skysight-inc/HackerNews huggingface dataset:
One of the main reasons for speculative execution is to fetch data into the caches ahead of them being needed. If you don't modify the cache, then you throw that away.

May be one way would be to use a smaller, separate cache for speculative execution and then copy that value to the regular cache once speculation is confirmed? This would add a one cycle latency for cache-to-cache transfer but there might be better ways.
Important to note that at this point they're only reading one bit at a time from kernel memory, but it could probably be changed to read more--exactly how many branches it could compare before the mis-speculation is detected is not discussed, and that could be an area for large speedups in the attack.
The mitigations are to disable SharedArrayBuffer and severely round performance.now(). Not good that there aren’t other less intrusive ways to mitigate.
Spotify has years of my listening data and preferences, other services don't. So if I compare Spotify's recommendations to others, it will always be better, and I'd have to put in a lot of hours into another service for it to catch up.
1421: The Year China Discovered America
Mazda and Toyota have created a joint venture to work on electric vehicles [0]. Not sure if they plan to sell cars under the new brand, or if it's a technology company only. I suspect the latter.

[0] - https://www.reuters.com/article/us-toyota-electric-vehicles/...
Is cryptojacking really this common these days? Is there an easy way outside of using these lists to detect if a site is attempting this?
Do you think the political will is there to let people die in the street?

If not, the running out of money part happens either way.
It's not just about the amount of data, though. The speech and audio quality of Google's TTS data is likely better than the audio contained in the LJ dataset (disclaimer: I've only listened to samples contained in the latter, which have some audible reverberation). Ideally, you'd use a professionally trained speaker and record them in a (semi-)anechoic chamber.
And this contradicts the above how, exactly?
Couchbase CEO on AWS, Oracle and IPO
If you are interested in looking at what reddit is saying about any coins you are researching you can try http://bitreddit.com.
Disclosure: this is a side project I am working on to learn react.
And if you're a web developer, now it the good moment to make sure your site works correctly when JS is disabled.
Thanks for this. Would love an annotated version of this if anyone is up for it. My C is pretty good, but some high level "what is being done here" and "this is what shouldn't work" comments would be cool to see.
Perhaps an alternative approach would be to productive some of your prototypes. For example, have you made a cool exhibit for a children’s museum? If so can you make it generic for all children museums?
There are substance abuse problems in all countries, yes. it does not follow from this that the country doesn't matter. Social norms, access to treatment, poverty/inequality, perceived hope about the future, etc are all functions of particular policies as well.

See Portugal's response to a major opioid crisis versus the US response and which one had better healthcare outcomes, etc. See the links between chronic joblessness and substance abuse, etc.
To make it a bit clearer how this works: the Variant 2 exploit poisons the branch target buffer to cause the processor's speculative execution in kernel space to jump to an entirely attacker-controlled destination when it hits a branch that matches the information the attacker has placed into the BTB. The actual retired instructions don't go this way of course - the processor detects the misprediction and goes back to execute the real code path - but the speculatively executed path still leaves evidence behind in the caches.
> Because only 2% of their teachers are male.

To be fair, they are at almost exactly the national pre-K average there.

> Speaking seriously, if you want to normalise women in roles where they aren't you need to normalise men in roles were they aren't either.

OTOH, given finite demand in each field, getting more women into high-paying professions that currently are disproportionately male should naturally result in more men in low-paying professions that are currently disproportionately female as a natural consequence.
Thinking about McDonald's comment a bit more: McDonald's optimized for fast turnover, so maybe they aren't the best fit. Instead you might want a sit-down restaurant chain like one of Darden's, such as Olive Garden. Picture "Unlimited soup, salad, breadsticks, and EV charging."

It's funny because it could be evolutionary pressure back away from the drive-through model. You could even imagine the classic Drive-In model making a big comeback. A Sonic restaurant already looks like a modern EV charger facility from a distance. (Though personally, I don't ever eat in my car, so that has less appeal to me.)
Nobody is going to yell at you for calling the 911 a sports car (and they don't all have rear seats, I assure you). They'll regard you as an eccentric if your choice for best sports car has the engine in entirely the wrong place, however...

