skysight-inc/HackerNews huggingface dataset:
> I'd say for new folks I highly recommend Doug Demuro's youtube channel. Unlike other car reviews that focus on the high end market, I like how he still focuses on extreme details around ergonomics to performance and look.

Are you talking about this channel: https://www.youtube.com/channel/UCsqjHFMB_JYTaEnf_vmTNqg/vid...

I'm guessing not, since it seems to be almost entirely focused on the high end market. Does he have another channel or something? What am I missing?

My preferred channels are Alex on Autos[1] and sometimes saabkyle04[2]...

[1]: https://www.youtube.com/user/TTACVideo/

[2]: https://www.youtube.com/user/saabkyle04/
Juicy PoC exists?
Bingo, we have a winner!

PS: Tough crowd
I've previously (~1 mo. ago) applied for a position at Canonical but never heard back, and the application receipt confirmation email stated "... if you are a match for any roles at Canonical, we will reach back out to you directly..."

Is there any sense in submitting another application for this position?
Intel FUD. AMD is not affected.
Maybe the problems with the component couldn't be diagnosed by the agents assigned to the platform. Maybe there was further work that needed doing on the same job that required more of them, and there was no point in leaving for 10 minutes and coming back. Maybe they were just wrapping up.

Obviously there's tons of waste, and maybe you were right about that example, but it's also very possible you're not. These anecdotes people love to trot out about manual labor are really silly. It makes you sound exactly like nontechnical software project management who don't understand what technical debt is or why man-hour estimation is hard.
Humans, in general, are not good at delayed gratification or long term planning. They don't plan for health care expenses or save enough for retirement. As a result, your employees will for the most part, happily defer those costs which means those costs don't go into the calculus for how much your employees need to get paid to do the work you need of them.
Thank you for the reference, but we here at The Split Banana believe EVERYONE can enjoy a delicious Ice Cream penis. Not just the gay community.
> I'm suggesting writing a considered article that discusses the issue clearly, and then submitting that link.

I might try this, although it seems sort of a waste when I could just make a text post on HN like I did. I am not in the "personal branding" business or the "self promotion" business like many bloggers. In my opinion, a simple post ought to suffice and I should not have to flee to another platform simply to express an idea/question that can have comments below.

I could of course have offered some of my own analysis, but the very simple question I ask in the post is whether the topic should be discussed (at all) on HN.

While I share your lament about the quality of much political discussion, I think the root of the problem is that people feel that their political beliefs are something they are simply entitled to and that they should not have to defend or question, as if they were religious beliefs and anyone who disagreed was doing the equivalent of calling them a heathen. Suppressing political speech as being (before the fact) impolite reinforces this idea.

So I think that by asking the question of whether HN should care about press freedom we are really addressing a much bigger question, which is whether the "News" RFS and the "Improving Democracy" RFS are actually important: (https://www.ycombinator.com/rfs/), and if they are, why they are important?

Would it insult anyone's sacred political religion to have this discussion? Why is YC joining the ranks of speech suppressors who consider talk about certain subjects profoundly offensive and dangerous? Does the story I censored need to be censored from YC readers? Do hopeful YC applicants need to worry about the possible consequences of posting a respectful and reasonable comment about the article?

Ironically, this conversation we are having is likely to be classified by HN mods as a flame war :)
Exactly. That's what people fail to understand about the car market. It is easy to create expensive cars for high income people once you have a few good ideas and capital. Now, going from there to create a mass produced, high quality car, this is the very difficult part that only a few companies were able to accomplish. It is possible that Tesla can get there, but most people just don't understand how difficult that is.
Amiga 1000 Phoenix Motherboard Replacement Project
I think the long term answer here is legislature that forces companies to license things for the same rate to anyone and that rate must be publicly published.
Good point and agreed. This will cost them, and clearly was a mistake.
Thanks for the clarification!

I think I have a joke.

