skysight-inc/HackerNews huggingface dataset:
Sure. The same quantity of money can be spent more than once.

Say that you're playing Monopoly (with house rules that allow personal debts), and the total supply of cash on the board is $300, divided up evenly among 3 players. Through previous transactions, Alice owes Bob $400, Bob owes Charlie $600, and Charlie owes Alice $200. Total debt on the board is $1200, 4x the supply of total cash.

Now imagine that Charlie pays Alice $100 to cancel half his debt. Alice now has $200 cash, and gives it to Bob to cancel half her debt. Bob now has $300 cash, and gives it to Charlie to cancel half his debt. Total cash on the board is still $300, all in the hands of Charlie, but total debt has been reduced to $600, only 2x the total money supply. (Note also that Charlie now has all the cash on the board and he can pay off his total debt with just 1/3 of his cash, which puts him in a very good negotiating position relative to the other players. This is how deflation - caused here by a decrease in total debt levels - tends to be very bad for debtors.)

Remember that everyone's debt is someone else's asset. If you own T-bills, that means the government owes a debt to you; part of the governments $13T national debt is your savings. If you have money deposited in the bank, then your neighbor's mortgage debt is indirectly your savings (going through the bank's balance sheet first). If you have both rewards points and a credit card balance, the rewards points are a debt from the credit card to you and the balance is a debt from you to the credit card company, and they get netted out when you redeem the points.

Debt really is a measure of two things:

1. The complexity of the financial system, for debts that are netted out between participants.

2. Wealth inequality, for debts that are not.

Both of those are increasing rapidly throughout the global financial system.
I hope I understand your question correctly.
The request asks for something in protected memory and also asks for something based off a portion of the protected memory (like the first byte). The system denies access to the request then puts both results in cache.
The attacker then asks for a byte of memory similar to the second request, which the system tries to get from cache but then goes to memory since it wasn't in cache. The attacker doesn't want that result so cancels the request and asks for another byte similar to the second request. That process repeats until the system says "Hey this byte is in my cache" and gives the result back to the attacker. That let's the attacker know what the first byte of that protected memory was. The attacker then repeats that whole process until they've read the entire protected memory, which is at a rate of 1500/bytes a second.
It never gets the actual protected memory from the cache.
I duno, technically it's the 'arm' executing the instructions

:P yes I stole it from mywittyname
> Ok I think I understand the subtleties of these attacks now. But: can anyone tell me why the accessibility check for protected memory doesn't happen before the cache loads the contents of RAM? If that happened then none of these attacks would be possible.

If that happened, Meltdown wouldn't be possible on the processors on which it is possible.

Those checks in no way mitigate against Spectre. Spectre is both simpler and in many ways more profoundly devastating -- as long as an attacker can influence the statistics that the CPU uses for branch prediction, the very act of trying to "work ahead" in another process can be influenced by the attacker, and will produce some side-effects even if you throw out the result, and those side-effects suffice to infer information about the work you did but threw out.
They have changed the document today (Jan 5th) and removed the confirmation that Meltdown was fixed in 10.12 and 10.11. It was previously thought to be patched but can no longer be considered fixed in those versions of the OS with this change.
And, quality services such as healthcare. Plenty of countryside with no good doctors or hospitals within an hour drive.
Nature paper published January 2018.
https://www.nature.com/articles/nature25152

"Using a new method of measuring krypton and xenon ratios in Antarctic ice core, an estimated temperature rise of just 0.1°C over the last 50 years was determined. This is well below many other estimates of ocean temperature increase. Mean global ocean temperature increased by 2.57 ± 0.24 degrees Celsius over the last glacial transition (20,000 to 10,000 years ago)."
The exploit methods that the researchers uncovered have not been provided to the world at large. You can bet that test kits are in the hands of large companies right now, to aid security patch development. If those test kits, intended for white hat purposes get leaked in any way, for any reason, it's out in the wild. That's not supposed to happen, and there's no way for the layman to know the status of a zero day in the wild, until explicitly reported as discovered.