The Z3 is an interesting comparison. Inexpensiveness was part of the British formula that Mazda preserved, and it's not present with something like a Z3. I guess whether you regard that as important is a question of taste, or politics.
NSA is in the middle of a bozo explosion. It's hard to keep good people when they have to deal with so many bozos.

To give you an example, there was a reorg a few years ago to outsource NSA's IT. (Makes a lot of sense that an agency that pretty much only does IT would outsource IT, right?)

In the reorg, 500+ people were identified as having no discernible skill that was relevant to the mission. They were segregated into their own org and given busy work. When the outsourcing occurred, the contractor was incentivized to employ and retain them for 2 years, including the 500+. To entice them, they paid them above their government salary.

The contractor could not figure out what to do with them either. It treated them as "casual employees". They were given a salary, but did not have to report to work and had no responsibilities. For 2 years.

Once the incentive ran out, these folks went back to NSA and got rehired as government employees. According to the hiring rules, they went right to the top of the stack.
https://lopp.net/bitcoin.html

Great resource that covers a array of topics on a spectrum of levels for different audiences.
Spectre is a much more serious bug I feel, but it requires the VM to run the malicious code snippet inside itself and with the right context, not from other guest VM, that is how I understand this. The kinda bug that would totally destroy cloud as a business is the one that other guest VM can read your memory...which doesn't seem like to be the case, for now...
I did on first attempt to load it, then it worked on an immediate refresh. Probably a cold cache or something.
> And this contradicts the above how, exactly?

Documentation: Data may not be read from any supervisor-mode address.

Published vulnerability: Data may be read from any supervisor-mode address.
> Advocating for more diverse teachers doesn't seem insane to me.

Agreed. I am male as well and while my school did not have many male teachers, I definitely benefited from the few male teachers that did exist.

> We should probably pay teachers more to encourage more high performers of both genders. I suspect paying better would attract more men as well.

At the (public) schools I went to, teacher pay was solely determined by credentials and seniority. Anecdotally, men seem to be more attracted to positions where compensation is determined through performance and risk. If that's true, perhaps changing teacher pay to be more reflective of performance would increase the number of men.
Who downvoted this comment? This is a beautiful poem reminding how short life is. However you are achieved and done it passes like a flash. What is wrong with some people? They are trigger happy I guess, downvoting what they could not understood. Shissh!
I don't get the impression that those are the full extent of the changes though; I think those two were called out only because they're API changes rather than implementation details. Haven't checked the code so I could be wrong, of course.
I don't have anything exciting to add, except to say thanks for posting it. Math was my weaker spot in school and trying to shore that up.
How is it in terms of availability, responsiveness to issues, and those kinds of things?
Bad for short term Bitcoin price speculators.

Good for long term investors and enthusiasts hoping for a grown up Bitcoin to achieve mass adoption and legitimacy as the worlds most standard digital currency.
https://en.wikipedia.org/wiki/Te%C3%A4n

(Super uncommon, yes, but it exists)
This is not correct.
That's just what the POC chose to implement.
This is so incredibly bad. Spectre is basically unpatchable. We can do better than we are now with patches but it's all just turd polishing, essentially. A proper fix will require new CPU hardware. And as a kicker? Leaks are basically undetectable.
It's so unusual a thing to do that it becomes clever for that reason. Maybe other things too—I haven't looked. But I'd say it passes the "interesting new phenomenon" test (https://news.ycombinator.com/newsguidelines.html). Small things can do that as easily as big ones, if not more.
@lern_too_spel

The AMD engineer could be right if talking about Ryzen, and/or he isn't mentioning user-user and user-kernel boundaries.

AMD isn't affected in nearly the same way as Intel/ARM are: https://twitter.com/ryanshrout/status/948683677244018689
From the FAQ on spectreattack.com:

> Q: Am I affected by the bug?

> A: Most certainly, yes.

