skysight-inc/HackerNews huggingface dataset:
Modern Microprocessors – A 90-Minute Guide(2001)
Oh wow, I just realised that feature exists.

Also looks like Zhu is coming to town Next week. Might have to grab some tickets.
your comment can be said to be grumpy also. See?
sorry i dont get why people are salty, I dont find it interesting and just wondered what people found interesting. Why do you have to get defensive?
It has in the past - https://en.wikipedia.org/wiki/Compulsory_license
None of the Cortex M cores seem to be affected, according to ARM. These are the ones mostly used in embedded applications.
Does anyone know how trustworthy client time accuracies are accounting for clock skews?

After a bunch of google searches, I have not found anything suggesting how accurate clocks are for clients besides Charlies algorithm [0] (I want to know UTC time/epoch... whatever from each client so i can compare them) which I am concerned about adopting due to the wiki page assuming a high quality network.

[0]: https://en.wikipedia.org/wiki/Cristian%27s_algorithm
The risk of losing one's health coverage is a burden of varying severity. For a person with an chronic disease, it seems insurmountable. For a person whose child has an incurable illness, who hopes at least that that child will not die untreated and in pain, it is worse. Do not weigh it lightly in such cases. Few people, after all, are slaves. We do not therefore dismiss their lack of freedom.

I feel that you have let me down somewhat with your previous explanation of the difference between the employee and the slave, because it is clear then that you do not at all abide by the difference you set out. It is not, after all, the employee's ability to pursue his own self-interest that makes him free rather than a slave.
just passed by the SC facility (the one on Homestead?) and it did indeed look massive.

Great to hear that they are expanding in their core practice and geographies. Hope they continue to do well.
The whitepaper linked from this article introduces a new memory barrier named "CSDB". Does this work with existing ARM CPUs, and if so, how? I guess they could have always had this instruction encoding defined but just never gave it a name, but the seems a little odd.
Finally clarified this on my own and came back here to update a final time...but yeah this is the right answer.
50%, rather, is the worst case scenario. 30% is a bad case scenario, and 5% best-case scenario. Which is still a lot for large cloud providers like amazon, google, microsoft.
I don't think you understand the bug here.

1) https://spectreattack.com/:
"Spectre tricks other applications into accessing arbitrary locations in their memory. "
Spectre does not let you execute code in another guest

2) Spectre is not javascript specific. I am not sure why you think it is, beyond the fact a PoC was written in js
Agree on that last paragraph. The only reasonable thing people can do is buy more hardware to cover the performance loss and/or buy more hardware that's not needed using the bug as a pretext to get the budget approved now.
24. My middle school was dominated by a publicly-placed crappy terminal with an internet timer. My parents said I had to do one sport and play one instrument, but other than that didn't force anything. I could hang out with friends whenever I wanted, but I was a bit socially awkward and introverted until high school.
To your examples, I think your interpretation of inequality is a misconception people have on many sides (politically speaking) that perverts the definition, or rather misuses and does not consider justice within the context of equality. Obviously, your SO not directly sharing her wealth with others seems just, at least with the minimal details presented. But this implies that there is something that is fair. How do we determine that?

You also bake in within your language a level of assigned responsibility to your SO's siblings.

> "But now how can you, or anyone else have a say in what is equal?"

I'd argue we all do. It's a philosophical question that may very well have an empirical answer. Perhaps a subjective one. Perhaps many subjective ones that share common traits. But the properties of equality in reference to fairness / justice are important things. The problem is we're still sorting out those properties, if any exist.

---------------------------------------

With all that said, I would highly recommend reading some Rawls and playing around with his ideas. I think he presents some really interesting approaches to the problem. Even if you disagree with the conclusions, there is much progress made there in his work I think.

While many attempts to correct the randomness (unfairness) of life can indeed make it worse, there are things that can work, and we shouldn't give up the pursuit entirely. There is such a thing as degrees of fairness, and for every problem nature's degree of fairness is just that - random. Some we can't realistically expect to beat, and others are things I would argue we should focus on.

