skysight-inc/HackerNews huggingface dataset:
Hubris.

I've been trying to wrap my head around for over a decade how these side channel attacks between L1 caches and branch prediction caches don't happen.

Wish I had published my November 2016 research into function call leaks. CPU registers leaking information between function calls is still a huge unmitigated issue.

You want to shit yourself, goose GCC or LLVM to instrument your function calls with a dump of everything in CPU registers before they start. Do this with libraries that people blindly link in dynamically.
Anything JetBrains does, emacs can be made to do. Someone should spend time extending it to do that, and share his work with the world.
You have not refuted anything I said besides implying that I am wrong. Again:

- You can turn off functionality if you do not want it.

- There are no management or remote access capabilities.

- The only way to compromise it would require compromising the main CPU anyway, and persistence would be a whole other (major) challenge.
It is an incredible failure of modern version control systems that distributed branching means that they're impossible for novices to use.

However, if you see github.com as a proprietary UI for git, it looks almost exactly like putting your files on S3 with some CRUD UI around it.
Except, Congress's ability to create a never-ending stream of new laws seems to be limitless. Maybe we should require a 3/4 majority and "slow" process to create a law but only a 1/4 minority and fast track needed to repeal one.
Who is “we” that should issue certificates?

The CA system is just a patchwork solution on top of something that is fundamentally impossible: trust between any arbitrary pair of humans.
I'm also looking at Raptor Hardware and I would love to hear the experience from somebody that uses it.

As well, I am not sure that POWER9 is immune to these attacks. And then, well, you still cannot buy their products, as far as I understand it from their page [1].

Does anybody know more about the Raptor systems?

[1]: https://raptorcs.com/
I assume the process will have improved since 2013.
You're essentially replacing a database and a CRUD interface, which doesn't have any of those features either.

I can't see how any of that is worth the extra time spent teaching git, or the extra complexity that comes along with merging your code and data into one repository.
The fact that it's available in Europe but not NA is a bit odd.
Social for the sake of "social" would indeed be bad, but features that actually help you discover new music via friends would be good.
>I learned to code in the era of 3:2 displays

What era was that?
These are all terrible arguments, sir. There is absolutely no way to make an argument that closed-source software is just as auditable or secure as open-source software. There will always be methods of trust required when you use things other people made, but when software is developed in a black box, with NDAs you didn't know existed, or 0-days known about for years, you simply CANNOT make an analogy to heartbleed. Heartbleed was one vulnerably in a poorly maintained OSS library. It is foolish to use it as your primary example of the failure of OSS security when there are tens of thousands of closed tickets on Github, Bitbucket and Gitlab to that would argue OSS is easier to audit and easier to openly discuss ihfosec issues.

By coming up with the same examples over and over again in lower threads you are coming close to trolling this thread and ought to stop and come up with a better argument for why a corporate system-on-a-chip system is inherently just as safe as hardware developed with open source firmware.
Wouldn't a good analogy rather have the effect of rationalising what's already ridiculous?
Many data scientists want to operationalize their models. If you don't work at a hip startup with a killer dev ops team, then you are likely at a big enterprise shop where relying on anyone else to handle your infrastructure for you is a great way to have 90% of your work never see the light of day.

I use Docker daily for my needs. It ensures that I can easily prototype a scalable set of services on my local machine, and then deploy it to a multi-node environment on AWS, Gcloud, or our on-prem infrastructure. Good luck developing a Redis-backed ML app without Docker when it comes time for deployment. You'll get it done, but it'll be a lot slower and more difficult than if you had used Docker or containers of some sort.

Edit:
Make sure to check out Yhat. https://www.yhat.com/
New prime on the block
I just did a "sudo yum update" on CentOs and I see a slew of firmware/microcode packages. Are these security patches ready to go already?
Yeah i've had issues with my XPS 15 9550 as well. I guess they have not been sorted in 9560 :( Once I customized everything (replace wifi card with an Intel based on, new battery under warranty, many many many BIOS fixes) it works well.