If "å" means "a river, a creek, a big stream" (https://en.wiktionary.org/wiki/%C3%A5#Noun_4 ) and "ö" means "island" (https://en.wiktionary.org/wiki/%C3%B6#Noun ) then "Från Å Till Ö" might be a story about someone who paddles a canoe down a river to camp on one of the river islands.

Or rather, only the last 3/29ths of the story.
Same reason you now have 200+ Linux distributions: people have opinions and disagreements plus free software means everybody can fork a project and do their own thing.

Meanwhile, Windows is still king of the desktop and Android is king of mobile for years to come.
That's why I'm so baffled that quality is used as the excuse for ripping off developers and further closing off their ecosystem.
I do also wonder if some speculative prediction / branching stuff can be controlled through undocumented CPU instructions: https://www.youtube.com/watch?v=KrksBdWcZgQ
Just curious--why is HN run on only a single core?
In which case, where is the harm?

"Children have the rights to:

- Protection (e.g., from abuse, exploitation and harmful substances)
- Provision (e.g., for education, health care and an adequate standard of living)
- Participation (e.g., listening to children’s views and respecting their evolving capacities)
- Specific protections and provisions for vulnerable populations such as Aboriginal children and children with disabilities"
SIMPLE EVERYDAY MAKEUP ROUTINE – My Go to Look
So what exactly are they going to do about spectre? Seems pretty unstoppable from what I can see.

Can they disable speculative exec completely for sensitive boxes or is this too baked in?
> They might have told themselfes they didn't know better - you know, afterwards - but you can't remove 6 million people out of a country of maybe 60 million and no one notices shit.

Removal from the general population was an overt policy (and overtly not all that different than what the Western allies did with suspect populations identified by ethnicity.) The actual conditions to which Jews and others were removed, even prior to the implementation of extermination, was not overt.

No one was trying to conceal the removal of disfavored segments from the general population.
> Is it possible to make a simple experience from the OpenPGP spec, one that would be accessible to the majority of non-technical users, and could be seamlessly integrated into common communications workflows? I don't know, though I would suspect it's not.

I suspect it would. Certainly it's not a possibility we should write off when no-one's seriously tried.
What I gathered from this conversation was to bet on the longer term success of tesla but leave their first few generation mass-produced models to the die hard fans
Impact question on AWS:

From https://aws.amazon.com/de/security/security-bulletins/AWS-20...:

"While the updates AWS performs protect underlying infrastructure, in order to be fully protected against these issues, customers must also patch their instance operating systems."

Prior to this quote, Amazon said that virtually all of the underlying instances have been patched.

What's the risk between now and when all of my EC2 instances are restarted with updated AMIs? Is it the 'full' risk, or is the attack less feasible, given the patched underlying OS'. Thanks.
Iranians Crowdsourcing ID of Protestors to Arrest and Torture
Does it perform fast?
I wasn't planning on wearing a costume until your comment but I dig it!

In all seriousness, if I ever get to this goal, I will follow up with you.
I googled this and can't find references? Can you explain what this means?
I don't think this is a dupe. This notice of reboots is not publicized at all in the other post.
So, Intel prefetches restricted data on a request by an unprivileged user, "conceals" the unauthorized but nevertheless prefetched data by nulling it out, but the unprivileged user can infer sensitive information about what's "behind the curtain" by timing the proceeding instructions?
They have well over $3B cash on hand and no problems with the bond/credit markets.

Do you think they'll still be burning all this capital to build the 5k/wk ramp up a year from now?
From the Spectre paper:

> We have also verified the attack’s applicability to AMD Ryzen CPUs.
> Not to mention most work for a hospital and therefore have a fixed salary.

Unless you have knowledge to the contrary, I'd dispute this. Most physicians, and specialists in hospitals in at least the Pacific North West are NOT hospital employees.

