skysight-inc/HackerNews huggingface dataset:
I feel like a lot of really smart people are really naive about public relations.

PR exists to protect the company from the masses and the lawyers. We in the tech community should not waste time personalizing a response to pr communications. We are not the target market. It is the general public and politicians they are trying to persuade. If they ameliorate them, they win and can move on to the next fight.

They will play word games and fiddle with language. It is not worth responding to PR if you deeply understand the problem. You will only find problematic statements. You will never get satisfaction because satisfying the technical community is a fundamental error for anyone who knows what they are doing in public relations.

There are other venues for us. Patch notes and tech forums are worthy of your time.
Agreed. Whether or not you think grammar matters, bringing it up is destructive to the conversation this is meant to start.
the meme is usually lambos (something like this: https://totallycrypto.com/wp-content/uploads/2017/11/DSC3452...)
Pretty common in our industry to use apostrophes after an acronym to make it plural. An example is VM's and VMS are two different things. When you get lazy and do vm's and vms you can not always be sure, I have even written an email where I stated "we need multiple VMS VM's".
Why we're experimenting with launching products on our own
Love it, an LFENCE on every indirect jump in core 32/64bit entry assembler code, not to mention the cost of the trampoline itself. Linus is right to say that this hack should be reserved for configured as broken CPUs..
I would like to add to your statement that in the criminal justice system, intent plays a big role in determining the punishment for the crime.

Given the public knowledge of police violence in the US, especially in responses to potentially violent situations, the intent of swatter in the US is very different from the intent of a prank-caller elsewhere, and should be seen differently.

To paraphrase, if you approach a gate, and I open it for you with a remote, that act doesn't make me a bad person (living in a gated community, I often do that without thinking).

The same act would be quite different if I knew there's an angry alligator on the loose inside, and I opened the gate to see how fast you'd run from the said alligator (moreso if you didn't even intend to enter).

The problem of the free-roaming alligator is not to be neglected, but it will take time and effort to solve. In the meantime, people who open the gate won't be treated too kindly.

A counterpoint would be that, as sad as the consequences are, at least more people are aware of the gator as a result - and not just the ones who have to live next to it while the landlord keeps doing nothing for decades.
At a decade younger, you're talking a range of 11-19. At the lower end, hopefully not partying much. At 19, probably very similar to the 21 year old crowd.
Also Android
Google project zero blog says: We reported this issue to Intel, AMD and ARM on 2017-06-01
Remembering artist Bill Lishman, the man who flew with Canadian geese
If your child gives her teacher a hug...

If the teacher is a woman, ah shucks how cute.

If the teacher is a man, he's a perv.

No sane male would take a teaching job in today's climate.
The article is a week old, and so predates the public disclosure of the bugs. He knew what was coming.
The really tricky part is identifying how much is due to fundamental dynamics and how much is due to unjust anachronisms. For that, I don't have a good answer.

I believe there is plenty of room for us make improvements, and that we have a responsibility to do so.

You may have missed a change I made to my comment, also. We aren't completely beholden to the Pareto principle. We can work against it to a certain degree, if we choose, which would lessen inequality, with tolerable side effects.
Well he does say patches should written that don't treat all CPUs as crap. AMD had to basically say "Wait a moment! This does not affect our CPUs what are you doing Intel?"
This would be more convincing if the x86 CPU manufacturer he used to work for were still in business.

I mean, I could sit here and criticize how Linus runs his kernel development project and how so much insecure code gets in, and talk about what a "competent" kernel developer would do, but since I don't run an equally successful, more secure kernel, it's just armchair quarterbacking.
> It would definitely show the critics of hiring more women in technology, that it really is about equality.

Given that they haven't done this does that mean that critics of hiring more women in tech are right in their conclusion that it isn't about equality?
Discovering a vulnerability is not creating it. A vulnerability exists even if it was not publicly disclosed. There were probably other people already exploiting it.
This isn't the fix with the 5% quoted performance loss (that one clears all of TLB on every syscall), I don't think this is as costly. But it's certainly not free and it's certainly not clean.

I'm disappointed Intel didn't bother to test the performance impact of this and report it in the patchset. Benchmarks are ordinarily expected with something like this (very hot paths they are changing), and they did have 6 months..
You boot up your own copy of Ubuntu LTS-whatever and read the address of it as root.

