skysight-inc/HackerNews huggingface dataset:
If you can dump the memory holding security certificates, I'd suggest you probably can.

There will be processes outside a users control that run with elevated privileges, attacks that allow you to monitor the setup of these processes could prove risky to the overall security of a system.
Launch a chrooted daemon that uses Meltdown to read protected memory to discover when a local console user (presumably root/sudo) logs-in, then read the protected memory of the keyboard input buffer (keyboard interrupt handler? Console buffer?) to grab their password, then mail() it off to your email account and login as root via SSH from the comfort of your own home.
Cars and planes (and even radio transmission equipment) pose a high risk on public safety. They aren't restricted because owners don't have the right to control these devices, they are restricted because public safety is at risk otherwise.

Processors don't fall into that class of devices. In fact, I'm willing to argue that not allowing owners to patch their devices is a public hazard (ddos botnets, mass identity theft, etc).
Xkcd: Meltdown and Spectre
I watched so far the first 7 or 8 lectures on youtube of his linear algebra course. (Which something like a million people have watched) He's such a great lecturer, extremely impressive. So mysteriously good it makes me wonder what it is about them that seem so good. He says somewhere about how he gets a lot of mail thanking him, that people appreciate that he's on their side. It's just done with what the experience is like for the student always in mind. Sounds simple, but there are plenty of lecture/course videos on youtube where that obviously wasn't given a thought.
The Nintendo Switch generally only allows white-listed pages. So the attack vector is pretty small.
The other consoles, yes, should be possible. But I think not too many people use their consoles for browsing.
Can you give examples where the paper is wrong?
In large things, not nitpicking. I'm just genuinely curious.
Hoe snel afvallen zonder je gezondheid in gevaar te brengen
Typical coal power plants have practical electric efficiency 40% but total energy efficiency is 60-70%, because they produce electricity and useful heat.

Also 40% is a theoretical (lab) value for a non turbocharged diesel engine - in practice most engines are operated out of their optimal range, they are turbocharged (a turbo increases power output at the cost of decreasing compression ratio and thermal efficiency), there are losses in the transmission, hence efficiency is much lower than 40%.

BTW, in lab, a coal plant with a steam turbine can achieve over 50% electric efficiency (some reports say even 60% is possible). They are too expensive to be used on large scale, though.
Sure, but until the advent of JS you at least knew whose code you were going to run. Now you are more or less required to run untrusted code just to get through daily life.
>I don't understand why people

Because it's a bother to keep in mind when they introduced the new name? Or release names? It's hard to imagine that someone would actually be talking about certain number of releases this way.

PS: Apple's stupid marketing bs strikes again.
What's the power transmission loss from carrying crude to a refinery and then to Australia? The country is a net importer of oil, which means tankers burning foul stuff to carry it there.
The historical record indicates Edison treated people dramatically better than Jobs did. The factual record to support that is overwhelming and covered in about a dozen books. Read about the enjoyment his fellow inventors had in working with him in the early busy days. Read about the praise he received from his fellow workers before he became famous. He was not known as an asshole.

The only thing Edison appears to have acted like an asshole in regards to, is some of his business dealings. Some of which is more attributable to the people that were actually operating the numerous business ventures (which he was not in most of the cases).

The case for Edison being like Jobs in terms of the asshole quality, is barely existent. It's mostly a modern myth popularized to attack Edison for Tesla's benefit.
You're right, it really is too difficult to live and let live. It's really too difficult to think, is everyone benefitting all that much from the pain I'm inflecting on whatever I'm hurting. Please, these are adults that knew what they were doing and that the pain they were causing didn't satisfy some need, but some want. If you don't want to go down in history as an asshole, don't be a dick when you or your tribe are only benefitting beyond basic needs and necessities.
Post. More. Benchmarks. I'll do the same once I have them. More data on this across platforms and apps is incredibly helpful for all.
Only if the algorithm can be split across multiple machines easily.