While I don't want the definition of fairness to be a focus of the post, I do think time spent there is well worth it generally. This post is more getting at why the definition is important though, as "what is fairness" is a huge can of worms.
Isn't this a case that describes the benefits of insider trading? Him being able to sell his stock in the company alerted everyone that something may be up.
Pretty sure that its not limited to js:

https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9...

Its a technique, not a flaw in js, from my understanding
NPR and PBS are extremely ineffective at lobbying Congress for funding; what federal funding NPR gets is indirect through member stations, but federal funding is far behind listener support and corporate sponsorship in the revenue streams reaching the member stations; the CPBs federal funding, adjusted for inflation, is basically flat for 40 years.
TLDR: two side-channel info leak attacks on CPUs: Meltdown that appears to affect Intel and latest ARM64 (Cortex-A75), and Spectre that was shown to affect Intel, older AMD and ARM64 and theoretically newer AMD processors.

Meltdown is more severe with read privilege escalation (javascript in browser could read kernel memory!), which has a kernel patch (KPTI) that can slow down many workloads by 30%.

Spectre also allows a user process to read memory of other processes/containers and potentially kernel, which was shown to work on Intel and ARM64 because their predictable branch prediction impl (Tomasulo). Newer AMD (Ryzen and Epyc) employs a hardware neural network for branch prediction, which is much less predictable but still theoretically possible to exploit. This is probably not the first time that the opacity of a neural network helped security :)
Maybe its just because I've been holding TSLA for years, but it all feels so short sighted when people panic and doom-say about stuff like this.

People have totally forgotten how the Model X ramp up went (badly[1]). This is nothing by comparison. In a couple years people won't remember that predictions were off yet-again by 6 months. They'll be driving electric cars instead.

[1] Mostly due to overly complex components like the doors, but still, the X ramp up was abysmal, and everyone has mostly forgotten about it. Consider that your foreshadowing. I'm certainly glad I didn't sell.
Singapore’s first cashless Ducatus cafe lets you buy coffee with Bitcoin
ARM posted a good overview and affected product list today:

https://developer.arm.com/support/security-update
I don't personally know of any crypto-millionaire... do you?
Cortex M cores don't have MMUs, so they cannot be affected. Also in embedded applications you would only be running trusted code anyway
> Our big brains didn't pay off for millenia, until they did, and in a big way.

That's not how evolution works. Each step along the way must produce a net benefit or it gets discarded. Just as insect wings served as propulsion for water skimming before actual flight, big brains paid off, then got bigger and paid off some more, etc. The only hiccup is the benefit has to outweigh the cost (eg big brains need more calories).

Side note: I think our wide array of modern mental disorders are costs of our brains' continuing enlargement. I.e. brains are trying to figure out how to get even bigger and more powerful without also having OCD or schizophrenia.
‘M’ just stands for microcontroller, as apposed to ‘A’ for application.

Many / most complex or multitasking embedded devices will use ‘A’ series to meet their processing requirements, e.g. network routing + OS + firmware / OS programming and multiuser processsing.

I probably should have better qualified my use of the term ‘embedded’.
This PoC is implemented in js, but my point stands regardless of the language used. It requires code executing on the same physical server as your app in order to be an issue for you. Similar to a hypervisor escape (since we're being pedantic yes, I understand this is not a hypervisor escape), the evil neighbor surface is not present if you have no neighbors.
Ask HN: What can be done to fix Spectre?
So Spectre seems like a pretty serious and deep running bug. Are there any potential fixes in hardware? I'd rather not go back to the dark ages and do without speculative execution or have to JIT everything full with mfences. What possible ISA change fixes could there be for Spectre?
DeDevelopers Blowout sale is Now On
Get Up to 30% off at Web Development, Web Templates & on Logo Designing, Banner Designing with DeDevelopers in Best Quality.
Visit for more: http://www.dedevelopers.com/ or Get a Quote: http://www.dedevelopers.com/get-a-quote
Ah excellent, I see Spectre and Meltdown have motivated my fellow software folks to take a peek at the internals of CPU architecture :)

Here's a great intro for beginners: https://www.elsevier.com/books/computer-architecture/henness...
Also wanted to point out that AMD's official statement was much better IMO.
> When Jimmy Carter says the media is applying a different standard to Trump, it lends credibility to the idea that they just might be.

