skysight-inc/HackerNews huggingface dataset:
VMware distributes a driver[1] one can install to patch the microcode on Windows at runtime. If these updates need to be recognized before OS boot, this may not mitigate the dangers. But in my test lab, HWiNFO64 shows the current microcode version.

The Intel[2] and AMD[3] microcode can be downloaded but I can't vouch for how many Meltdown/Spectre mitigations these versions contain. The Intel one is dated 2017-11-17.

[1] https://labs.vmware.com/flings/vmware-cpu-microcode-update-d...

[2] https://downloadcenter.intel.com/download/27337/Linux-Proces...

[3] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...
Ha, thanks for speaking plainly. It's so refreshing.

Sometimes a fuckbomb is the best way. Rarely and tastefully, but still.
I haven't used the ! history for many years. It's simply easier and faster to use command line editing.

! was useful before command line editing; but not much since.
even if they would be problems in germany because of the name.
npm isn't the root of the problem, it's just a particularly popular example of it. Sort of like how Intel isn't really the root of that other problem, just the implementer of speculative execution with the biggest market share.
I was about to give him the same answer but you beat me to it. It’s not jus throwing stuff in a field in PG. You can weight multiple bits of data. You can even define multiple different search vectors in separate columns if you want to use different search styles in different situations.
How to Curb Silicon Valley Power–Even with Weak Antitrust Laws
It is mentioned in passing.
VMware CPU Microcode Update Driver (for Windows)
It looks like the trend is following the 50th percentile prediction that xkcd gave a few years ago.

https://xkcd.com/893/
It's often impractical to audit the source code for all your 3rd party dependencies even if they are open source. When was the last time you or anyone you know reviewed every line of your web framework or DI framework? How about the dependencies of your dependencies? Many organizations don't even review all the code their developers write internally. Does your organization code review 100% of releases? Since inception? Like it or not, we're all placing a lot of trust in our dependencies.
You are right, thanks for the bug report.
Dude I don’t doubt they care about this issue. My point is I’m not gonna read 168(!) pages of posts about it. Post a single article summarizing the issue or something.
That would be a solution, however flicker-free dimming for LEDs is not difficult. Linear regulator chips are cheap, but inefficient. Switch-mode power supplies cost a little more. Both are mature technologies any electrical engineer should be familiar with.
This is a key detail that gets glossed over too much for my liking.

No OS or Firmware update will fully fix Spectre.

All applications that interpret untrusted code (such as Web browsers) also have to be patched.

https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd653...
According to the Internet - it has a type3/2x type2 pcmcia in addition to parallel and serial port?

Maybe something like:
https://www.amazon.com/PCMCIA-Compact-Flash-Type-Adapter/dp/...
could work?

As far as I can figure out, it should be possible to copy files directly over a serial cable (to/from COM1 on dos, /dev/ttyS0 on Linux).

But for sanity, being able to fix a non-booting disk is recommended, so I'd probably try with a second-hand pcmcia hd, usb adapter or something like the above.

I also learned Ms dos comes with INTERLNK.EXE and INTERSVR.EXE - but I wasn't able to figure out if there's a sane way to talk to that from Linux.

http://www.pcxt-micro.com/dos-interlink.html
It is high time for an OLED dispay on the MacBook Pro. And not just on that horrible touchbar gimmick.
The 2008 MBP did use PWM backlighting. PWM is slightly more efficient than a constant current regulator and gives a more consistent backlight color temperature. IIRC Apple have stuck with PWM backlighting for these reasons, but have moved to an extremely high frequency (~120kHz) which should be imperceptible even to the most sensitive users. Many other top-tier laptop manufacturers also use PWM backlighting, but with a switching frequency of around 1kHz.
For folks on Windows looking for Meltdown/Spectre protection but whose motherboard manufacturers are no longer pushing updates, this appears to be an option. I posted this in the other thread[1] but thought it warranted some more exposure.

Here are links to the latest microcodes I could find for Intel[2] and AMD[3]. As additional fixes come out, it is trivial to copy the updated microcode file over and reboot.

[1] https://news.ycombinator.com/item?id=16085672

[2] https://downloadcenter.intel.com/download/27337/Linux-Proces...