KASLR is not enabled everywhere, and where it is, there are other attacks to defeat it, which are mentioned in the paper.
It can be controlled by a boot option in linux.
Looking at the patches Linus is commenting on: as an Asm programmer, this is absolutely horrible --- basically every indirect call (one instruction) turns into a seven-instruction sequence that will, due to preventing speculation, result in massive slowdowns:

https://lkml.org/lkml/2018/1/3/770

Unlike the KPTI patches, which only affect things on each system call, this happens on every indirect call and probably bloats the code considerably too. I can see why Linus is not happy.

Edit: To give a bit more background, predicting indirect calls and speculating into them is absolutely critical to getting good performance from OOP-ish code which tends to use them a lot (virtual functions in C++, function pointers in C). The Linux kernel is (thankfully?) not very OOP-ish, but it does rely on indirect calls (function pointers) extensively.
They've been doing a huge amount of infill in Northern California, replacing whole facilities with brand-new complexes in existing core patient areas. (One example is their Santa Clara facility, which replaced a predecessor less than a mile away with one maybe 5 times its size.)

It must be an insane amount of capital expenditure.
I would rather know up front numbers to filter out the obvious ones that are not competitive even though practically all say they are.
In Pursuit of Liquid Gold
As far as I understand, one of the two attacks does affect AMD, and it's hard to solve as it relies on normal branch prediction.
You arrange things so that the speculated execution loads from an address you provide (this is the target address you want to read), then uses the result of that load to calculate the address of another load (this one, into a location that aliases in the cache with an address you can load directly yourself).

You can then use cache timing to see which address was read in the second load, which means you can see part of the value that was read in the first load. Rinse, repeat.

The variants mostly amount to differences in how you arrange the first part (speculated execution loading from an address you get to provide).
Ask HN: How to commit?
I've got a bit of a fear of commitment when it comes to moving forward with a new startup idea.

I've tried a couple of startups over the past several years, one consumer and one a b2b SaaS company. The first one had no clear business model and was more of a side project to learn to code. I hoped to turn it into a startup but in hindsight it really never had a chance. The second had a clear business model but didn't target a specific niche and ultimately had no differentiators or compelling value proposition.

I'm at a point where I don't know what to do next. Nothing jumps out at me as a clear problem that needs solving, or a "scratch your own itch" type situation. My entire motivation to learn to code was to start a startup, and I can't figure out what to do next.

Where do I go from here? How do I find an idea and convince myself that it's good enough to move forward with?
Oh certainly, the political implications of digging a tunnel under Los Padres haven't even begun to unfold.

I support the project, but part of me wishes that the money could have gone to massive improvements of Los Angeles, Bay Area, Sac, and smaller cities' transit (with density bonuses, value-capture schemes, etc.). No way that wins a statewide ballot though.

In the end, the Caltrain improvements as part of the project will help a lot, which I think include more double-tracking as well as electrification and grade-separation.
Not this one, which basically penalises every indirect call by preventing them from being speculatively executed.
THIS IS SO GOOD. And readable! But mostly adorable.
Reminds me of a comedy show where they were making colour images in Excel.

https://www.youtube.com/watch?v=UBX2QQHlQ_I
Linus can be a real asshole
> They also indicated their Project Zero team discovered this vulnerability last year (although they weren’t specific with the timing).

Last year was four days ago. Headline is one of those delightful sensationalist opportunities you only get for a few weeks each year.
Why not simply investments that he happens to believe are better values than Intel stock?

Or is he expected to believe that Intel shares are in fact so undervalued that they represent the best investment he could possibly make? Or to voluntarily maintain investments in what he believes is a comparatively suboptimal vehicle merely to "take one for the team"?

In other words, why would one expect, let alone demand, a CEO to make what he believes are poor financial decisions in his personal life?

As for being "invested in the company", once you reach the level of Fortune 50 CEO, the concept is basically nonsense: practically speaking, no matter how poorly you invest or perform, barring criminal prosecution, you'll still end up financially better off than nearly everyone else in the world, including many, if not all, of your peers.
I don't think so, because Google is primarily a tech company not a teaching company.

However I'd be disappointed in Google if they didn't try to even out the gender ratio of the teachers and hire some more males as well. I can understand it would look like hypocrisy to some.
Just looking around, general available figures for public internet (as opposed to tor) suggest that anywhere between 0.1% to 1.0% of users have JS disabled. These numbers have also been consistently going down over time. That's a fairly small number to dictate how a system should be designed.
The ARM white paper goes into detail https://developer.arm.com/-/media/Files/pdf/Cache_Speculatio...
Edit: Sigh... This message is badly written, mainly because I confused your point :-) I'm not quite sure why I was thinking you were arguing that it was not an ISA relationship. In any case, removing my addled brain from the equation is probably useful -- you can probably figure out that there is more than one way to look at this. And while you clearly think that your way is correct, it is useful to view it from other perspectives.