Sometimes people assume that you can use local shared memory or something between threads in order to synchronize state. You figure out how many individuals can be on a server at once and then ensure that you can handle that load on a specific machine.

I've seen this type of stuff for game state before because they need to keep everyone in a specific game domain (level or city depending on the type of game) synchronized and be nearly real-time. It can be hard to pull this across different machines without introducing significantly latency, redis or DBs is slow for a FPS shootter.

Not saying this is the case but I can see it could be something like that.
"The irony is
that our custom base-hw kernel actually used to keep the kernel in a
dedicated virtual address space - until three months ago when we
reworked the kernel to follow the main stream where the kernel is mapped
in each user-level address space as privileged pages."

That hurts. Reminds me of when we finally relented and started to stream video using Flash only to have Adobe announce the end of life on Flash.
I love Panic, and their software is great quality for what it does, but I'm sad to say I just don't have a place in my life for those kids of development tools anymore.

I find it unsurprising that there isn't a market for Transmit on iOS, but I do find it surprising that there's still a large market for Transmit for Mac. I bought it in 2011, and got a year or two of use, but now only use it once or twice a year which doesn't justify an upgrade.

I'd love to see them focus on more modern development tools, but I'm not sure their approach will work in that context.
Oh, interesting, I never tried it on Windows. What doesn't work? Everything!? Can you make an Github Issue for it?
If they are going to block JavaScript, they need to do it for all domains, not just untrusted domains. For example, if I can MITM my own website activity (which I can, by having a device that sits between a router and a console), then I can change the JavaScript coming from trusted domains.

In other words, if I visit a site like Google or Facebook on an affected device, I can change the JavaScript that is run, and make it still appear like it came from a trusted domain.
Sadly homebrew Debian variants aren't very safe either. Usually they lack timely OS updates, ship pregenerated ssh host keys in the images, stuff like that. Even Raspbian is pretty bad at this though better than many smaller ones.
I suppose if a Cloud provider could ensure that all your VM instances run on the same host and no other VM is allowed there then the issue would be a bit mitigated.

Although this restriction on how the cloud provider is allowed to schedule your VMs probably would somewhat defeat the point of cloud hosting in the first place.

Out of curiosity, how many VM/container instances usually run on a physical host at any given time (for your typical cloud computing provider)?
Even though I would also like something like this I understand they do have their reasons for not doing so.
AFAIU they are of the opinion that a livedisk would misrepresent the capabilities of the system.
Introduction to Operating System for self taught web developer
2018 College Football Playoff National Championship Patch
Almost all of this commit is .patch files. Going through them, it seems to be about 10 from AMD, a few from IBM (for S390 processors), a bunch from Intel, and a few from kernel core maintainers. It's a giant workload, but seems to have been distributed pretty widely.
Real data like this post are more useful than more benchmarks.
How a Decade of the iPhone Changed Global Kidnapping
> We were apparently doing fine without them before that

well, feel free to return to using pentium2-like CPUs
Whoa that's an ugly webpage. It's so huge!
Guess that's what I meant, but I'll take either!
Yes, That is why I said consumer grade. I dont want to fiddle with things anymore. I know Synology offers Btrfs, but they only offer it at the higher end spec machine. I think their newest DS218 doesn't support either Btrfs or snapshots, and it doesn't have ECC Memory.
Would be funny to see a game server exploit (since this was about Epic Games here) via specially crafted network packages that look like valid game messages. Has this happened before? Seems natural that those game coordinator backends and such should have security holes too.
It will show any captive WiFi-portal however so perhaps watch out for that.

In addition they do have a store with indie games which seems to be more or less open to anyone (I assume there are some checks but I wouldn't trust them completely) much like Steam.
There's potential for a little rearchitecting to help, at least in the case of UDP:

NAME
sendmmsg - send multiple messages on a socket

SYNOPSIS
#define _GNU_SOURCE /* See feature_test_macros(7) */
#include <sys/socket.h>

int sendmmsg(int sockfd, struct mmsghdr *msgvec, unsigned int vlen,
unsigned int flags);
User-space drivers have been doable for a while, and dpdk[1] is definitely worth a check. There's also some manufacturers[2] that only does user-space drivers for their high-performance cards (e.g. 4x10Gb/s, 2x40Gb/s, 2x100Gb/s cards). Being designed with this in mind helps performance a lot.