[3] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...

YMMV, no warranty express or implied, etc.
We do this with all of our PHP dependencies at work, they get committed into the project. The upside is that the deployment process is simpler, the server doesn't have to fetch all the libraries you depend on within each deploy and it mitigates all of the risk of left-pad style bullshit.
Not what you're looking for, but it's worth knowing that since iOS 11, there is a panic sequence that disables TouchID at least. This applicable in non-border LE interactions where a citizen can be compelled to touch the device, but not to give up their passcode (IANAL, this might be out of date, as precedents change).

https://www.macrumors.com/how-to/emergency-sos-iphone-ios-11...
Thanks for your feedback. The django logo is an svg and i tested only on a HD monitor and i like it. Maybe in a bigger screen it's too big but I haven't worked a lot on the design of my blog. I hope you enjoyed the content more than the logo. ;-)
Here's a summary from a vendor trying to compensate for the issue in software: https://iristech.co/pwm-flicker/
Linus Torvalds Is Not Happy About Intel's Meltdown and Spectre Mess
Hey, I wrote that article :) - yes it was pure coincidence, I just decided with all the security stuff going on this week (Spectre/Meltdown, I hadn't heard about the npm stuff) I'd write and article about it.
The status page at https://status.npmjs.org/incidents/41zfb8qpvrdj says that "We apologize for the temporary unavailability of some packages.".

If this was only a matter of missing packages, this would "only" be a matter of breaking builds.

But it looks like third parties were able to take over the missing packages, see https://github.com/npm/registry/issues/256 - which is a HUGE deal, considering "npm install" blindly executes the scripts in a package's preinstall property (as well as the packaged module itself possibly containing arbitrary backdoors)
Given we have things like Twitter it would matter a lot. I also vividly texting with friends and family on different continents during the last world cup's Germany-Brazil game. A friend actually did have a slight delay and he received my text saying that it's 5-0 before he saw the goal. That was without intentional delay and already was a spoiler although it didn't matter much on that case.
Bash is a special case where there exists a similar tool which is standardized in POSIX, and for most cases where sh is insufficient bash is probably insufficient too. Therefore POSIX sh is almost always the better choice.
The "can you tile the plane aperiodically" that started the investigation into these tile sets, the disproof was that proving it was equivalent to solving the halting problem... and thus the tile set is equivalent to a Turing machine.

I keep wondering if https://grahamshawcross.com/2012/10/12/wang-tiles-and-turing... is practical as a bathroom wall.
The Tron score did a wonderful job blending early synth sounds with an orchestral backdrop.

It also has a odd and memorable theme that moves around using augmented triads yet isn't octatonic nor based on a whole-tone scale.

There's also a nice moment at the beginning of the credits-- where the theme previously wandered through harmonies quite rapidly, here it gets anchored to a single key with a fairly lush orchestral accompaniment. Then that leads in to a massive pipe organ solo doing the chromatic version of the theme for a final time, then to more fitting electro-orchestral credits music that cycles chromatically through augmented triads. (I think there's a reference to this music in the NES metroid game somewhere, I think it's Ridley's lair)

Anyhow-- the strange orchestral changes and lyrical melodies are the kind of thing that make you stick around for the credits. It's all very simple in a way, but extremely effective, too.

Contrasting that-- I almost laughed in the new Star Wars movie when at the climax the brass just loudly ascends up root position minor triad. It's like being served a steak with a side of a stick of butter.

Edit: I guess I should have written "spoiler" about the loud arpeggiation of a minor triad in the Star Wars movie.
A lot of cheap mains-powered LEDs aren't using PWM, but running on mains power directly.