This is how you can get into ridiculous situations where your hospital is "in network", but your provider is not (because of course, you get a choice on the physician you are assigned at a hospital, especially in ED...).
How would that work? unpatched VM can escape the patched Hypervisor? Is that possible? What would be point of patching hypervisor if guest can trivially escape?
It's counter intuitive at first, but the key to understand how this works is that while you can use an MMU to assign chunks of physical memory to a process, you can of course also just use the MMU to assign the memory mapped IO registers of say a PCI express peripheral to a process.

That is in a nutshell what a "userland driver" is. It's not too far removed from poking the parallel port at 0x378 on your DOS computer :)
You need to buy Apple hardware to develop for iOS, is that not a barrier enough?
Too many options, honestly. I'd love to see a widely agreed "basic profile" for GPG, so that everyone writing tutorials etc. would be suggesting the same thing.
For me it's the concerts listing, which shows you when an artist is in town and how to buy tickets.
I reaaalllyy like this theme! As others have said, it would be great to have it in the UserStyles library.
Speculative execution as a concept should not be flawed. My take is that the results of illegal speculation should never be leaked in a visable way.
"Meltdown" is an Intel bug.

"Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code.

Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.
> Your value is what you earn for your company.

Your value is what your company is able to extract from your labor. Doing the exact same stuff for multiple companies would give different levels of "value" to the same person. The further you are away from sales or high-level executive decision making, the harder it is to demonstrate clear value to people who make 'value' decisions.
For variant 1, a kernel JIT is definitely helpful, which is why the Project Zero PoC used it, but it's not required.

For variant 2, Project Zero used the eBPF interpreter as a gadget, a fake branch destination, without having to actually create an eBPF program or use the normal userland-facing eBPF APIs at all. And they only chose it as the least "annoying" option (see quote below).

edit: I'm not sure how ASID support would mitigate either of those variants, though there may be something I'm not thinking of. (It would help with variant 3, but that's the variant AMD wasn't vulnerable to in the first place.)

quote:

> At this point, it would normally be necessary to locate gadgets in the host kernel code that can be used to actually leak data by reading from an attacker-controlled location, shifting and masking the result appropriately and then using the result of that as offset to an attacker-controlled address for a load. But piecing gadgets together and figuring out which ones work in a speculation context seems annoying. So instead, we decided to use the eBPF interpreter, which is built into the host kernel - while there is no legitimate way to invoke it from inside a VM, the presence of the code in the host kernel's text section is sufficient to make it usable for the attack, just like with ordinary ROP gadgets.
Not really, they are mentioned in the article. What is fascinating is the number of discoveries by the Google team. The Wikipedia page has a summary of the prominent ones: https://en.wikipedia.org/wiki/Project_Zero_(Google) these are not bugs in obscure pieces of software but on major services and operating systems.
I guess I'm just wondering what fraction of investors decision to hold TSLA is "We never believed Musk's deadline to begin with" and what fraction is "It's only a 6 month delay, so not a big deal"
Trump dissolves voter fraud commission
It takes the grumps out of HN and replaces them with cuties!

https://i.imgur.com/GNpBKlj.png
Linkkle – Social Media Tool
It's not illegal if it's information that isn't libelous, because revealing true illegal conduct and taking legal action to stop it is considered desirable, and regulation that discourages that by removing a strong incentive is considered actively harmful.

If the information is libelous, well, then it is illegal.
About curiosity, and finding new things to explore.
I do not know golang-services. But in the end, somewhere is the code written and it must be shipped, started, maintained and so on. Someone must also write the drivers for used technologies and must bring them into the golang world.

For us as a little company without access to many developers with affordable pay expectations, it is a big relieve, that a lot of specialist knowledge is bundled together in spring. Such as how to do central configuration, logging, monitoring, failover, loadbalancing, streaming, backpressure support, db connection pooling, message queuing, and so on. And you need special knowledge only when something fails. And when it fails, you can assume, its done the same on each service. It helps a lot. You have then a wider pool of people you can ask to help you to do the actual business coding work.

