skysight-inc/HackerNews huggingface dataset:
I use blockfolio, and gave up trying to pop in all my trades. So I just it to track overall price movements of the coins - blockfolio doesn't seem to understand the swapping of one coin for another even show it displays prices in pairs and lets you insert trades that way. For example, if I bought one, swapped it into another, and bought another (esp. USDT, which doesn't show up even as an option, only USD) then the system doesn't chain those together as one transaction.
I usually prefer to whitelist domains rather than individual scripts. Either I trust a domain enough to serve scripts or I don't, there's rarely a middle ground.
Further Analyzing the Intel CPU “x86 PTI Issue” on More Systems
Then the next generation it is.

It's a 5-30% performance boost without even a major change. :-(
why is this even on the top? no offense but it is a css stylesheet.
Comments moved to https://news.ycombinator.com/item?id=16065845.
> The first set of numbers isn't actually unrealistic. Doing lots of primary key lookups over low latency links is fairly common.

Latency through loopback on my machine takes 0.07ms. Latency to the machine sitting next to me is 5ms.

We're actually (and to think, today I trotted out that joke about what you call a group of nerds--a well, actually) talking multiple orders of magnitude through which kernel traps are being amplified.
Of the variants of the attack that can leak privileged memory, AMD is only impacted if a non-default kernel configuration is enabled: "BPF JIT"
From my understanding, the VM can exploit it too via executing a crazy amount of syscalls. I may be misunderstanding, but if that were not the case I doubt that AWS would be forcing quick reboots of a ton of its VMs.

Edit: Wait, sorry, I misread. Read is all you really need, write would just be a cherry. If you can read the memory of the host kernel, then you can gain access to any other VMs on the system. This one is bottom-up, you need access to one system and in theory you can gain access to thousands.
Then perhaps rather than posting a raw, unadorned question with no actual value, you might write something considered and post a link to that. As it stands, Betteridge's Law of Headlines[0] suggests the answer is a simple "No".

[0] https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
And they lost some browser share from me and people I knew when they dumped Presto for becoming a Google slave.
Maybe? None of what you're saying is obvious to me in either direction. But it does seem to me that "served country in the past" is a reasonable thing to consider when hiring for largely thankless civil service jobs.
Spectre has two variants, CVE-2017-5053 and CVE-2017-5715.
Nut quote: "Systems running all versions of Xen are affected," which should be fairly clear based on reading Meltdown/Spectre. This is uniquely bad for hosting providers, and the accelerated disclosure timeline does not help at all. Expect drastic response from unprepared cloud providers in the next 48 hours.
There aren't really any special Android ARM CPUs, maybe they are confident it doesn't really work on Android because it's very difficult to get the timing precision and low-level assembly sequences in Java/ART compiled code. Though I wonder how that squares up with JNI.

I think the key to the statement is in any case that you need to differentiate between what is possible on the processor architecture level when you have full software control, and what is possible on an operating system level, where 3rd party applications are further restricted in various arbitrary ways such as only allowed to use Java, limited access to high resolution timing primitives, etc. that can make practical exploitation impossible, even if the flaw is present.

It's difficult to reason about because it's hard to tell if you can manipulate a JIT runtime into generating the code you need for the exploit to work - and as the JavaScript implementations show, the answer is often "yes".
It's related. This was during the early versions of the security patch, which was causing performance and clock skew issues for PV instances (https://twitter.com/kainosnoema/status/941816042103324672). Since then AWS has mostly resolved these, but we've moved all our instances to HVM AMIs as well since they're apparently not affected.
Well... reading further, below the details of the third POC, they say "Our research was relatively Haswell-centric so far. It would be interesting to see details e.g. on how the branch prediction of other modern processors works and how well it can be attacked."

So it seems like they tried it on AMD and ARM, but they tried much harder on Intel. That's less reassuring than my initial reading.
> Because it forces the rotten core of the ideas to the forefront.

it seems to me it would do the opposite. it simply requires that one pursue the same goal in a more polite manner, to avoid being put in prison for one's words. ideas and intents can be rendered in a vast array of ways.

> By criminalizing specific icons of hate, you can rob those who would build a following from using them as a rallying point.

i don't see how. all this means is that people will use allusions, metaphors or otherwise use substitutes for that 'icon', whatever it is. or even just endorse similar policies, concepts or other things. or instead of being against x, they'll be for y. etc.

the real way to "stop" ideas (rather, the way to sway the majority of people) is showing why an idea isn't great and presenting a better idea. with logic and reason.
Ooh, not so much. There are arguments about that postulate the conservatives give more to charity than liberals.

That's only true when you count religious giving.

Now then, yes, there are many, many valid religious charities (and by this I mean organizations, as well as that component of church giving that factors into benevolence).

