is ~only right way to do for real application platform. You can always make more easier opinionated high level API over it (like three.js). If platform has only high level API you cannot make it another way around.

Good example about this issue is CSS. I have a bit strong opinion about this but I really think that fact that we cannot polyfill flexbox / grid layouts is "proof" that this technology is not good enough and lower level API would be better option (and current CSS model maybe built on top of that).
In my mind Meltdown is a failure of implementation due to the choice to violate the logical design. If the logic of your design says "do not access ringX memory if you are not executing in ringX" then don't do it. Intel instead decided that they would access it but thought they could hide the results of that access from the process by never providing the read results. The problem is that actions always leave evidence in the physical world, simply assuming that no one could detect those actions (which was true at the time) is not the same as not committing the action. The benefit for Intel in violating the logical design rule was speed (and probably a reduction in gates) and the optimistic view that there were no consequences to the violation. Unfortunately hubris invited Nemesis to the party, as usual.

Spectre is a different problem in that the very design of speculative execution contains the seeds of its flaws so there really is no way to implement it in such a way as to avoid the intra-process snooping although the inter-process exploit may be avoidable via implementation.
> We expect that Meltdown and Spectre open a new field of research to investigate in what extent performance optimizations change the microarchitectural state, how this state can be translated into an architectural state, and how such attacks can be prevented.

Not to be cynical or downplay the research, but that's the kind of thing you (have to?) put into papers to make getting research funding easier in future. Hardly a new field, just very difficult to do research on.
The firmware driving the VC4 on an RPi is non-free and closed, and the VC4 runs with greater privilege than the ARM core, with access to all the RAM. This firmware may not have security bugs like the ME and the PSP have had, and it may not contain a backdoor that we know of, but technically there's nothing stopping it from having one without anyone in the public knowing it.

Still, no Meltdown and no Spectre on any RPi
A small visual complain. The Django logo is really too big. I am on a big screen, not sure if that's relevant. But it's preferable to scale back. Firefox 57 on Mac.
What model of laptop?
Google Analytics has a query parameter that can be used to extract arbitrary data. So make a request to that with an ID that you control I guess? GitHub mentions it in their CSP post: https://githubengineering.com/githubs-post-csp-journey/
Interesting but from a modern perspective is not perl a better scripting language to learn.

I have never used bash scripts professionally i.e. as a language rather than a simple script with just a command in.

Like wise back in 87 or so I got trained in sed and I have only used it once since, and that was when I was playing around with early linix's (when it came on a huge number of floppys)
No, that's not the Debian problem. The Debian problem was that they literally ifdef'd out the RNG refresh code.

And, again, Debian's problem was in their version of the OpenSSL userland RNG. Applications that simply relied on /dev/urandom rather than OpenSSL's janky mess weren't impacted by the bug at all.
There's such a thing called: 'embargo period', wherein CVEs are (in most cases) responsibly disclosed to various parties---including several Linux distributions---much ahead than the general public, to coordinate security errata.

So you can be assured that Red Hat coordinates with upstream. It also has a serious "Upstream First" policy (with sensible exceptions, of course).

As to whether Red Hat has kernel developers, of course it does. :-) Much of Red Hat's popularly began as a Linux distribution. If you're curious, the LWN publishes statistics about who contributes to the Linux kernel, and the most recent one is for the 4.11 development cycle -- https://lwn.net/Articles/720336/

(Disclosure: /me is a Red Hatter.)
Is there an online politics and policy forum that for its topics matches the quality that HN achieves on technical topics (or does better)? Specifically, I mean the knowledge value of comments, the expertise and sophistication, and the lack of flaming and trolling.