Any company or project providing a patch, has a way of testing the validity of the patch. Those test kits can be weaponized, but not without a degree of skill. Anyone who tests software knows this.
> how that ever got approved if the security model was clearly leaking

When you consider a theoretical model of the CPU, then it's not leaking - the speculative execution, cache, other parts of the CPU are designed carefully so that no data can "escape" and be read by processes that don't have the permission to do it. Speculated execution can happen, but before any results from that are released, the permissions are checked, and if they fail, the results are discarded.

What people did not consider is the timing attacks that do leak information. It's only "clear" to us now after the attack has been demonstrated, even if it has been present in CPU design for the last 20 years.

There are probably many more of these side channel data extraction paths possible. For example, in the recent years attacks on cryptographic algorithms have looked at similar timing measurements, and in some cases power consumption measurements.
Does anyone expect bug revelations after this to be less worse, or is there still a chance there could be vulnerabilities that are worse than these?
It's shrunk a lot relative to the US peak [1]. Relative to other western powers it's still in a league of its own [2]. I think your comment is more indicative of a political agenda than mine.

And for the record, if the United States as a society decides that gun ownership is important enough to let the mass shootings continue that's OK with me. What bugs me more is the perennial argument that gun control wouldn't solve anything or that it's impossible for the US to address its gun violence problem even if it wanted to.

[1] https://en.wikipedia.org/wiki/Gun_violence_in_the_United_Sta...

[2] https://www.nytimes.com/2016/06/14/upshot/compare-these-gun-...
It is certainly possible that the memory the exploit is trying to read might be changing under its nose. An actual implementation of the exploit would need to account for that.
I had read somewhere that AMD PSP does not have Internet access.
Strang's Linear Algebra: http://math.mit.edu/~gs/linearalgebra/

Concise, clear, thorough. Strang is a great author.
Having said that caste discrimination is a problem in the UK in fact I know one of the MP's that helped add caste discrimination to the Equality Act 2010.

Of course this is being opposed by "community leaders".

Interesting a woman from my home town was recently abused for being low caste. http://www.bbc.co.uk/news/uk-england-38663143

It would be interesting to beak down H1B's by caste
This seems to contradict the previous assertions that AMD CPUs aren't affected.
Whatever the headline is needs to come from the article, and we're more than happy to update it again if someone can suggest a better one.
But it's the drug and alcohol misuse which predicts violence, not the mental illness.
Only on HN can you find people who think the NSA is worse than Facebook.
Mycroft – A predicate logic language – overviewithpostmortem
Can't delete comments, so an actual question will destroy my karma count.. great system HN.
Not really: http://www.bfjlaward.com/pdf/25949/61-76_Blitz_JPM_0417.pdf
For discrete TPMs the specification explicitly says that they are not required to be resistant to physical attacks (probably because that would require specifying what kinds of attacks it is supposed to be resistant to).
This discussion seems like an apt place to drop Morris Kline's "Mathematics: The Loss of Certainty" (https://www.amazon.com/Mathematics-Loss-Certainty-Oxford-Pap...). As a non-mathematician whose only exposure with a lot of these ideas is through that book, I can't help but see these discussions as falling very much in line with the competing schools of thought described in the book.

The book is a non-academic tour of the history of mathematical foundations, and the way mathematicians struggled to rediscover "truth" or the purpose of their work when new crises were reached. For example, the book spends a good deal of time explaining the centrality of Euclidean geometry to people's worldviews, and the way that the discovery of non-Euclidean geometries shook people. Not just because they didn't assume other geometries could exist, but because people believed geometry to map onto Euclidean physical reality because it was God's way of revealing Himself to the world.

The other main crises that the book toured were the discovery of quaternions, Cantor's theories, and Godel's theorem.