Not really. Carter is a qualified expert in some things, but analyzing media bias is emphatically not one of them. Now, as a statement that seems at odds with Carter's assumed partisan bias, him saying it may be more credible as a genuine statement of belief than of a source said the same thing with either no obvious partisan bias or consistent with obvious partisan bias, but that's not the same as lending credibility to the claim itself.
+1 for Keepass.
Chanticleer Holdings announces a reward program based on blockchain
Each step along the way must produce a net benefit or it gets discarded.

Maybe so, but the benefit could have just been individual fitness signalling (like a peacock's tail) without providing any advantage to the species as a whole until the big "payday".
I'm working on this very thing right now as a side-project. It unrolls functions, if statements, for/while loops, etc and uses jupyter notebooks to do so AND allows you to interact with the result. Kind of like an interactive log.

It's early days but I'm making progress! https://github.com/ebanner/pynt
> However, this side-channel mechanism could enable someone to potentially extract some information that otherwise would not be accessible to software from processors that are performing as designed and not based on a flaw or bug.

"performing as designed and not based on a flaw or bug"

I have no words...
7/10, defense contractor doing projects no one cares about until I get my security clearance. Tired of "rudimentary python scripts", want to work on a real code base and with other people (I'm the only one on my project). First job out of college.
I don't think you understand my point. You should reread my post, especially the first sentence. It's first and alone for a reason; not sharing hardware is an effective mitigation against vulnerabilities in shared hardware.

Obviously it's not just a js bug, there are other PoCs in other languages.

I never said anything about executing code in another guest, not sure where you got that from.
This could be an extinction level event for less popular OSes. Intel, and to a lesser extent AMD, may end up causing enormous damage for which they'll pay nothing much.
No collision has been found in SHA-256. SHA-1 is the broken hash function
https://lkml.org/lkml/2018/1/3/780
This probably means software is using CPUs in a way that they weren't meant to. To me, it is funny to watch how virtualization and JIT compilers changed the game for CPU vendors who were used to making CPUs mainly for compiling and running software on a single host instance. Since we have direct virtualization support now, I suspect we are going to get a JIT support in CPUs soon (if we didn't already).
His restraint and the fact that this stuff is even being considered tells me this is a really really bad bug. I doubt he would be so cordial in any other situation.
What Do You Do When the President Gets Trapped in an Elevator?
Oh, come on. Their only goal is to make Google money. The fact that they do useful work is a nice side effect, but if they didn't improve Google's security and give good PR there's not a chance in Hell Google would keep them around.
I worked on following websites using React JS and Python

1. React JS development
Production: http://www.fredfarid.com/
Staging: http://fredfarid.it-consultis.net/
Backend : NodeJS, ExpressJS, MySQL, Docker
Frontend: ReactJS, Redux, Webpack, Algolia
https://github.com/bluearcontech/socialwebSite

2. https://www.corva.ai
https://app.qa.corva.ai/
account: user@corva.ai(password)
Technology stack.
React JS, Redux, react materialize, MongoDB, PostgreSQL, react-bootstrap, ruby on rails, vagrant

3. BetterCell.com
I have been working on this project, this website does not finish yet.
We use React, Ant Design, Redux-Saga, Styled Components for this project front end.
4. Golang Back-end development
https://staging.ur-local.com
http://platformx.universalreputations.com/
https://github.com/bluearcontech/web_go_backend
Main technology stack of this web site development.
Golang, HTML, Javascript, JQuery, PostgreSQL, Jet Template, Bootstrap, Session, Bower, Gulp

Also, I have rich experience with GraphQL and Apollo.
You could review my LinkedIn, Upstack, Github.
My Github Profile is: https://github.com/bluearcontech
LinkedIn Profile: https://www.linkedin.com/in/zhefan-li-026a97145/
UpStack Profile https://upstack.co/profiles/zhefan
Please contact me if you are interested in me.
Best Regards.
Would it be practical to run each javascript VM in it's own sandbox?