While it is interesting to see your viewpoint, you may also consider that not everybody will see it the same way that you do. For example, why do you suppose that inheritance via composition makes it not an ISA relationship? Is a Swiss Army knife a screwdriver? You may say "no", but others may say "yes" -- it is a screwdriver by way of containing a screwdriver. You can verify this usage of the language simply by listening to sales pitches for the crap they sell on the shopping channel :-) ISA and HASA do not necessarily need to be exclusive properties.

It's easy to get wrapped up in your own definitions of things and to block out how others may view the universe. This is precisely why I originally asked the question. I appreciated the enlightenment. I hope that the above will help you achieve the same.
Well there is spectre, and meltdown. Spectre is much more limited than meltdown. The patch AMD was referring to was for Meltdown.

Spectre at least does not leak ring-0 memory. Sure it means that some application might be able to read/infer memory values of other user-mode process.
>unnecessarily hostile

Not that I disagree with you, but are you familiar with Linus’ other uhhh...critiques?

http://lkml.iu.edu/hypermail/linux/kernel/1510.3/02866.html
Bring on the female superheroes
India caste protest disrupts Mumbai
Great, embargo was in and google went ahead disclosing and saying hear we're here disclosing this (because they've patched)
> Moving from crypto to fiat is also liable to taxation

Trading between cryptoassets as GP suggests he has done already makes them subject to taxation. The fiat step isn’t needed.
How is this a dupe? The linked one talks about technical details of the exploit, this one is mostly about consequences and about the Mitigation status of Google products.
Note that it's not just tabs sharing processes that's an issue: prior to the site isolation work, any iframe in the same page would always be in the same process as the main frame. With site isolation, it's possible to host cross-site [1] iframes in a separate process.

[1] Two pages are considered cross-site if they cannot use document.domain to become same origin. In practice, this means that the effective TLD + 1 component match.
about:config javascript.options.shared_memory in Firefox.
The thing that makes me bearish about Ripple's price is that so little of the currency is in the hands of the public. From what I've read, total amount of XRP is fixed at 100B, but it seems like only about 1.3B units are in actual circulation, with the other 98.7B units held by Ripple Labs, the founders, or institutional partners. ~37B is 'held' by these entities, and another ~60B is locked up in smart contracts to slowly release these remaining funds to these actors at a rate of up to 1B per month.

I find it concerning that so many people are valuing Ripple off the 'market cap' because the 'true' circulating supply is much less than the commonly used figure of 38B. If the 'true' circulating supply is only 1.3B, what will happen when founders and partners start to cash out their ~30x greater stake then currently on market? Can the market absorb 30x more supply?

Does anyone have a good source on what amount of Ripple is held by the 'public'?

Disclaimer: I'm long Bitcoin, and not a Ripple expert. Have been a detractor for several years: don't like the technical design, reliance on network effects, and amount of centralization.
I think you’re misunderstanding. The person you’re replying to wasn’t saying you couldn’t disable JavaScript. They are saying the websites they and many in the industry develop won’t work like that and haven’t since the turn of the century. That’s what they were claiming to be not wrong about, and they aren’t. Turning on NoScript shows the problem but doesn’t solve it.
Researchers Discover Two Major Flaws in the World’s Computers
clflush only makes the attack easier. There are other ways to flush the cache. Besides: code is mutable. You can just make a clflush instruction out of thin air without the loader's involvement.
Clover-$425 mill. to disrupt health insurance-but upset customers,missed numbers
I agree with Linus though. Not that I've ever worked on a big project like the kernel but things like these will take a backburner.

The kernel maintainers don't have a way to bring these things up in Intel's boardroom like Apple can and it is possible that Intel will never produce a proper fix.
I try not to think of the ~30 bitcoins I lost on an old drive several years ago when it was worth only a few cents per coin.
They go into detail in the white paper https://developer.arm.com/-/media/Files/pdf/Cache_Speculatio...

They are adding a new instruction to control speculation...
Worked on a Intel(R) Celeron(R) CPU 847 @ 1.10GHz.

With "gcc (GCC) 7.2.1 20171128", remove the parenthesis from CACHE_HIT_THRESHOLD macro[1] to compile correctly.

[1]: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9...
Using an apostrophe is the technically correct way to pluralize acronyms.
An Update on AMD Processor Security
Crowded streets: Cities face a surge in online deliveries
I missed that, actually. But you are right, it's not just the crucial bits of inline assembly they are patching here, they expect your kernel to be built with their special version of GCC (yet unreleased) that mutilates every single freaking indirect jmp/call into what could cost more than a virtual function call..