1: https://dpdk.org/
2: http://www.napatech.com/
This is somewhat of an opinion piece. We need more articles like it to counterbalance the "AI is the new electricity" crowd. Hyping deep learning isn't healthy.
If you’re running an SSL terminating web server in front of your application server (on the same node), these exploits would allow you to read the ssh private key from the front end, AIUI.
Very interesting information. Thank you.

What would you say is the typical efficiency of a modern gasoline car? Say, one that uses 7L/100km on average?

Also, why do the coal plants with higher efficiency so expensive? I've read somewhere that higher heat would be better, but the steel that can resist it, is too expensive. Is that correct?
Renting beefier servers may also be an option if the performance impact scales linearly with pre-patch performance. However it's not clear in this case how that works.
In the paper edition of The Economist they do occur.
I love Panic's tools, but I was one of those that got burnt when they pulled their StatusBoard app off the App Store a couple of years back. I have a small side project [0] that I created a specific integration with StatusBoard because it suited our web service so neatly. Shortly after I launched my app, they shut it down!

Haven't been able to find another app like it, and I believe a lot of our customers (including myself) still use an older version of StatusBoard still, so I've left the integration info on our web site for now.

But like others on here, I have most of their other tools on my iMac and my iPad, and while I use the iMac ones semi regularly, I hardly ever use the iOS versions (apart from StatusBoard).

[0] - http://www.staffstatus.io
A user-space driver doesn't communicate with the kernel. It is assigned DMA buffers, and communicates with the NIC solely through reading and writing to shared memory buffers.

Even before this fix, the benefits were massive, as sending a buffer was just writing to some memory, rather than syscalls and copies galore.
PS4 and XBox One are running AMD CPUs (albiet x86-64 arch) this generation and the Switch is NVIDIA (ARM Aarch64).
You're making assumptions about a software stack you haven't seen.
Spolsky's wrong about rewriting from scratch, he took it way farther than was sensible.

The main problem most people make about rewriting from scratch or switching architectures or what-have-you is not doing it at all but thinking that it'll be a cheaper and easier transition that it will actually be and also committing too early to the new product.

A lot of this comes down to the arrogance of engineers and the devaluation of testing. The reality is that testing and real-world use have tremendous value in shaping products. Actual usage is one of the best ways to discover bugs, of course, and over time those bugs get fixed, leading to a more mature product. Similarly, actual usage is the best way to discover the gaps between the developers' design and vision for the software and what people actually want and need. More so when people trade hard-earned dollars for software. Developed software thus represents not just X number of hours of dev. work it also represents a tremendous number of hours of refinement, validation, and verification through "beta testing" (product use), in short: product maturity.

Trying to replace a mature product with an immature product is a disaster waiting to happen, even if the immature product is technically built on a superior foundation. The right way to do this sort of thing is to spend time running parallel development efforts, giving time for the new thing to mature and compete against the established product and allowing the market/customer base to make the transition as the new product gains maturity and becomes superior in practice not just in theory. Or, as people avoid the new product due to it failing to achieve its promises.
The requirements for getting onto the various platforms are pretty stringent. It's nowhere near as easy as getting onto Steam. You have to go through quite a rigorous certification process before you are allowed to ship your game on the online stores.
> C-like expression parser

What does that mean? What can you do with that?

> Source code view

Does it understand programming languages? Can you inspect the contents of variables like in VS?

My impression is that the focus is on debugging executables where source level access is unavailable. Cracking, reverse engineering. Are there people who use it for development?
Depends if the bottleneck is a single CPU or whether it is a single machine. Those beefier machines are usually slower per CPU.