You can test whether this is the case using a smartphone camera and an app with manual shutter speed control. If you see scanlines just above and below, but not at 1/50s, your light source is flickering at 50 Hz, which is the AC frequency of UK mains power.
We don’t need more credit. We need credit to be more
What happened when I taught Harvard undergrads about inequality and poverty
I’ve said many times this is the best way to deal with the large monopolistic companies - group up.
"I ran the numbers through the Census data. The lowest median household income of all the cities represented by my students was $120,000 per year. The poverty rate in the city with the lowest rate in our class was 0%. Nobody in that student’s hometown lived in poverty."
This article describes exactly why the NS (Dutch Railways) provide a cheap card (which is even on sale like half the year) allowing one to get 40% off the fare provided they travel during off hours. The off hours are: mo - fr between 9 AM and 4 PM & from 6.30 PM till 6.30 AM, weekends, and holidays. If you check in, it counts from that time (even if you swap trains or travel for 3 hrs straight into peak hours).

There's a few more versions of the card which are essentially trying to achieve the same, just assume you travel in higher volume. For example, there's a more expensive version of the card which makes travel completely free in the weekends.

Thing is, people who work get the travel costs reimbursed from their employer so they generally don't care. Its up to the employer to adapt. And given you can game the logging in time I am not sure how effective it is to decrease congestion/pressure.

I've also noticed the effect on my partner's job. She works 4 days a week, and wants one day off. Well, the most popular days to take off are Wednesday (because it is in the middle of the week) and Friday. Same with taking days off. Some days and dates are popular, for social reasons. Someone who is antisocial won't have much understanding for that, just like you put.

The power system is another example. At times, the German electricity grid is operating on a surplus!

Yet another example is getting paid 150% of 200% during holidays such as Christmas (which is how it works in horeca).

Fascinating discussion, but just being against social behaviour won't change these situations. There needs to be incentive. Being antisocial or being OK with that with the benefit of receiving a discount seems like a great way to achieve this in situations where it makes sense. Does anyone know examples where it'd make sense, but where it isn't currently applied? Or where it has been tried locally, but isn't implemented world-wide? If you take the toilet flush example: we're not paying for toilet usage in our households (right..?) but we are paying for water. If the price of water would be dynamic based on current demand, and the current demand is transparent, that could decrease demand during peak times just like the other examples do. At the very least, those who cause the congestion pay for it, and pay for the extra costs attached to the peak's effect. On a side note, the thought of highly fluctuating water prices sends shills down my spine.
> tldr: genetic analysis shows that parrots and falcons are closely related.

Falcons are more closely related to parrots than they are to hawks and eagles. That's more interesting that "bird related to other bird".
An older PoC that someone did in Go very similar to how this project fires up an already-installed browser: https://github.com/utamaro/neje-ui
Maybe someone who knows more about AMOLED panels can comment about the role of PWM? It seems to be something other than brightness control, the article at [1] says:

At any level of brightness, modulation with a frequency of approximately 60 or 240 Hz is present ... It can be seen that the amplitude of the modulation is not very large at the maximum and near to it brightness, as a result there is no visible flicker. However, with a strong decrease in brightness, modulation appears with a large relative amplitude, its presence can already be seen in the test for the presence of a stroboscopic effect or simply with rapid eye movement. Depending on the individual sensitivity, such flicker can cause increased fatigue."

[1] https://translate.google.com/translate?act=url&depth=2&hl=en...
Wouldn't you need to install those packages as root for the code to have privileges to take advantage of that exploit?
Yes, I used pelican with Flex theme for my blog.
http://www.paulox.net/about/#blog

The Flex theme is not so old, but can be better, but I'm going to update it based on many report I received here.

BTW pelican site is quite fast
https://developers.google.com/speed/pagespeed/insights/?url=...
Golang sucks
And this is why you vender your dependencies. Nothing in production should ever require any external service to build and run.

You should also not be cowboy updating things just because there is an update.
> A lot of cheap mains-powered LEDs aren't using PWM, but running on mains power directly.

Yes, I just added information about that to my comment, sorry for the race condition.
I think one of the potential advantages is energy consumption of this compared to running deep learning on a conventional CPU/GPU would be dramatically less.