It reminds me a little on how maven defaults said: code belongs into src/main/java and test below src/test/java and then have a little pom.xml,that describes your project. It has brought sooo much relieve to get rid of so many flavors, how people have structured the code. Not to forget the style of make scripts. You can now open many projects in any IDE without any hassle, you do not have to search forever, where the starting point is and so on. I always forget that. Less work for my little brain, when navigating between projects.

So, even with the dependency hell (i totally agree), i am ok with it, as i seem to forget, what i dont have to do on each individual service anymods. And i have access to a rich ecosystem, that is maintained and supported and people react on issues.
Les 14 meilleurs conseils pour appréhender un divorce
Why is it bad? Customers are buying 30% more CPU ;)
Hopefully they add an option to enable it for specific sites. I think mining scripts are a great way to monetize online content. I'd much rather give away some compute time than watch ads (which I'm just going to block anyways).
So have they been lying to investors?
If I remember correctly, this bug only comes under AWS’ responsibility when people are using paravirtualized instances. HVM instance’s don’t have a Linux kernel below your OS, so they don’t need underlying work, they just need OS patching.
Not sure how water is set up, but I think municipalities should own the network infrastructure and rent/lease it out to private companies.

This keeps the city from having to run a business, instead they just maintain the infrastructure (like pipes/roads) and let the private companies duke it out themselves.

This is always how I had it in my head, but apparently there's a name for it (Open access network): https://en.wikipedia.org/wiki/Open-access_network
RMS remains a rambling nutjob and none of this is really applicable to the issue at hand.
I guess this too is a meme?

From each according to his ability, to each according to his need.
It's harder in your case, so it will take more time. 2 to 3 years maybe.

To find out where to start, ask yourself where your children are more likely to get caught alone and reported to CPS.

It will also require you go to clubs (sport club, book club), events (garage sell, protests, etc) or even to put them in motion.

Eventually, some thing that works very well is talking to people waiting with you. In queues, waiting rooms, at traffic lights or even traffic jams. It's awkward/annoying as hell when you do it wrong, but after a big of practice it's really a great source of networking.
Important note about the security flaw impacting ARM and Intel hardware
Independent discovery don't happen overnight. Intel must have been aware of these vulnerabilities for some time.

edit: I'm sure everyone involved acted responsibly. I'm just curious as how far apart these independent discoveries were made.

The bug has been around forever, but it must have been discovered relatively recently since it's not fixed in hardware yet.

I've always been baffled by the concept of simultaneous discovery.
> which falls under the second part of the law you describe

To be hit with Volksverhetzung you need to meet all three criteria. If you have musicians that do, they better not play a gig in germany or they might stay here for a while longer. When not talking about Nazism (they have proven 3, so the bar is a little lower) to hit (3) you need to build some movement. Maybe found a local KKK? Generally there needs to be a bit more than just talk.

> Also, do germans find american thugs in low regard? One can argue they can be just as dangerous.

The average german propably doesn't care much about them. Some teenagers propably liked their idealized lifestyle. But they've propably grown out of that by now. I don't know what modern day teenagers like anymore =)

We don't really have gangs and they are propably seen more as a social problem than one for law enforcement. A symptom of the huge inequality / divide in american society.
> there is a 'noise' threshold below which a probabilistic benefit will have no effect. [I]t simply will not have an effect no matter how many millions of generations go by

We've arrived at a circle in this thread, considering the eyebrow example was initially offered to show how even small advantages will, over time, make some phenotype (and genotype) dominant.

This is also mathematically true: given a coin with only the most minimal bias, cumulative results of coin tosses will eventually drift far away from 50%/50%.

Concerning your empirical observation regarding the evolutionary usefulness of eyebrows: How many people have you seen being clearly impacted (in regards to their offspring) by missing toes, being born with only one kidney, having ears shaped sub-optimally for capturing sound etc...?