However, I would probably steer people to the Precision 5520 instead if you are going 15" and Dell. Comes with Linux and is business class which hopefully means less stupid QA issues and better tech support
If you're not in one of five metro areas where you can reasonably navigate without a car, they'll know you're a liar and a scoundrel, and will do nothing about it.
I'm also interested in some elaboration of this scheme. While I'm less interested in ORMs etc, the advantages/disadvantages would be useful to compare to some recent thoughts I've had regarding the use of databases.

Professionally I have little use for RDBMSs, however recently I've been working on some side projects with a focus on flexibility and modularity that have changed my perspective on how databases should be used. Formerly, I (and I assume many newcomers) had a database driven approach where the database structure came first, and code grew around that. This reduces flexibility because your data is all coupled together, which will force refactoring of data when your storage configuration changes. Data refactoring sounds like a thing of nightmares, but ability to easily migrate data between a RDBMS-backed module to a redis-backed module with minimal fuss is the kind of flexibility I'd like to have.

The alternative that I've settled on is to begin development with the notion of a generic 'data store' and later fitting a database around that. Though I am yet to see the scheme come to reality, I believe this will reduce data coupling, increase testability and debuggability for both code AND data associated with a given module, and increase migratability of the data. This has also pushed me toward the exclusive use of integers for IDs as they can be considered universally supported with minimal effort, which has me curious about further benefits of different ID generation schemes.
Then it's because you don't know how modern cloud works.
Ask HN: Three questions about the CPU security issue
I have opinions about these but since I don't hack for a living I'd like to get more current opinions. Answer one, none, or all as you see fit:

a. Do Intel's security woes stem from the same things that gave them a consistent speed advantage over AMD;'s processors? In other words, has Intel been trading security for better performance this whole time?

b. While x86 is fr and away the dominant architecture, performance hits of 20-50% (depending on who you ask in relation to what task) seem likely to upend the industry. What do you think this means for competing architectures like RISC/V?

c. These attacks look relatively easy to weaponize and hard to detect forensically. Almost everyone is vulnerable and simultaneously has the excuse of having 'been hacked' for anything they'd like to escape responsibility for (oversimplifying for brevity). How would you expect these incentives to manifest in the real world?
Online/Scaleway also build their own servers and were impacted by the Atom bugs/issues where Intel were apparently hard to work with. There's reason for the resentment.
A common security issue I've seen with uses of JWT doesn't have to do with JWT itself but how it's used by front-end developers. It's commonly stored in localStorage instead of an HttpOnly cookie, which creates a cross-site scripting vulnerability.

More details here: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...

Shockingly, the advice I've seen to protect against this by folks like Auth0 is "keep your tokens expiration low" or not mention it at all.

I don't imagine PAST gets around this, as it's more like misinformation around the storage mechanism, but I think it's worth mentioning in any "how to use" section about PAST or JWT.
Does that mean we don't need to rush to patch it?
11 React Component Libraries You Should Know in 2018
I'm building a user-friendly database interface for postgresql https://github.com/ivanceras/diwata . It is a very complex application, but rust and elm helps me build it with ease.
The X220 has the superior keyboard and really isn't underpowered unless you're interested in gaming. Coreboot allows all sorts of upgrades beyond the OEM firmware.
16:10 vs 16:9 is very noticeable for me at screen sizes below 15 inches and 3:2 is even better.
So what they're saying is that it was designed with a fault from the beginning. Or maybe we are just using it wrong?
From the perspective of Intel, as well as most of the microprocessor industry, yeah. Even "broken in reality" is arguable: while this is indeed an exploit, choosing performance over security (when the resources to implement a chip are finite) is a legitimate design tradeoff.
Why do they only offer 1080p and 4k? Something in the middle makes much better sense.
I'm disheartened by the number of comments here who are taking the stance that Intel has idiot designers or that management doesn't care about security. This attack is very clever and unexpected. Even though side-channel attacks have been talked about for awhile, even the guy who developed Meltdown was surprised that it worked. It just seemed like an "in theory" security hole, not an exploitable one.

AMD isn't vulnerable to Meltdown not because they foresaw this issue, but probably because they simply weren't as aggressive as Intel in allowing speculative execution. For years people have preferred Intel over AMD cpus due to their performance advantage, due in part to that higher sophistication of their pipeline.