If the memristor chips could be mass-produced, this could lead to things like basic voice commands and face/image recognition being added very cheaply and being added to cheap embedded/IoT stuff (for better or worse).
OLED has horrible burn in. For phones they’re doing incredible mitigations but the fact is that the screen isn’t on with static elements for 8hours+ solid each day.
Thanks for the report. I've never tested on a iPad.
Like nazi? Give me a break.
For me, the biggest gotcha in bash is whether or not a sub-process/shell will be invoked, which can affect things like mutable variables and the number of open file handles. For example:

COUNT=0
someCommand | while read -r LINE
do
COUNT=$(( COUNT + 1 ))
done
echo "$COUNT"

This will always print `0`, since the `COUNT=` line will be run in a sub-process due to the pipe, and hence it can't mutate the outer-process's `COUNT` variable. The following will count as expected, since the `<()` causes `someCommand` to run in a sub-process instead:

COUNT=0
while read -r LINE
do
COUNT=$(( COUNT + 1 ))
done < <(someCommand)
echo "$COUNT"

Another issue I ran into is `$()` exit codes being ignored when spliced into strings. For example, if `someCommand` errors-out then so will this:

set -e
FOO=$(someCommand)
BAR="pre $FOO post"

Yet this will fail silently:

set -e
BAR="pre $(someCommand) post"
Isaac is subhuman filth.
20 Year Archive on Google Groups (2001)
Thanks for the report. I'm thinking to change font.
Thanks for the report.
Could this be a difference in the dimmer. I’m in the US (120V vs 240V) and I had research carefully what dimmers were compatible with the dimmable LEDs in our flat. Sometimes the dimmer would hum, the LEDs would squeal, or they would go from 0 to 100% with 20% dimming.

Most LEDs are made in China and I doubt the Swiss are getting a specially manufactured ones. But old, incompatible dimmers are definitely a thing.
It's not in the definition, it's in the distribution curve that is implied. Good = better than average = rarer than the average.
I had very limited contact with CPAN some years ago but I imagine it was slightly more sane in terms of granularity of dependencies.

Whereas a lot of npm modules are relatively small - some tiny - and have their own dependencies. So a simple "npm install blah" command can result in dozens of packages being installed. Dealing with that manually would, in fairness, be a giant chore.

Now of course there's a discussion to be had about whether thousands of weeny little modules is a good idea or not but, to be honest, that's a religious debate I'd rather steer clear of.
I just don't understand how this can happen. In Maven Central for example (Java) if you publish a package it is immutable and stays there until nuclear fire immolates the Earth.
> Then, I do the somewhat tedious work of translating between elements' bounding rectangles and positions into this space.

Having done something similar, it can be quite frustrating. Add in high DPI devices (window.devicePixelRatio > 1) and it gets even more complicated. All in all it would be nice if there were standard methods for doing the translations
I'm not the poster you're replying to, but I think I understand it.

npm is not just their package management tool... the way most people use it, it depends on someone else's package registry/repository to deploy to your own servers.

And github is someone else's source code management tool/server.

As a matter of policy, if I can't have something on my own server (or one my org controls) I don't get to rely on it to deploy/run my application.

So I think I get the parent's comment... it's a really foreign situation, to me, to depend on the availability of stuff like this on servers I (or my org) don't control in order to deploy my application.

I'm sure the people who depend on these things look at me and say "Wait. You have to set up your own package repository and source control before you can deploy instead of using all this nice stuff that's available in the cloud? Seriously?"
Good luck explaining this

https://news.ycombinator.com/item?id=16087079

in the face of this

https://news.ycombinator.com/item?id=14905870

Literally nothing was done for 158 days. You yourself asked:

https://github.com/node-forward/discussions/issues/29#issuec...

"How would package signing prevent people from requesting the wrong package? The malware author could also sign their package."

And here is a perfect example. Someone replaced a legit package with a malicious one. Had the original author signed the package, then then NPM users could have defended against the new malicious author, because the new author's signing key would not be in their truststore.

Unsigned packages leave NPM package users defenseless. I hope that is crystal clear now.
I can stare at my CCFL ThinkPad all day, but if I stare away from it at around 75-80° (basically not quite 90°, so say around 2PM on a clock) I can see it flickering away. But if I stare straight-on it's fine; it feels completely steady, and certainly more rock-solid than any CRT.

My light emits a (very) tiny amount of light when it's initially turned off. If I stare straight at it I can't see this tiny bit of light at all; I can only see it in my periphery. I suspect my inability to see flickering works by the same mechanism - and I'm very glad for that!