Kline ends describing the arc over the last two hundred years of math as a splitting-off into four different schools: set theorists, intuitionists, formalists, and logicists. Each camp tried to reassert math on "solid ground". I hear echos of those debates in this thread, where some are asserting that there can possibly exist multiple foundations, which from my reading of the book is a very formalist idea (our rules of math are a formal system, and any internally consistent set of rules are just as valid as objects of study).

Not being a mathematician, I don't have a sense of where those schools played out to the current day. I'd be curious to hear if they're all still around in different forms, or whether some have more or less died out.
Practice of caste system is negligent among the educated, especially folks who come to US and in Indian metros (millions live) and most of the towns. It is still followed to some extent in 'redneck' villages in interior parts of India where one knows the other by name and caste. As far as entry into temples, all major hindu temples dont follow it or just dont care. Millions visit these temples each day. But, most of the incidents of late are more politically motivated than caste related. Current PM Modi himself is of lower caste. Also India and Hinduism is not uniform. Lower castes (designated as shudra in caste heirarchy) are called upper castes in south and hold political power. Its complicated.
This basically works out to the difference between income & net worth — and it's as important to nations as it is to people.
That's fair. Although I usually look to HN to hopefully find someone who provides clarity over situations like this. Performance impacts are really easy to interpret incorrectly.
Integrating JavaScript into Elm: Alternatives to Ports
My bad, but sounds like your response is ignoring all but one of my points.

Keep in mind that the issue was present in Windows 2000 yet remained undetected for 7 years after the release of Windows 2000.
I've been pondering how to identify the cached line without a timer. It seems like a classical race condition if multiple reads can be issued at once, eg by ILP. Another thread could easily figure out which load completes first.
Multi-Armed Bandits Library for Julia
> Is it theoretically even possible for all debts to be paid with the given supply of money

Yes, because money spent (to pay off a debt or otherwise) doesn't vanish in a puff of smoke, someone has it, and they can then use it to either pay off debt or buy goods, and the person who gets it then can use it to pay off debts or buy goods, and so on, ad infinitum.
Publicly, We Say #MeToo. Privately, We Have Misgivings
Be careful with this. We hired an exterminator once to deal with a carpenter ant problem and he said the number one cause of vermin infestation (rats, mice, squirrels, chipmunks, etc) is putting bird feeders near your house. Apparently the nuts and seeds attract vermin, which inevitably tunnel into your house through openings, and make it their house. I love the sight of birds, but after seeing chipmunks (ground squirrels) dig a huge tunnel network under our front yard, to the point where the lawn was collapsing, I'm not risking it.
Exactly what I was thinking...
Where do things stand with the status of vacuum in Redshift which derived from Postgres?

What version of postgres vacuum implementation are they derived from? Have they implemented or incorporated any of these improvements since their fork? (Obviously Redshift doesn't need the btree index ones since it uses distribution keys and zone maps.)

I ask because my experience is that Redshift vacuum implementation is awful on large heavily used data warehouses, and I wonder if there is any hope for improvement.
~100k years ago
https://www.sciencealert.com/the-last-time-the-ocean-was-thi...
except, you don't get 4.5% return in rent per year, due to depreciation
> You're really blowing off something incredibly difficult, more difficult (politically and financially) than putting someone on the moon.

You're probably right, but I also think that the main roadblocks are political, not financial. The US has one of the highest GDP/capita in the world but consistently fails to apply this economic power to helping its own citizens or does so in extremely wasteful ways like creating jobs through military spending.

Edit: Also public infrastructure isn't just transport. There are cities in the US that do not have safe drinking water. It's shocking.
Eliud Kipchoge and David Bedford at Oxford Union [video]
Only 1%? My eye. This has smell of Yahoo to it. I bet within 6 months, this goes up toward 10%. I bet they lost their entire data.
This needs to be the #1 comment in the thread. If you use a transactional mailer, make sure you are not archiving emails with security-sensitive content.

That includes resets, username reminders, signin notifications, etc.