Edit: Apparently you can already do something like this. Seems to be an option for Chrome starting with 63. (Which was an October release I believe?

http://www.chromium.org/Home/chromium-security/site-isolatio...
The problem with things like sedentary lifestyles is similar to the problem with internet correlations, which in either case imply the same thing. Compare the US to other nations experiencing similar problems and it's reasonably clear that whatever our issue is, it's unlikely because of lifestyle changes alone. Other similarly well developed nations with lackadaisical lifestyles don't suffer the same problems, yet impoverished nations such as those in the Pacific isles do. And in many cases, the problems are confined by our invisible borders. The Czech Republic is a good example there. Bordered by Poland, Germany, Austria, and Slovakia. Czechia is rapidly approaching problem levels, its neighbors are not.

There's a great distance between cholera and less filtered water. Worldwide the high end estimate of cholera deaths is 130,000 and that is with liberal modeling of unreported deaths. A quick search informs [1] that about 2 billion people a year rely on water that is absolutely contaminated with feces. That's a 0.0065% death rate at the high end. Usage of isolated or private water sources along with basic testing can trivially reduce these risks down to 0. And on that note of giving context to numbers, we should look at things like the opioid epidemic. In the US in 2015 about 15,000 people died from all opioids. Even if we assume that it was 0 before, which it was not, that would not explain the ongoing decline in life expectancy. The real reason is mortality rates from a wide array of diseases including 8 of the top 10 killers, heart disease in particular, continue to rapidly grow alongside our unhealthfulness. And that was after they had been in decline for decades.

[1] - https://www.compassion.com/poverty/water.htm
I don't think that's right, Ctrl-F for "HVM" here: https://xenbits.xen.org/xsa/advisory-254.html

In the HVM case an attacker can't generate hypervisor addresses because the hypervisor runs in a separate address space, so HVM isn't vulnerable to the most easily exploitable of the disclosed issues.
> Each step along the way must produce a net benefit or it gets discarded.

More precisely, each step must not impose a net fitness cost or it gets selected against to a degree positively linked to the degree to which it imposes a net cost. But that's, more importantly, each genetic variation taken in total, not actually each individual phenotypic effect of the genetic variation (e.g., sickle cell trait was preserved not because sickle cell anemia is not a net negative, but because the malaria resistance that comes even when an individual is heterozygous for the trait is a strong benefit that manifests more often than sickle cell disease which occurs when an individual is homozygous for it.)
Arm is a problem for all kernels not just Linux in how they map on chip peripherals, etc. All the problems that UEFI solve, are not solved on Arm.
Maybe it's just because this is a more technical update, but the responses from Intel[1] and AMD really seem like night and day to me. This page is for the most part clearly written and only has a minimal amount of BS before getting to the point about:

• identifying the problems (without casting aspersions on other vendors or being FUD-y about issues that don't exist)

• specifying what _specific_ hardware is vulnerable

• info for developers (here's the patches you need if you're building your own kernel, here's a new compiler intrinsic that will be available soon for your applications, here [2] is code to implement the intrinsic yourself if you're not able to update your compiler)

• slightly less useful info for end users (update your stuff, which isn't necessarily actionable advice for some of us on Android)

• lets us know that future hardware may still require the KPTI patches, but it sounds like the speculative execution issues that aren't fixed by the patches ("variant 1") will be fixed in hardware

Things that still aren't great:

• no mention of performance impact of their various mitigation strategies that surely someone would have benchmarked in the 6 months they've been working on this. However I'm sure before too much longer someone will grab that code from their github and compare it to regular memory accesses

• this FAQ purporting to be in layman's terms definitely isn't [3]. Imagine telling your elderly relative that saw an article about scary computer bugs in the New York Times that the problem is just a "novel use of an existing side-channel technique" to "access data from privileged memory (DRAM or CPU cache)."