I have yet to find one with a signal to noise ratio that is even nearly worth my time. Most are filled with misinformation, partisan spin, and propaganda attacks, none of which I learn much about (except what the latest misinfo, spin, and propaganda is). I want a forum that's focused on informing its members.
Attorney-client privilege is interesting. What happens if you say that you have emails and voicemails from an attorney?
Its built into docker swarm, afaik. You don't need to do anything special setup for TLS.

https://docs.docker.com/engine/swarm/how-swarm-mode-works/pk...
They're on to me and my evil attempt to smuggle lolcats into the US
Build an Image Recognition Classifier
beautiful work. To anyone who is interested in really understanding relativity deeply without intimidating math, I recommend Tim Maudlin's book: "Philosophy of Physics: Space and Time".
The Ideal Paragraph
Curious as someone who has considered micro dosing - what would you say the effects of taking the lower dosages repeatedly were that would put it in the 'abuse' category?
Visual Studio 2017 Throughput Improvements and Advice
Great article, but it's depressing to learn that acts are optimising their performances for a single "instagram moment" that will maximise publicity, potentially at the expense of the actual live experience.
I brought up single instance since you suggested using a SQL database most of which don't support a distributed deployment in the same way ElasticSearch does.

My point was merely that ElasticSearch scales from very small use cases to very large ones. You don't have to setup a cluster. And that using your SQL database isn't going to be significantly easier to manage.
Jehanne Operating System in 2017
Yeah the kernel does a great job in maintaining backwards compatibility, the rest of the stack not so much...
In general, the best way to read Info documentation is inside Emacs.
> I'm just saying there is no such thing as 'plain text'.

And I'm just saying it's pedantry. 'plain text' is an umbrella term for 'not binary'.

> I also think that plain text is a bad idea, binary files are much easier to parse.

Binary files are definitely faster and more compact. And tools such as google protocol buffers makes passing information very convenient and efficient. Unfortunately, most APIs out there use JSON, so we just have to live with it.

Maybe the widespread adoption of JSON and plain text APIs is a reflection of how we, as developers, have become more likely to optimize for our own development process rather than the actual hardware (see all the electron craze).
I've also thought about this, though not your conclusions.

Pushing society forward tends to require society's help. And a big issue is we've become far less tolerant and more cynical of change. We certainly consider ourselves tolerant but that's mostly on a small subset of all issues - primarily just social stuff like sexuality. By contrast imagine we did not have electric poles up today and somebody suggested we string up these poles all around the country. And they also suggested we wire them up with enough juice flowing through them to kill anything that happened to touch them and something else at the same time - and that these wires could also easily start fires and more. Society wouldn't even consider it - preposterous, unsafe, won't anybody think of the children, blah blah blah. A solar farm frying some birds gets headlines today. I mean... really? Society used to be more tolerant to risk, challenge, and capable of dealing with uncertainty. That opens up the doors of possibility.

Another big change is that I think many peoples' goals in life have changed from moving society forward, to just earning a lot of money. Revolutionary invention is not really the best way to make lots of money in society. In the pure sciences, like physics, it's positively fruitless. Even in the more monetizable fields, it's extremely high risk and the rewards are are wildly variable. 20 years from now Elon Musk could easily be the richest person in history, but he could also just as easily be bankrupt or approaching it. Getting back to the first point, what happens when the first person dies on a SpaceX mission? What if the two people SpaceX plans to send around the moon end up dying catastrophically? It really shouldn't matter in the grand scheme of things, but society would flip a lid, government would try to regulate, and it would be a catastrophe far greater than the loss of life. Dangerous calculus if your life's purpose is money.

Ultimately we have a conservative society that's risk averse and driven by money more than by invention. It's not a good recipe for cooking up revolutionary change.
Gorgeous way to keep track of CA fourteener climbs
MSI is the only company I know of with 32GB in a 13" laptop. No clue if they boot linux.
To everyone in this thread: please step back and ask yourself why you're continuing to comment. Are you looking to be understood? To understand? To prove or show that someone else wrong? If it's not one of the first two, please just stop. If it is one (or both! which is what it should be) of the first two, take another step back and ask yourself what's the most constructive way of accomplishing that goal. Right now you're all just talking past each other, commenting at each other rather than with each other. It doesn't matter how any one else is commenting or how wrong they are: you can only change how you yourself do.
Does the Django postgres module handle partial word lookups?
Does anybody think it would be a good idea to use AI to automate reminders of the information when it becomes relevant? How would something like that be implemented?
A bit ironic, given the article is about all the ways you could get screwed by NPM packages if you don't have a CSP.
This is almost entirely subjective and workload dependent.