I've seen some crazy game server designs before in the quest to have fast response times. But UE4 is pretty professional so even if they are tied to a single machine, they probably are not tied to a single core for some of their critical algorithms I would hope.
Mega Millions Announces Single Winner for $450M Jackpot
Yes because we expect recent CS grads to be fully cognizant of good software engineering practices.
>> "N.H.S. Overwhelmed in Britain, Leaving Patients to Wait"

The next line in your comment explains why this is the case: "Cuts to the National Health Service budget". The NHS was a unique jewel of a public health system (from which I myself and members of my family have benefited, as well as contributed to btw). This was until successive Tory governments took a knife to its budget and started making plans to sell it all off.

The fact that the NHS is ailing supports the exact opposite of what you are trying to say: a health system supported by public funds takes good care of its citizens. One that is privatised and whose budget is slashed, does not.
You can be prevented from a successful MITM by enforcing HTTPS using HSTS and pinning the keys of trusted sites. That's not a viable solution for accessing the internet at large, but for a console that is only incidentally used for web browsing, it's absolutely an option.
No no no, you can easily train the branch predictor by sending a bunch of valid requests followed by an invalid request with a payload that redirects the ensuing speculative load into your desired address range.
Ah, so actually all of page isolation is about preventing Meltdown/Spectre or related attacks. I had thought only the first point was about that. This makes sense of course.

Thanks for the answer and for the awesome work in general!
I'm not am expert on turbines, but generally the turbine efficiency is directly related to the temperature and pressure difference between the inlet and outlet. Hence bigger plants have typically higher efficiencies. Bigger turbines have also more stages, so not only they have to withstand higher pressure, but simply there are more parts.
> It could be still a problem though, considering many console games use all kinds of hacks to barely run at the target resolution/framerate.

If you had to slow down any of the consoles by 10% there would be tons of problems in the games. As you said, those games are highly tweaked to just barely run on those CPUs/GPUs.
People want to maximize the time they spend together with their team mates, spouses, friends and children. That requires synchronization.
Dirvish: a fast, disk-based, rotating network backup system
Visual Complex Analysis - Needham.
A lot of great pictures, exerything is explained (and shown) geometrically. Complex differentiation/integration, non-Euclidean geometry, vector fields etc.

Mathematics and its History - Stillwell.
Wonderfully written. From the ancients to the 20th century, covers the mathematics (in a lot of detail) and lives of major mathematicians (potted bios).

Concrete Mathematics - Knuth et al.
Discrete maths, number theory, generating functions, covers most of the maths that pops up continually in programming.

All You Wanted To Know About Mathematics But Were Afraid To Ask. Mathematics for Science Students 2 Vols. - Louis Lyons.
Pretty basic, but covers all the mathematical basics for physics. (1st year uni level I guess) I learned a lot from this years ago, I still consult it as a reference. It's a pleasure to read.

Also, all of Hamming's books.
I Bet My Bitcoin Like a Gambler, and It Made Me Scared for the Future
Are there denser ways to store electrical energy? Hydrogen fuel cells maybe?

Seems like you need something much lighter than lithium-ion batteries to even begin to fill the role of passenger planes.
I find that Swarm is the only thing that fits my use case of just shipping. There's so much complexity and overhead with kubernetes and often I just want something that works so I can ship it. You just can't beat Swarm for building an insta-cluster that works well and quickly gets you where you want to be. I'm sure kubernetes is great if you have forty datacenters around the globe, but I don't, and neither does anybody I'm building services for.
Yep, I was actually debating whether I'd mention sendmmsg/recvmmsg in my original post but I left it out. Definitely an option for UDP, but you're out of luck if your game server uses TCP (surprisingly many do) because you have to recv from each socket separately.
Vulnerable to Spectre, yes, like nearly all speculative execution processors. The PS4, XBone and Switch are very likely vulnerable to Spectre all the same but that will probably mostly affect their web browsers.