But by studies performed by religious organizations themselves (who if anything are likely to skew the numbers more positively), across the board, "Local and national benevolence receives 1 percent of the typical church budget", and an additional 5% goes to "church run programs" (be it after school care, social or group activities).

If a secular charity - and lets go back to Charity Navigator here - Top Ten Inefficient Fundraisers (http://www.charitynavigator.org/index.cfm?bay=topten.detail&...) we see some of the worst charities spending 15% of their donations on "program expenses" (i.e. doing what they are being given money to do).

I'm not familiar with the monitoring of 501(c)3 groups, but I suspect if charities were to regularly spend only one per cent of their givings on what they got to enjoy tax exemption to do, they'd likely have such a status revoked.

And, if you factor in this average percentage (even the six per cent combined, which is generous, as as much fun as social and youth activities are, they're not necessarily serving a critical need), and start to question 'how much money is being spent on 'spreading the word', patting themselves on the back, competitions in Texas to see who can built the world's biggest cross just down the road from where the world's previously biggest cross was built at costs of millions, there comes more and more skepticism of just how highly you can value "giving to your church" on the scale of charitable contributions.
Why a period in a text message makes you sound angry
You're simply cherry-picking evidence which supports your belief and ignoring contradictory evidence, and other factors. Have you tracked any particular one of these skinny Asian round-the-clock over a period of time? One observation of a meal doesn't tell you everything.

I'm in Asia now (Japan). The predominant eating pattern is: tiny portions, by American standards. (Stuffing with large servings of rice is a Chinese or SE Asian thing. I have seen it too.)
Yup, I have some muscular friends who sink like stones. I hear this is also the reason other apes can’t generally swim—they’re too dense. On the other hand, I’m very thin and have relatively low body fat, so I’m not very buoyant at all either. Filling my lungs with air is enough to make me float, though. :P
this reads like a report from a bloodbath.
2018 will be the year that large, incumbent companies take on big tech
Thanks! We've merged another thread and updated this link from https://security.googleblog.com/2018/01/todays-cpu-vulnerabi....
Both domains were registered on 2017-12-22. Given the planned disclosure on 9th January that Google mentions and MS and others coding patches silently [1], do the early reports [2] of kernel patches, does this mean that due to coding in the open the whole disclosure procedure has been vastly accelerated?

I wonder how the timing relates to New Year and many companies having holidays in CW1.

[1] https://lists.freebsd.org/pipermail/freebsd-security/2018-Ja...

[2] https://news.ycombinator.com/item?id=16046636
I'm not an expert in the field, but I'm pretty certain the writer of this piece is neither. He is not using correct units and seems to be misusing the term "fatigue strength".

The proper way of conducting this kind of material comparison would be finding the design limit. In this case it would be probably either toughness/weight of fracture toughness/weight. Then if you are unable to come up with specific grade of metal that simply beats bone, you have absolutely no case. Typically alloying for high strength decreases both toughness and fracture toughness.
I've heard they continue to have had big steel welding problems. Earlier cars were composites and aluminum but ramping up production of steel cars is a very different manufacturing technique.
http://autoweek.com/article/car-news/tesla-might-be-missing-...

The rumors have been they are still using 1980's manual production line techniques https://www.harborfreight.com/welding/spot-welders/240-volt-...

Th
Until someone figures out how to exploit it using JavaScript. The speed this moves it could be any minute now.
For a moment in time, the octogenarian and the 3 month old are both in a competition for the same resource, if they both have the same chance of getting it, and the octogenarian happens to get it, the outcome is still fair within this context. It could just as easily have gone to the 3 month old.

It is not fair to count the octogenarian's past good fortune against them in what should be a fair contest. But we do it, because when handing out organs we don't care about fairness, we care about viable lifetime remaining.

When searching for fairness a lot of people seem to believe that good luck in the past means it should be harder for you to have good luck in the future. Ironically, this is very unfair.
http://cherrypick.club
http://getpeppy.com
It's not a zero-day exploit.
Electronic Frontier Foundation (EFF) | San Francisco, CA | Full-Time, Onsite Only | https://www.eff.org

The Electronic Frontier Foundation (EFF) is seeking applicants for the full-time position of Operations/DevOps Engineer to join our Technical Operations team and help build the infrastructure that lets EFF defend civil liberties in the digital world. EFF is a really great place to work. We offer a supportive and empowering environment, along with an excellent benefits package including housing cost assistance, student loans assistance, medical, dental, and vision insurance, a 403(b)(7) retirement savings program with matching, paid time off, holiday benefits, parental leave, a dog-friendly workplace, and more. Because our team benefits from close communication with each other and the with other teams at EFF's San Francisco office, working remotely is not an option.

https://www.eff.org/opportunities/jobs/operations-engineer
Variant 2 and Variant 3 are Intel only. They are the most concerning as they break VM space.
That article talks about a plant that took five years to commission, and is built to make cars that have been mass produced for decades and when it is done it will have a capacity to produce 200,000 cars per year.