We know that the biggest performance factor in both of these patches
(spectre, meltdown) is the kernel boundary.

So saying something along the lines of "Redis is more affected than Mongo" is.. odd.

MongoDB (I HOPE) will save files more frequently than redis, since redis is primarily in in-memory DB
with some lazy IO access (depending on configuration).

So if you have a lot of small network calls to redis (which, is a kernel boundary event.)
then it will be more impacted than a mongodb which takes only a few very large requests.

My gut is that the opposite would be true for the same workloads on both, MongoDB needs its files to return data, redis doesn't.

Even the vfs-cache is in kernel "space", so if your entire data sat in vfs cache it wouldn't help.

But that's my gut, and your exact usage may not mirror the 1:1 of this scenario.
I look forward to the day when solar panels are efficient enough that an aircraft can appreciably recharge its batteries while gliding.
They have that idea too in "System Management Mode", which is separate from the Management Engine.
NPM: Many packages and/or versions have disappeared
Beyond the lack of smartphones/earbuds, the two big things that stick out to me:

1. The cars. Sometime in the 90s and 00s cars started becoming a lot less boxy (compare the Camry from 1990 to 2000 to 2010 to see this).

2. Way more formal dress wear. In today's NYC financial district you plenty of jeans, and even a lot of financial professionals have given up the suits and ties. The financial district today also has more tech workers, and I believe more tourists.
I'm not entirely sure what your objection is; light does move in time.
Just noticed it when starting a new project. Seems like i'm not the only one.
Founder of https://commando.io here. Thanks for the shout out. Curious how you heard about us?
If any of my bash scripts get long enough to where I want a reusable class, I rewrite in Ruby.
The number of commenters defending/sympathizing with raw water proves Silicon Valley is vulnerable to this kind of hysteria. I'm routinely horrified by how many people here fetishize the natural, without understanding that Nature is a hostile force that wants to kill us! We should all be grateful for the Wall of Science that protects us from Nature. (Source: MS Biology)
They can get and spread Giardia. It's fairly common and that would be bad. Even the other strange diseases they could communicate to a family member or immuno-compromised co-worker isn't a small deal either.
It's not entirely uncommon to have TCP on the backend even for AAA games.

I worked on a huge open world third-person shooter always-online AAA game and it uses TCP for everything.
You have a terminal if you're on a Mac or Linux machine. It takes bash commands by default. Knowing perl is good, but knowing more bash is always good.

I hadn't known that <(echo "hi") is treated as a file with the contents of stdout, which simplifies commands that take files as arguments.
The term that the original poster didn’t include is “Cogeneration” [0]. Another use case would be desalination in areas without an adequate supply of freshwater.

[0] https://en.m.wikipedia.org/wiki/Cogeneration
Also see: https://github.com/npm/registry/issues/255
Not the OP, and I haven't used PG regularly for a few years, but back then I vaguely recollect the query optimizer not behaving consistently based on whether you had a full column with a GIN (or GIST) index and a (potentially partial) index on an expression for some reason. In a nutshell it preferred using the full column with an index rather than the expression index.

Even more importantly in some circumstances, having the full column allows the optimizer to pick another index when it's totally relevant, and filter the relevant rows without needing to recompute the TSV one by one for the subset.
Nothing like a good mental colonic with a brutal dissolution of ego to increase that amygdala response, right?
"apt upgrade" (unlike "apt-get upgrade") does pull in new packages, but it won't remove existing ones.

I don't see why "apt upgrade" wouldn't install the new kernel. It's hard to tell what when wrong without knowing any details.

Anyway, if apt decided to hold back a package for some reason, most of the time you should be able to install it with "apt(-get) install". Do not install packages with dpkg unless you know what you're doing.
I noticed no effect from microdosing mushrooms (0.5g per day for a few days) but I don't suffer from depression. How long did microdosing take to make a meaningful effect?
Is there any way to quickly wipe and restore a full macOS? or other OS for that matter? As someone who travels, well, all the time, it seems a massive amount of overhead at the moment.

If everything is in the cloud, that means I have to be sure to have fast, reliable internet at my destination (which is definitely not always the case). And any way I can think of to securely travel with a copy of my data is just the same problem: the CBP can request I unlock the other device.