Because extremely little regarding your body is left to chance. Unless you're one of less than a hundred with a given feature, be assured that it's a variation that, for a significant number of prior generations, has proven to be useful.
GM isn't a representative example of the car industry. They'd been getting their asses kicked in the car industry for decades before Tesla came along.

Toyota is another question entirely.
We know that the scariest attack "meltdown", cannot be reproduced on AMD or ARM chips at all[1]. The second attack "Spectre" is also greatly mitigated due the neural network predicting pathways for the application. Thus it's unlikely/less-likely that you'll be able to access other locations in memory[2]. However, it's definitely possible.

[1] https://meltdownattack.com/meltdown.pdf

[2] https://spectreattack.com/spectre.pdf
In case the comment below is unclear-because you make sure everything you say is TRUE
Hoodies have become as much a standard of conformity as suits. You're just conforming to an unspoken requirement to appear sufficiently non-conformist.

Show up in such an environment wearing a suit and see how much your self-expression is valued.
The CopperheadOS post was 5 days ago and was in the top 10 for the majority of the day. Which also had the original title of being a Google-less Hardened version of Android.
You need to patch your VM to prevent your own processes exploiting the bug. The hyper visor patch is to protect you from the other VMs on the box.
The OS patch stops you reading kernel space from user space trivially (ie. without eBPF in the Project Zero example). You can still cause leakage from the same context, for example, the V8 JIT can read all of the processes memory, without site isolation that can include data on other web pages, passwords, cookies, etc.
I think this means we should consider all browser processes to be completely insecure, until mitigations are applied (e.g. Chrome's Site Isolation: https://www.chromium.org/Home/chromium-security/ssca).

Looks like any session token/state could be exfiltrated from your Gmail tab to a malicious JS app running in-process, for example.

Am I overreacting here?
I applied for this 12/9 via the online form but have not heard back or received any response via email. Do you know whom I could contact to follow up regarding this opportunity?

[edit] Thank you to the OP for the quick follow up!
No, I actually meant multiplicative. I was worried that the worst case is 30% syscall overhead on virtualization host multiplied by 30% syscall overhead on virtualization guest.

Still, even if this mitigation is only enabled on Xen host and not on the guest, can this attack be then used inside the guest's userspace to read memory of the guest's kernel, as opposed to reading memory of the host's kernel?
...and for those of us who leave JS off by default except for a few very trusted sites, the bar for turning on JS on a site that asks to just went up a lot higher.
Given that Google has been experimenting with POWER, does anyone know if POWER is affected too?
Apologies, there was an outage. It's back now. Not mobile-optimized, though
I thought the presence of a branch in the logo was clever.
Turns out "maybe" is "not" - if you put the faulting read at a mispredicted branch target, you don't take the fault.
Sorry but what does building five rockets in a quarter have to do with any of this? ("Elon Musk" is not a valid answer.) The auto factory mentioned in the article is set up do to 400,000 cars a year. They are completely different problems. If you've never seen it in person before, the level of automation required to mass produce automobiles is really something. Have a look at the two factory floors. There are nothing alike:

http://www.spacex.com/news/2013/09/24/production-spacex
http://www.popularmechanics.com/cars/hybrid-electric/g877/ta...
> so I didn't know this, but got curious about how many known prime there are

This isn't the exact question you're asking, but we actually know the distribution of prime numbers, which allows us to calculate the (approximate) number of primes that are less than or equal to an arbitrary value.

Since the largest prime discovered is 2^(277,232,917-1), that means that the number of primes less than or equal to that number is approximately equal to 2^(277,232,917-1)/ln(2^(277,232,917-1)).

That's approximately equal to:

2^(277,232,917-1)/ln(2^(277,232,917)), which is in turn equal to 2^(277,232,917-1)/(277,232,917 * ln(2)).

That's a number that's too big to plug into your standard everyday calculator, but that tells you the number of primes you could "discover" and still not break the (new) record.