Why would anyone say thats even in the same ball park as a company building a assembly line for a new class of product at over double the capacity and doing it in one third the time ? Of course their factory is going to be a smoother operation they have been doing it for decades, when will volvo make a mass market electric vehicle ? You would think with the kind of demand there is for the model 3 Volvo, BMW, GM, or another one of the established manufactures would be able to exploit their knowledge of car assembly and take market share from Tesla, but so far the best anyone has done is the 30,000 units a year the Chevy bolt is expected to manage and it isn't planned on scaling much past that.

So the factory situation is a mess, but I don't think a peachy PR piece about a very different situation is any kind of nail in the coffin, just a reminder of how much the current state of the art in car manufacturing is being changed. Even companies that have internal combustion down to a science can't manage to put together electric cars. To me it shows how far ahead Tesla, it would appear the current plan for everyone else it to let Tesla figure it out and poach their executives.
https://github.com/IAIK/meltdown 404's. I assume this is by intention? So full disclosure, but missing the code? Or is it somewhere else?
You know it's a bad one when Project Zero allows more than its usual 90-day deadline...
It says at the bottom they were both done by the same person.
Actually, I think networking is their core product (though maybe not competency...).

Their App is tricky to use (easy to skip, rather than enque a song, or accidentally skip while looking at meta data, or searching for tracks to queue).

They have offline working, half-decent play lists (but still too easy to accidentally make a new list, rather than augment an existing one).

However - "everyone" knows it, and knows favourite songs on it, and have an active account - so it's nice at parties, or for sharing tracks in person or via messages, tweets/statuses etc.

The only other thing I'd like to see was a steam/sdk integration for soundtracks in games. Everyone listens to their own music with any (mmo) game worth playing - but it'd be nice to have Spotify cross-fade to the "scary/dramatic" playlist in a fight, and "moody" when the game calls for quiet mood etc.
Intel has released a statement for the codename Meltdown bug:

https://newsroom.intel.com/news/intel-responds-to-security-r...
From spectre.pdf:

> In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it.

(granted I think site isolation, if enabled, mitigates crossing domain boundaries)

It goes on to show a sample JS impl that JITs into the expected insns using V8.
So is speculative execution just inherently flawed like this, or can we expect chips in 2 years that let operating systems go back to the old TLB behavior?
Depending on how sophisticated your prototypes are (or something I can google and do myself), there are definitely values. But you need to share more info for me to advise. I do look for HW prototyping services sometime but it'd require someone who knows specialized fields (fluid physics). You should start to test by doing a bunch of videos to post of social media and see what kind of responses there are.
Chrome is listed as impacted due to javascript being able to read memory from outside the browser sandbox.

"In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it." - from the spectre paper
Ripple Roars Past $3 to Become Second Most Valuable Digital Currency
What is science about?
This argument is terrible and has been put to rest by Nozick in 1974. Look up the utility monster.
You should install it and then try reading your own grumpy comment again. See?
Intel and AMD were informed of the vulnerability in June. The stock is up significantly since then, if the CEO was selling for that reason you'd assume it would be much sooner after. In all likelihood this is for tax purposes. The SEC would likely never be able to prove otherwise. I also doubt the SEC even looks at it. There was heavy options volume leading into it though, which they might.
the big if is whether javascript code that can exploit this can be written. (edit: that's a yes, from the pdf itself...) if yes, nobody's safe, as any webpage (any webpage, even that ad in an iframe) could in theory read your password if it's anywhere in RAM.
Why are people conflating "government work" with "NSA work"?

It's like saying "corporate work" instead of "Google work".

State level agencies are obviously going to be low-level dreck. The NSA is completely different, and has some of the smartest people on the planet.

It's intellectually lazy (read: dumb) to apply an anecdote to everything, like saying "black guy committed a crime, therefore ALL black guys are criminals". Be smart and more deliberate, instead of being intellectually lazy.

I've been in enough situations, both in the corporate and government sides, to know that each situation is unique. I worked at/with large companies (Intel, IBM), medium companies (Cadence, ATI), and several small startups, along with government (NSA/other agencies). They all have their own unique properties, and I can't say "huurr durrr government employees are all lazy" when it's obvious they aren't, just by looking at what the NSA does.