Scary.
> Your mistake is conflating what the user authorizing with what the user wants.

Unless you are arrogant enough to believe that you can read the user's mind to know what they actually want, then the only alternative is that you end up with a system that can only be used for the narrow use case you imagine.

This is probably why the Linux Desktop is only really useful as a web kiosk.

>If blaming the user for mistakes was going to be a successful strategy we’d have evidence of that by now

If user-oriented permissions were going to work we'd have evidence for that. Instead what we have is people being infected by ransomware that never needed a privilege escalation at all, because some idiot was so concerned with protecting the OS from the user they forgot to protect the user's data from malicious actors.
Or ... it's a pipeline problem. Exactly like it is for women in tech.
I would think that any sane implementation would not transmit privileged data to waiting instructions.

Look at their Listing 2: Instructions 5 - 7 will be waiting for the privileged data from line 4 (they are not speculatively executed since they have a data dependency on line 4).

So why is Intel releasing the privileged data to the waiting instructions? An answer could be that violation checking is delayed until retire, but other implementations are possible.

Anyway, so it could be that AMD and ARM are vulnerable, but it's possible that they are not.
I’ve been wondering the same thing. I think it depends on how/if the hypervisor tries to “emulate” speculative execution on some calls or instructions. If it does and does so faithfully, then perhaps. My guess though is that such emulated functionality would be missing this bug.
Alaskan infant's DNA tells story of 'first Americans'
Then surely you must also argue that all data-dependent, side-channel attacks, such as key recovery attacks against some cryptographic algorithm implementations, are the fault of the hardware.

Unlike Intel, ARM and AMD are implicated only where the attacker can inject code or data (specifically data that is manipulated by pre-existing vulnerable code) into the target address space. The particular kernel exploits require injection of a JIT-compiled eBPF program, as they said they were unable to locate any suitable gadgets in existing compiled kernel code. I wouldn't rule out gadgets being found in the future, but much like cryptographic software timing attacks, the proper fix is to refactor sensitive software logic to be data independent. There's no way to implement an out-of-order, superscalar architecture and protect against this stuff simply because of the nature of memory hierarchies. All you can do is 1) ensure that privilege boundaries are obeyed (like AMD and ARM do, but Intel notable doesn't), and 2) provide guaranteed, constant-time instructions that programmers and compilers can reliably and conveniently leverage. Unfortunately, all the hardware vendors have sucked at providing #2 (much timing resilient cryptographic software relies on implicit, historical timing behavior, not architecturally guaranteed behavior), but it nonetheless still requires cooperation by software programers, making it a shared burden.

Also, FWIW, basically everybody outside the Linux echo chamber has known that eBPF JIT and especially unprivileged eBPF JIT was a disaster waiting to happen. This is only the latest exploit it's been at the center of, and the 2nd in as many months. The amount of attention and effort that has gone into securing eBPF is remarkable, but at the end of the day even if you could muster all the best programmers for as much time as you wanted it's still an exceptionally risky endeavor. Everything we know about the evolution of exploits screams that unprivileged eBPF JIT is an unrelenting nightmare. But it's convenient, flexible, and performant, and at the end of the day that's all people really care about, including most Linux kernel engineers. The nature of the Linux ecosystem is that even if Linus vetoed unprivileged eBPF JIT (optional or not), vendors would have likely shipped it anyhow. It's an indictment of the software industry. Blaming hardware vendors (except for the Intel issue) is just an excuse that perpetuates the abysmal state of software security.
My head is still spinning writing an OS is a BIG DEAL!!!!
Any estimates on the market valuation? Not mentioned anywhere in this article, and the $20B number floating around sounds quite high to me.

For comparison, Vivendi/Universal is at $35B (based on its share price) with 20K+ employees in multiple divisions vs. Spotify in just the music streaming business with 1600 employees.
My understanding is that in Utah they did that with Utopia and the lobbyists put some pretty big roadblock in it (and refused to use it). So I don't think it's that simple.