We use a new compiler option -mindirect-branch=thunk-extern
I wonder what fraction of data inside a kernel is really ‘private’.

Obviously we want 100% of the data in the kernel not to be writeable, but if only a small amount shouldn’t be accessible at all then maybe the long term solution is to handle that data in a special way. Something that makes using it slower but doesn’t make every other syscall suffer as much as a consequence.

Or maybe the solution is to prioritize moving more and more code into userspace.
I imagine these record-breaking primes are too large to be useful in a hash function though.
In the U.S., the executives and managing administrators of school districts skew heavily male, no matter the skew toward females for teachers and curriculum tracts: http://aasa.org/SchoolAdministratorArticle.aspx?id=14492

Is it the case in Silicon Valley that many of the executives are women?
Among all the software that came out of Microsoft, Excel is one fine software. The other one is Solitaire.
“Meltdown” and “Spectre”: Every modern processor has unfixable security flaws
Don’t like pink or princess stuff for my daughter, but a few minor things slipped through the cracks. Should I get rid of them?
Im actually wondering if Google was using the number of employed female teachers to increase their overall male/female ratio... it seems like a 50/1 ratio has to have an explanation behind rather than pure chance
Comparing a weak country that has been overrun by a much stronger one with economically dominant western countries that have suffered some integration problems is a false equivalence. Germans do not find themselves in the same predicament as Tibetans, by any stretch of the imagination.
After thinking about this I think you may be right. It might be hard (or impossible to do in practice).

> or within the same space as the executing address

That's probably a good place to start from. I'm guessing there still would be issues here with JITed code coming from a untrusted source.
Have you considered https://lobste.rs ?
Is there any information available about whether the Linux KPTI patch mitigates the ability to use eBPF to read kernel memory?

I'm asking because eBPF seems to execute within the kernel, and KPTI seemed to be about unmapping kernel page table when userspace processes execute.

Are there any mitigations to the eBPF attack vector?
My take is that RN is great for demo apps or simple UIs, but I would not choose it for a production app where performance matters (ie. using camera, audio, custom controls, platform-specific SDKs, multi-threading, etc). You're definitely going to do heavy lifting in native code, and a hybrid app quickly becomes a mess. Dealing with multiple environments and super slow build times in Xcode will seriously slow down development cycles.

IMO RN is no exception to the Simple vs Easy trade-off [1] Not to mention using RN gives FB a legal blank check from your company [2]

[1] http://chrisfrost.com/wp-content/uploads/SimpleVsEasy-478x51...

[2] https://medium.com/@raulk/if-youre-a-startup-you-should-not-...
Thanks for the helpful answer. :) Things make much more sense to me now.
Don't bet on it ,Seattle was burning nearly three hundred million per mile of light rail on their last project. Other global cities are probably better but US cities have nearly all demonstrated bad judgement and cost over runs. Politicians love a ribbon cutting.

Outside of NYC rail is not a rousing success and defrayed maintenance costs are in the tens of billions if not a hundred across the country for current installations. Worse many systems short change bus routes in an ill fated effort to boost rail ridership. Sadly they even have throw millions to get people to build along such lines.

with autonomous vehicles not far off, implemented as buses with such tightly controlled routes it would be a far better investment to go that route as a bus route can change with the needs of the population served.

With regards to the number of people on such projects, all the regulations and rules nearly guarantee waste as we have to accommodate every special group and politically connected companies
Another consideration is power usage in data centers. Server power usage is annoyingly complex, and once you get above 70% utilization power usage may go up considerably.
I'm really amazed by the simplicity of the meltdown gadget. After the initial blog post I played with a few variants, but always got the zeroed out register in the speculative branch. I guess what people (including me) were looking for here was some other side channel or instruction that did not have this mitigation in place (e.g. I had hoped a cmpxchg would leak whether the target memory address matches the register to compare with). The shl/retry loop makes a lot of sense if you instead assume that the mitigation was implemented improperly and can race subsequent uops. I really can't imagine why this data ever made it to the bypass network to be available to other uops.
Last update is _today_. It links to a comment on this thread. I think (2016) should be removed.
I can't speak for life in any of their offices, but just a heads up to anyone thinking of applying here:

I interviewed with them, made it several rounds, and then they went radio silent, after giving me the runaround. Given they approached me, this was particularly confusing. They just seemed very disorganized.

This was a few months back, so maybe they've change, but it was a complete waste of time.