It's always fun to see Google introduce a new product that the NSA already made years ago...
Also, p is prime.
It already is, just some people want want to extend the law to force people to think & behave the way they want them to. American law covers everything necessary for every individual to live a civilized life where they can pursue happiness and meaning as they choose to define it.
I'm not that savvy with security so I need a little help understanding this. According to the google security blog:

> Google Chrome

> Some user or customer action needed. More information here (https://support.google.com/faqs/answer/7622138#chrome).

And the "here" link says:

>Google Chrome Browser

>Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mitigation by isolating websites into separate address spaces. Learn more about Site Isolation and how to take action to enable it.

>Chrome 64, due to be released on January 23, will contain mitigations to protect against exploitation.

>Additional mitigations are planned for future versions of Chrome. Learn more about Chrome's response.

>Desktop (all platforms), Chrome 63:

> Full Site Isolation can be turned on by enabling a flag found at chrome://flags/#enable-site-per-process.
> Enterprise policies are available to turn on Site Isolation for all sites, or just those in a specified list. Learn more about Site Isolation by policy.

Does that mean if I don't enable this feature using chrome://flags and tell my grandma to do this complicated procedure I (or she) will be susceptible to getting our passwords stolen?
How  to Earn Passive Income with Cryptocurrencies
Does it restore the passwordless login feature? :p
The linked thread suggests that Spectre doesn't have _any_ mitigation.

> The business/economic implications are not clear, since eventually the only way to eradicate the threat posed by Spectre is to swap out hardware.

Is this fully accurate, there's no software mitigation available now?

From [0], the above may be true:

> There is also work to harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre .

There is 'work'? No current patch? So Spectre is unpatched?

This point doesn't seem to be being highlighted but appears particularly important.

[0] https://meltdownattack.com/#faq-fix
Thread with more information: https://news.ycombinator.com/item?id=16065880
Admins: this is flagged as dupe, probably should not.
Right...

According to the WHO [1] the US health care system scores first on exactly one metric, which is cost...

It boggles the mind that someone could rationalize a healthcare system that leaves millions of people uninsured, bankrupts and destroys people unfortunate enough to attract even minor health problems, and results in higher costs than anywhere in the world as ‘better’ than ‘average European care’, because it is ‘bimodal’. What does that even mean, practically speaking? What does the US health care system offer the more fortunate citizens that you won’t have in, say, Japan, or Sweden, Malaysia, the Netherlands?

Question: do you think people live longer in the US, compared to other countries? Die less of common illnesses? Can get treatments for covering the 99% most common health care needs that are available exclusively in the US? I don’t think so...

[1] https://en.m.wikipedia.org/wiki/World_Health_Organization_ra...
Today's CPU vulnerability: what you need to know
If you are supplementing with Vitamin D you should also look into Vitamin K2. K2 helps D to absorb calcium into your bones (where you want it) and helps Vitamin A remove calcium from your veins (where you don't want it).

An interesting read: "Vitamin K2 and the Calcium Paradox" - https://www.amazon.com/gp/product/0062320041
I would think EV chargers should be a tourism gold mine in the near-ish future. A 20 to 30-minute-ish semi-captive audience should be making a lot of business owners drool right now.

I'd been considering for some time that if I were McDonald's corporate right now, I'd be examining EV chargers right now for a potential amenity to sell to franchisees (or possibly even to require from franchisees ahead of demand curves to create favorable headwinds).

I hadn't thought about gym chains, but that's also a great idea. "EV charging at any of our gyms around the country" / "Stop in on your next road trip" just might be an amenity that could sell some gym memberships.
The worst thing you can do for the environment isn't flying; it is having a child. Having multiple, is, well.. X times worse.

Our population isn't declining either, as long as you watch it from Earth's PoV instead of whatever nation you're from.

I don't want to judge a specific person on having a number of children, and being the parent of one child I can't even fathom having five (!!!) but the general notions you made in conclusion to that I disagree with.
Yeah, this HN headline seems intentionally negative considering their current weekly production rate is somewhere between 40%-60% of what they produced in all of Q4. Therefore focusing on their total Q4 is misleading regarding their current production. Why not use the article's actual headline?

EDIT: And now the headline has been changed to match the article. Good move. The original headline on HN was something along the lines of "Tesla only delivered 1,550 Model 3s in Q4".
Don't know, but not having a useful history of tracks is really annoying. Why I've landed on cloudplayer for Android - it allows you to go back to "that nice track three songs back when I was biking down a hill" (when shuffling a large, partially unknown selection).
Accelerated, but not vastly. Google's post says "We reported this issue to Intel, AMD and ARM on 2017-06-01", so the embargo still ended up holding for 7 months, even with it ending a week early. The domain registration dates of 2017-12-22 seem to be just when Google started to prepare for releasing the publicity materials, not when the vulnerability was discovered.
Ah, I missed that, thanks!