Also secure access to your transactional mailer account with 2FA and restrict access to those who need to be there (i.e. not your entire support team).
I can see from your profile that your account is "Founder+CTO" and thank god I don't work for someone as pretentious and sanctimonious as you.

In all honesty, a dumb question is a dumb question, sure. If you don't want to answer it, that's ok. But don't get so high-minded about it.
What about the fact that these instructions might get partially executed in the pipeline before the branch gets resolved and the pipeline flushed? If a mis-fetched instruction can reach the LSU stage before the pipeline gets flushed, it might serve as a speculative memory load...
Because it's very easy to see how this flaw came about.

Branch prediction and caching is necessary for modern processor performance and it turns out that these two features can interact in a way that allows software to employ timing attacks to determine memory state for areas of memory that should't be readable.
Free Book for New Year's Resolution: Escape Poverty
Whoooosh!
Branch prediction is related to the Spectre attack. I believe AMD is only unaffected by Meltdown.
Responding to his issues with Vijay Pande's work (I'm not affiliated), graph convolutions really are better than char-RNN for this. There's a good theoretical motivation for why, and people have spent a lot of time trying to find better embeddings of chemical space. (Admittedly, still not great - I wouldn't dispute the overall thesis that AI in drug discovery is still very early.)

I did a project a year or so ago to reimplement one of Aspuru-Guzik's papers, a variational autoencoder, (https://github.com/maxhodak/keras-molecules) and when I did that I compared to char-RNN and the VAE did get much more interesting results. I also saw results from other people around that time showing that using graph convolutions on the front end instead of one-hot encoded SMILES strings was even better.

Also, as for OP's objection about GANs not working because it's a "perfect discriminator," this is an obvious result that becomes apparent after spending 20 seconds with the problem. (Eg, this thread here: https://github.com/maxhodak/keras-molecules/issues/55) I haven't read the Harvard paper referenced but I'd be absolutely shocked if this was lost on them. There are definitely ways to work through it.
Scientists Design Bacteria to Reflect “Sonar” Signals for Ultrasound Imaging
If responsibility is written and it says they produce unbreakable hardware, then yes.

If they don't do anything after finding out vulnerabilty - probably it depends, I dont know.

But thy are clearly putting in effort with vendors to mitigate and solve the issue. Doesn't look like negligence to me.
Right, but all this does is close off one possible avenue for a clever attacker to cobble together an HRT. Given the sheer number of JS APIs that have been thrown into browsers, I think it's pretty naive to imagine that we've closed off the only possible avenue to jury-rig a sufficiently precise measure of time.
Where "enough" is "more than is available in the universe". The number of outcomes you'd need to precompute exceeds the number of atoms in the universe.
Note that the form only works properly in Chrome :/
Exactly, whenever there is any mention of an aviation incident, I am always in awe of how infrequent these are despite tens of millions of people flying every year more or less round the clock. What a massive human achievement.
Present Company | San Francisco | Founding iOS & Java engineer[s] | https://present.co/

We’re building Present, an innovative social network just for women!

We’d like to hire experienced iOS and Java server engineers. Our iOS app is written in Swift. For the server role, experience with our chosen technologies is a plus: App Engine (Java), Guice, Guava, Objectify, Protocol Buffers, Docker.

Our team is almost 80% women and has experience at Square (former CTO), Google, and Facebook: https://present.co/join.html

Send your LinkedIn and/or GitHub to hello@present.co. Let’s be Present!
So the only way the US comes out ahead in that situation is through playing games with inflating the currency while lying about it to recoup the costs of servicing the debt.

In the end, once the US is caught with it's pants down it will definitely not be making the US any richer.
That does not stop him for leveraging it for his political gains either.
Wait AMD had to disable branch prediction completely on 17h (Zen)?!
The Vacietis (https://github.com/vsedach/Vacietis/) reader can be easily adapted to do that. You can see examples in the unit tests:

https://github.com/vsedach/Vacietis/blob/master/test/reader-...