[1] https://newsroom.intel.com/news/intel-responds-to-security-r...

[2] https://github.com/ARM-software/speculation-barrier/blob/mas...

[3] https://developer.arm.com/support/security-update/frequently...
It wasn't common practice, but fully Javascript rendered applications were a thing as early as 2001. That was when my company developed the first one that I know of. It was a godawful ugly pig but it worked.

Most sites did nothing like that, but they did use Javascript and would break in various ways without it. At that time, there were a lot of people admonishing web developers to test their applications with Javascript disabled. Sort of like now.

ETA: I had to look it up - XHR was first available in IE 5 as an ActiveX control. The internet at large couldn't really expect it to be available but I believe that is where we first used it.

Initial release: March 18, 1999; 18 years ago
These timing attacks are all about local time deltas, not absolute times, because it’s measuring the CPU caches, not anything to do with the network. Things like “this operation took 5µs, which suggests that the data it was accessing was/was not cached”.
Their response makes perfect sense and is a careful contrast to the "everything is broken" hysteria from the other side. This isn't like Heartbleed or a remote code execution vulnerability --- the attacker has to be able to run very specific code on the processor in order to exploit anything. Thus they are basically saying "you're fine if you don't run untrusted code" --- something which bears repeating since it is the only positive thing in this whole debacle.

but in embedded, industrial and network devices - many of which will never seem workarounds from their OS / software for the hardware fault.

...many of which won't ever run anything but the original firmware they came with from the factory anyway, making it a somewhat moot point (and if there are exploits that lead to remote code execution, chances are there are better things for an attacker to go after than try to exploit a timing side-channel.)

The ones most affected by this are cloud providers and other scenarios where multiple mutually untrusting users are sharing the same hardware on which they can run arbitrary code.

The ones least affected (i.e. not at all) are isolated single-user/single-purpose machines running trusted code. This includes the majority of embedded systems, which is presumably why ARM is emphasising the point so much compared to Intel or AMD.
If you read the article, it's actually:

(2^77,232,917)-1
>It is not, after all, the employee's ability to pursue his own self-interest that makes him free rather than a slave.

Actually, yes it is. I'm sorry you feel let down, but your side of this discussion is frankly indefensible.
Cortex M and all ARM-developed cores prior to v7 are in-order CPUs, so they do not do branch prediction or speculative execution. Without branch prediction this kind of issue cannot exist.
Akamai's State of the Internet quarterly reports are the only authoritative source I'm familiar with that confidently publishes at a global data scale. They have one of the only true global networks, that reach basically into every market. They're the only global network that I know that publishes routine detailed information like that. It's not perfect, I'm not aware of anything better however. They've been publishing it for a number of years, so there's a decent tracking history of trends over time.

Here's the Q12017 pdf:

https://www.akamai.com/fr/fr/multimedia/documents/state-of-t...
I upvoted this like I try to do for most good effort/well-intentioned Show HN's, but I wasn't planning on installing it since I had customized my HN settings to make my HN usage as discrete as possible, with `topcolor` set to #f6f6ef (wish bodycolor was also a setting so I could just make the header and the HN body #eeeeee!).

But after reading some of the other comments I decided to add the plugin and am feeling that I won't regret it :) Not only do I love the use of pink in general, I love this theme's particular choices, such as the blue accent for the headline links and the muted pink for visited links for even better minimalist readability. The minimized header is a also nice touch (though maybe `new`, `threads`, and `submit` deserve emphasis -- at least based on my habits). And I guess if I want my web browser not to scream "HACKER NEWS READER" to anyone looking over my shoulder, a theme that hides the "Hacker News" header in addition to adding a pink explosion will do the trick. Thanks!