Incidentally, when I was using CRTs I had to have them at 85Hz to hide the flickering as much as possible. 60Hz would drive me nuts - but then again, I used 60Hz for several years while using MS-DOS, so I think 85Hz was just a strong preference.

This may be interesting to some: https://news.ycombinator.com/item?id=15004608#15005811 (the whole thread, along with the highlighted comment)
Yes! Sorry if I didn't mention it :-) thank you!
Would you rather they be low skill developers with a diploma?
I agree (I replied to the other comment in this subthread).
$ bash -ec 'BAR="pre $(someCommand) post"; echo hi'
bash: someCommand: command not found
$

I get the same behavior in bash, zsh, dash, and busybox sh. shbot says the same for bash versions since 1.14, ksh, and even the original bourne shell (modified to use ` instead of $()).
I'll look into distcc next time. Thanks!
PyPI (which is what Pip uses) at the very least does not require authors to sign their packages. I can't say whether it supports signing though.
Weeks! - Thank you, I knewit was slower, but that's such an order of magnitude slower I don't even know how to calculate it :)
Well a lot of processes run as Root anyway. Also if possible i run as few processes as possible
Free Ways to Build Your Credit Score by 100 Points in Less Than 30 Days
Are you sure growkits are illegal? Truffles?

Although nowadays I am rather conservative regarding recreative use of entheogenics Azarius ships their growkits seemingly to entire Europe [1]. Anecdata: it is fairly easy to grow champignons and psilos. The kits I used were complete with straightforward guides.

I wrote "psilos" because there is also A. Muscaria, though it has less severe effects care must be taken when plucking food in the wild (and I am unsure if they'd be an option for your specific use case). There are some great guides out there allowing you to distinct species but as Sean Penn's Into The Wild [2] shows one mistake can be fatal. There's a Dutch community on FB about plucking mushrooms in the wild, but its focusing on its culinary usage. As I said, there's also some guides (in the form of books) available.

BTW, do you know if and why psilocybin works (better) than LSD for your use case?

[1] https://azarius.net/smartshop/magic-mushrooms/grow-kits/ (Disclaimer: I'm not affiliated, used to be a customer back in the '00s)

[2] http://www.imdb.com/title/tt0758758/
Honda also has multiple factories and is using tried and true technology. Tesla on the other hand uses newer parts, technology, and manufacturing techniques.

On the short term sure it's painful. Long term it should give them a huge competitive advantage. So long as they can keep up demand.
Yes. There are basically three steps here...

1. Use social engineering to get your package included as a dependency;

2. Use obfuscation techniques to hide the real intent of the package;

3. Capture data and send it off to a remote server.

First can be pulled off, but really depends on the community / maintainers doing their job right. In case of Django, I imagine that would be pretty hard - while the codebase is giant, by itself it has no other dependencies (except stdlib and pytz). Then 3 could be either much easier or much harder on the backend, depending on how well the box is secured (e.g. outgoing firewall rules).

However the impact could be much more severe, since you're executing code on the server - at the very least you can inject any malicious JS you like, rewrite the CSP headers (if present), just dump the entire DB right away, and a lot of other bad things.

This basic recipe has a chance to work regardless of the target language/package manager. It's all up to your dev process and security regime to catch it.
Whether it's a good idea or not, that's what JS' lack of stdlib produces.
Detailed comparison of CCFL & LED flicker: https://www.infobyte.hr/blog/134/ccfl-vs-led-screen-backligh...

CCFL PWM flicker: https://youtube.com/watch?v=RHlvgo6b_2s

LED PWM flicker: https://youtube.com/watch?v=84OCOX9O3PE
Mark, is that you?

Kidding - but we had exactly the same problem, except with a React app rather than an Angular one just before Christmas.

No joke on with this statement though: every time we have a time-consuming build issue to deal with it comes down to some npm dependency problem. Honestly, if there were a way we could realistically ditch npm (NO! YARN IS NOT ANY BETTER - to preempt that suggestion - it's simply an npm-a-like) I'd happily do so but sadly there isn't.