As-is, C block constructs get mapped directly to Common Lisp special forms like tagbody and prog because those implement a superset of C control flow semantics. Pick different names in vacietis.c and you have an AST.
Identification of Pre-Existing Adaptive Immunity to Cas9 Proteins in Humans
That's correct. The Libz Blitz was basically the name for the library team's plans for 2017 overall. The impl period covered the whole project.
It really depends on what we use it for, what strings are attached to the money besides interest (official or otherwise), how that would affect our credit rating / percieved value of the dollar with other countries, our effectiveness in spending that money, etc. I’d submit that it isn’t a question we can really predict the answer to. Way too many variables.
I think such quality collapse is evident across many industries today. It might be related to wage stagnation. Can't afford to buy quality, and no incentive to produce it.
Maybe I'm misunderstanding something. I thought the attack was from returning from a fault and reading back cached data from before the fault.

So the branch predictor only needs to be cleared after any interrupt or syscall return.
I'm also confused. Disabling all branch prediction would obliterate performance.
I wonder how long that will last until GitHub bans them for (presumably) massive amount of spam. The fact that it's PRs only, not just issues, makes it a bit harder, but I can't imagine it'd be that hard to abuse
To price derivatives one uses risk-neutral probabilities, which are different from real-world probabilities. The binomial tree you talk about cannot be used to calculate the expected return. Maybe this was not properly explained in the course you took, or maybe you were not paying attention.
> I mean how are those languages good from a software engineering point of view?

Common lisp: great for game programming or any type of application where it takes a while to build up a set of "state." You can redefine various aspects of the program while it's running. So, ok, there was a bug in your physics code and your player fell through the map. You can fix the physics bug while the game is still running and place your player back in the same spot. Now you don't have to recompile and try to get your game in the state it was in before.

When I get back into game programming, I'm probably going to use CL extensively. I might delegate the low-level stuff to an embeddable game engine (like Orx) but all my high-level logic would be CL.
The fundamental problem with AI (here meaning, neural-network based applications) applied to biology is that pattern recognition doesn't get you very far. When designing a small molecule drug, for example, the goal is to find a molecule that will slot into some protein (or other biomolecule) of interest in just the right way; whether it does so is dependent on shape in complex and impossible-to-predict ways. As an analogy, take the task of making a key (drug) to open the front door of an apartment across town (disease-relevant target); your "training data" (known drug-y molecules) are the keys for a bunch of other apartments sampled mostly randomly from around town. Obviously, you can make any number of plausible key-oid objects that would pass visual inspection as potential keys to the target, but even a godly-intelligent post-Bostromian superAI couldn't solve the problem in any principled way. You just need information about the actual lock you want to open, plain and simple.

There are many, many, many other open problems in biology, of course, ranging all along the conceptual gamut, so I can't say there's nothing where AI would be a killer app. And there's also the sort of last-ditch null argument that, well, being smart helps humans do biology, so computers that are smart must be useful somehow. But typical progress in this field is from patiently acquiring new data. There's no point where you know "enough" of the picture to infer the rest with any degree of certainty- the degrees of freedom in the "design" of biological systems is simply too huge.
Applications that don’t use Redis as a persistent store, and enable pipelining, will be hit less hard, yes. Applications that connect to Redis remotely will also be hit less hard — loopback makes this somewhat of a worst-case scenario.
To be fair SV does a pretty good job at spreading douchebag ideology, with or without Kalanick.
Tesla Model 3 – Your questions answered
Why So Many Men Hate the Last Jedi but Can’t Agree on Why
Best pun of the year so far. ;-)
woah, this is my project. Glad you guys find it interesting. I'm happy to answer any questions you might have.
Which is why i said technical details aside.

I think it's interesting, you are not just paying for speed, you are paying for a compromise, because the speed is gained through complexity, which not only increases the chance of error (by design or implementation) but in the case of a high degree of speculative execution can translate into worse performance per watt. In short, it's the whole "more is less" thing.