I'm not super knowledgeable in the field, but it's also my understanding that it's much, much harder to do TV + Internet, while just Internet is significantly easier. A lot of the shady deals with municipalities and regulations involve the TV part of things.

I'd personally be happy with just one hassle-free, super fast pipe just for the internet, relying on Netflix, Youtube, Hulu, Amazon, Twitch, Crunchyroll, etc for all of my TV needs (that's what I do right now already). But it seems that the majority is not willing to give up cable TV entirely, and that limits the target audience.
Oh no.

Let's take a second here. What will happen if Spotify signs new artists and effectively becomes their own record label?

It will start off normally, but eventually (or possibly from the start) Spotify will not allow this music to be streamed anywhere else. It will be exclusive to Spotify, the same way Netflix has done with their originals.

Now what happens? Users are forced to pay for multiple music streaming services, just as happened with the video streaming industry.

This is already a huge burden on users of video sites (and makes piracy a much more appealing option), but is not even acceptable in the music industry. Users create playlists with their own songs, and will want specific songs.

Even with your 90% statistic, which may or may not be true, the other 10% is still very important. I'd imagine that hit songs are streamed more often comparatively but older songs are more important.

Hopefully this fracturing doesn't happen, but if so (as I said) piracy certainly looks more appealing. Especially with Google Play Music allowing you to upload your own music..
SirMixABot Robotic Bartender Is Now SERVING
Sounds like all instance types can now be run in HVM mode (news to me, but the AWS tech in the thread made the claim). Converting to HVM is annoying but ultimately not that hard or risky. Since HVM mode appears to resolve much of the performance issue, this seems like a reasonable workaround.
Please don't post glib, baity comments about divisive topics. That's close to the troll line if not over it, and we ban accounts that do it repeatedly. From the site guidelines at https://news.ycombinator.com/newsguidelines.html: "Comments should get more civil and substantive, not less, as a topic gets more divisive."
Are you a Kiwi?
Periodical cicadas
Plus it's much easier politicaly to get new infrastructure build than use those funds to maintain what you already have. Their are hardly any federal grants for mantaince but you want to build a 4 lane boulevard that's not going to be used much for the next 10 years here's 30 million.
What I understand is that the hypervisor of GCE has been patched already and so some customer running on the same machine as you can't exploit you. However if you are running KVM or something yourself on a Cloud instance (vm in a VM) then you should patch that.
Snek: PowerShell Wrapper Around Python for .NET to Invoke Python from PowerShell
Yes and no. The cost of some malicious party figuring it out and using it on Google would potentially been far greater than anything this could cost.
Because customers need support. They need someone to call when service goes down, they need someone to call when a billing error occurs, they need someone to call when moving properties. I wish Open Access networks applied to more services in the states like telecom, gas/electric, railways etc. Let the government worry about city planning and where to lay pipes, rails or lines, and let the companies do the day to day management of servicing customers.
The two types of side projects and when to chose the perfect one
Long time ago, in a far away office park there was an intense discussion over so called "flag early" and "flag after" designs.

Flag early camp argument was - protected pages should not be allowed to be fetched to begin with by any insecure execution flow, and we need to pagefault before speculative execution

The "flag after" camp was all for post-factum pagefaulting when the branch has finished execution, so you do not need to pagefault for every branch, and only do it for the branch that has "won"

Chip design magazines from nineties has all that well covered.
> To be fair, they are at almost exactly the national pre-K average there.

And Google's representation of women in software engineering roles is also around the industry average.

To your second point, it's not either or. You can both better incentivize women in tech and men in teaching.
If true, how are edge computers going to connect to the cloud?
The Bolt might be perfectly competent but it is not "sexy".

Can you see GM making competent electric cars? Yes they can do that all day long. Can they make it sexy?

That begs the question if GM can make any sexy cars. I would say that the Corvette, Camaro ZL-1 and Cadillac CTS-V might be fair examples of what GM is capable of.

So the question is can GM make a sexy mass produced electric car? They haven't tried yet.
How much value would be destroyed if black hats discovered the bug first and people started discovering that information from their Google cloud VMs was getting leaked?