Ideally, we just wouldn't be able to be compelled to unlock our data, without the high probability of being forced to hand over the device because of our refusal. How is this not a violation of the Fourth Amendment? It's frustrating in the least.
No, this should work in any POSIX-compliant shell.
I would be curious to hear about other examples where the idea seemed truly terrible, but then exceeded beyond their wildest dreams. I hear partners regularly citing this - and then they talk about AirBnB. Who are companies 2-10 who actually make this a pattern, or is this just bias because AirBnB was such a smashing success and it's a good anecdote?
FYI you can now split [1] and shrink [2] the number of shards.

1. https://www.elastic.co/guide/en/elasticsearch/reference/6.1/...

2. https://www.elastic.co/guide/en/elasticsearch/reference/6.1/...
> JavaScript […] is a demonstrated attack vector

Does that mean that we are soon going to be vulnerable to remote exploits via WASM as well? Do mitigation attempts such as reducing the JavaScript timing resolution aslo apply to WASM?
I'd agree. It's just relative.
I like the quality of discussion on HN. I think we should discourage things like posting pithy quotes from comedians. Especially if you won't even stand behind the point you're trying to make.

And yes, I would like my perspective to be understood.
It's now called coordinated disclosure, for reasons.

And, correct me if I'm wrong, but apparently calling Linus Torvalds and Greg KH the general public (as far as Spectre and its (poor for now) mitigations are concerned) is the new norm. I'm not sure of what the community will think of that. And of the corporate actors involved in that curious choice.
The light and dark of AI-powered smartphones
It is indeed over the top. Almost too much to believe. Oh, wait. It is too much to believe.

This notion that any place within 100 miles of a border is a "4th Amendment Free Zone" is an urban legend. The ACLU should stop spreading it.

The exact issue we're talking about here has been tried all the way through the Supreme Court, which found that the border search exemption only applies to people with some nexus to an actual border crossing.
Sounds like an opposite situation. GP's comment was about people avoiding buying the lines that haven't been updated, and you are only recommending the un-updated lines, so you aren't trying to steer people away from those old machines.
Quite right, but it's a tradeoff. We have years of experience with the effects posts like that have on HN, and they're dreadful.

I puzzled over this dynamic for years but it seems clear to me now: the issue is genre/medium fit. In the case of the GP comment, the genre is the diatribe. A scathing diatribe in a small literary salon or journal, like n+1, is one thing; on a large, public, internet forum it's another. In the first case it's interesting and leads to interesting responses. In the second it's a fast track to the bottom of the barrel, a snake in Snakes and Ladders.

Imagine if anyone who felt like it could reply to any n+1 piece and n+1 had to publish all of them as new pieces without editing. What would happen to quality? It would tank. Personal projection, simple misunderstanding, dimwittedness, windbaggery, reversion to the mean: every known factor would work against you. Extrapolate further and this would kill n+1.

In both cases—a small literary forum and a large internet one—the goal is more complex, more interesting formations, but the way to get them could not be more different. The more I learn about this, the more I appreciate McLuhan. Most of the issues on HN derive from the medium, not what people post to it.
I have been looking at AMD/Epyc CPUs recently.

(Because making NUMA aware C++ code is hard, and AMD Epyc is a single socket on a server with 4 very closely knit NUMA zones so non-NUMA code will run better on that vs Intel)

But unfortunately there's no comoddity server from HP/Dell available yet. But I hear one is on the way on the Dell side.
No, one does not need to read in between the lines for that, either. One can simply read the lines. Far from everyone being "just focussed on the technical issues", the questions over the share dealings have made the news in the papers, from The Australian to The Irish Times.
I really dislike the term "responsible disclosure" in this context. I might consider it responsible to notify a software vendor about a vulnerability in their software so they have a chance to issue a fix to their customers before the rest of the world finds out. But this situation is different. These vulnerabilities affect everyone, and only a special few were allowed to prepare in advance. That's just preferential disclosure.
This refers to this: https://ghostbin.com/paste/q2vq2
Also HN comments: https://news.ycombinator.com/item?id=15946095