None of these is vulnerable to Meltdown. That is an Intel/Apple/ARM Cortex A75 only thing.
I would be fuming if somebody electrocute me, that's for sure; but much better than if they kill me with a rusty axe. That would be very impolite and unforgeivable.
This one has already more upvotes
I am not saying that people should throw out computers and live in caves. I am just describing a current situation which makes me sad.
Isn't "reader mode" available on some browsers almost a "no style" option? I use it exactly for that reason. I admit not every page is reader-mode-enabled but I just don't bother with those.
If you had to compare this to commando.io how would you distinguish the service?
There may still be some options depending on the structure of your server and where the added CPU load is hurting most, for example, shunting IO to a thread/threadpool where futex() calls (if necessary) only occur for every N IO requests, rather than pay the syscall price for every IO on the main thread. But that might introduce new latency/ordering problems all of its own
Dunno, a modern UK car will get 60mpg on motorway travel (that's what I've had), or even more. that's 50miles per us gallon. 2 passengers means 747 fully loaded efficiency, 3 wipes the floor.

Of course a 747 in a domestic Japan configuration will have more passengers than a typical BA 747 tatl flight with 100+ beds.
In case the author sees this thread: the time labels for the weekday graph are wrong. The morning peak shows at about 0400, when it should be around 0800.

The weekend graph might have the same problem, since it ramps up before 0600, which is unlikely.
It should be noted that we are still a very long way from creating a useful replacement for our olfactory system, our digestive system, our circulatory system and our reproductive system, among other things that make life worth living.
Whopper Coin: https://www.cnbc.com/2017/08/28/burger-king-russia-cryptocur...

Apparently some loyalty rewards for Burger King
In my experience btrfs is not suitable for anything.
Timeline with a sane date format:

2017-09-28 - Vulnerability reported to AMD Security Team.

2017-12-07 - Fix is ready. Vendor works on a rollout to affected partners.

2018-01-03 - Public disclosure due to 90 day disclosure deadline.
If it's helpful,

Our Node.js, MongoDB, Python servers all with significant network traffic didn't have any measurable impact after KPTI patches on Amazon Linux on T2.medium(burst), M4.large, T2.large(burst) respectively.

Our impact is lesser than the figures suggested by redhat's advisory - https://access.redhat.com/articles/3307751
There are dozens of ways to prevent this, viable because you fully control the hardware and software stack of the terminal (and only allow contacting servers of your choosing).

I imagine they are more concerned about game authors snooping keys or whatnot.
No. Docker for mac runs a Linux VM.
It's one of the better ones imo. It's used for a social cause and unlike many other coins, you can actually buy things with it.
My experience with academia is that it's a kindergarden. Everybody has silly personal 20+ year vendettas going on.
I'm not at all surprised that academics are unable to co-operate.
Since they describe this as log-in issues, should we expect that to be a server using lots of UDP? Or do you think that the log-in service is hemmed in by the load on the game servers?
Here are some comments from Musk regarding electric aircraft: https://www.youtube.com/watch?v=yx3auTD85Fw
You're not getting my point. I never said governments shouldn't pay for medical care. I'm saying there's a line where it needs to stop, and asking where it should be drawn. Sure, let's pay for cancer treatments. How much, exactly?

I posited a hypothetical scenario, which can get extremely real if we start looking at real situations of benefits fraud, and asked you how we should deal with that. Are you really saying that the government should just pay whatever I want to charge for my service that doesn't work? If it does work, can I charge the government whatever I want to provide it?

What you're not understanding here is that this, and every other example of asking the government to do things, is manipulable by humans and thus is an adversarial process. Because the government isn't God, it doesn't have truly unlimited resources.
Markets have better liquidity when all players are at the same time & place. It's possible that asynchronicity will come at the cost of liquidity - raising transaction costs.
Somewhat related: using the cache latency to estimate the CPU cache size.
https://fromwhenceitca.me/cache_size/cache_size.html
Spam!!!! Almost all the stars are from the throwaway/spam accounts!
Nobody is disputing that, so why even bring it up? Whether "secret hardcoded backdoor" is misleading was being discussed.