Sure, Google could just patch themselves, but the information to recreate the issue would surely be leaked by a xoogler, since it only takes a single sentence describing the vuln for a competent sec team to recreate it
According to the page, Project Zero only tested with AMD Bulldozer CPUs. Why didn't they use something based on Zen/Ryzen? It's not clear if the 3 issues affect Zen/Ryzen or not.
Alan Turing’s “Can Computers Think?” Radio Broadcasts Re-Recorded
My first car was an early generation MX3. As well has been incredibly fun to drive and also practical (it had a rear hatch), it was practically indestructible. I literally spent no effort to maintain it. Additionally, Mazda (at the time) had the interesting idea of introducing cars a low price and then increasing the price every year. This kept the resale price high.

I suspect that historically Mazda made a mistake of pricing their cars too low. The Toyota Corolla appealed to NA buyers because it was seen as a "good" car. Mazda cars, in comparison, were seen as "cheap" cars.
Ask HN: How long until mfgs ship laptops without the CPU bug?
Was going to buy a new MacBook today then realized I probably should wait... so: how long until we see a non-software fix available in consumer machines?
uMatrix, although it doesn't have the various anti-XSS protections of NoScript.
But its UI is great, much better than NS IMHO, and it's not limited to script blocking.

https://github.com/gorhill/uMatrix
Here is my physics engine! (Works in your browser too!)

http://htmlpreview.github.io/?https://github.com/aguaviva/Ph...
Doesn't each tab run in a separate process?
Thinly veiled ledger ad
https://malwaretips.com/threads/stylish-browser-add-on-2-mil...
Since Xcode 7. See “Free On-Device Development” here.

https://developer.apple.com/library/content/documentation/De...
Or migrate to google since they don’t have a broken discounting billing system
Haven't they moved that goal back 1 quarter every quarter so far?
I started by reading this as the tale of one person's tumultuous trading history... which made me really concerned for this person's money.
I think a Tesla acquisition is a good best-case-scenario for them. Their brand, design, and Gigafactories will be valuable for a company with the manufacturing chops to take them on. I’m more bullish on SpaceX, and I think Musk would be better served to focus on it more.
From my point of view it looks like they are trying to do something that would normally take 5 years in 2. Even if they "fail" and it takes 3 years, that's still faster than the "normal" way.
Most games aren’t using anything remotely near as sophisticated as that. Most games use rigid body simulations, and while the details of each implementation is different, most of them work in a similar way. The common method in open source engines is a projected gauss Seidel [0] which is used in bullet physics. Most other engines (PhysX and Havok) are to the best of my knowledge using something very similar.

[0] http://www.bulletphysics.com/ftp/pub/test/physics/papers/Ite...
Yeah, the blog post says they knew since June 2017, with that blog post being from July.

> This initial report did not contain any information about variant 3. We had discussed whether direct reads from kernel memory could work, but thought that it was unlikely. We later tested and reported variant 3 prior to the publication of Anders Fogh's work at https://cyber.wtf/2017/07/28/negative-result-reading-kernel-....
troll or propaganda?
Coincidentally, I was browsing the "Just Sold" section on Flippa this morning and came across this site: https://flippa.com/9361923-ohmycoins-xyz.
I hope the telecom industry comes to regret their lobbying and bad business practices.
NoScript[1] works pretty well.

[1] https://addons.mozilla.org/firefox/addon/noscript/
Yeah, act like a boyscout, but don't expect any merit badges in return...
Nothing about pedestrian safety that more technology won’t fix
That sounds like a win either way!
Hiring Senior Java/Scala Dev's in Vancouver BC
All the ones i've met had full time employee badges ;)
People who probably are white and male.
Just closed $45M in Series D funding back in May 2017 and looking to grow our development team of 150 -225! Please apply on the link above our email jordan.chan@visiercorp.com for more details.
Insurance prices stayed the same

... which is a big improvement over double-digit-percentage annual increases in the rest of the country.