Or to recast it, nobody is hating on AMD right now, but AMD CPUs do allow a user process to learn some things about the kernel via timing attacks. If next month a researcher develops Meltdown2 for AMD, are AMDs designers now suddenly idiots for missing an obvious security hole?
How? what is there besides running pip?
This 3% or whatever from 0.5^n is a lower bound. To get close to it, all your other relatives would need to come from completely somewhere else. But in reality, many of your other ancestors were probably related to him, because they had lived in his valley since they invented farming, or whatever. So you probably have some more of his genes from several great, great, great grandmothers who were related to him.
Good points.

More fundamentally, it feels a bit screwy for a multi-faceted 'project' to live wholly inside $GOPATH in the first place. But at the same time, it's natural.
If we ever create life from nothing, identify conditions where that would happen,estimate number of locations Galaxy that would have planets with said condition...surely that would provide scientifically informed estimation of extraterrestrial life.
> I my case it adds up: Slack, Docker CE (that spins up a VM on Mac) for tests, corporate Docker EE setup (runs alongside Docker CE), elasticsearch, kafka, and 9 more services inside that corporate Docker setup, two Chromes (Chrome Stable and Chrome Canary), multiple VSCode instances. And if you need to build something with boost or folly you can add 3GB ram just for that.

Sure, but any Ultrabook is going to struggle running all of that, and more RAM isn't going to help by itself. You can run all of that on a Macbook Pro, but not a Macbook Air; the XPS 13 is intended to be comparable to the Macbook Air.
> There are only two hard things in computer science … cache invalidation is one of them.

I mean, it's a pithy saying, but TTL invalidation is a problem you have to solve with JWT too. Caching tokens is the easiest possible cache invalidation problem: definitionally, you know a priori exactly when the token is invalid.
Ok, 4:3 displays. You get my point, more square displays than 16:9.
Temporal backpropagation?
But did they fix the key repeat issues ?
> 4004 -> 8008 -> 8080 -> x86

The progression is more interesting than that: it's Datapoint 2200 -> 8008 -> 8080 -> x86. The Datapoint 2200 was a "programmable terminal" (really a desktop computer) that had a CPU made from TTL chips. They got Intel to make a MOS version of the processor, which was the 8008. (TI made a MOS processor for them too, beating Intel with the forgotten TMC 1795.) Because the Datapoint 2200 used serial shift-register memory, it needed to be little endian, and that's why the x86 is little endian.

Also, the marketing names make 8008 sound like an 8-bit version of the 4004, but they are really unrelated. The 4004, for instance, wasn't even von Neumann.

https://en.wikipedia.org/wiki/Datapoint_2200
The verify is getting a runtime error
Thank you, that's already quite helpful!

But how to end up with actual music/a melody doing this? Do you manipulate the sound live? Do you record different samples, made that way, and stick them together with a sequencer? Or do you switch between different, predefined, patches on the fly to kinda "play" it like an instrument?

Sorry if these questions are basic, but this has always fascinated me with synth music: Creating beautiful melodies out of something that starts out pretty much just as "noise", it's kinda like magic.
> I mean, who uses touch screens for development?

Co-workers are less likely to touch it and leave marks, that's the only upside I see.

> I am otherwise actively looking for a laptop.

I got a X1 Carbon a few days ago. I'm pretty content so far.
> From Jeff Dean's list of numbers every programmer should know[0], a round trip within the same datacenter takes on the order of 500,000 ns; a main memory reference is on the order of 100 ns. How often will an application be making an order of magnitude more than 5,000 main memory references to service a request? Sometimes, sure.

That argument is only valid if your application doesn't touch disk and doesn't touch the network to go talk to some other service anyway.

Do you have a concrete description of what "online validation" specifically means for you, and how long it takes? How long does validating the token take instead?
Exploring (lack Of) ISP Diversity at Street Level
This is a fantastic question and should be higher.
How did people get access to unreleased software?
The main reason for putting touch screens on laptops is that Windows 8 - 10 have an interface that is designed to be tablet friendly, at the expense of being desktop friendly. So it is easier to do an occasional touch gesture to do certain things. Also, things like kinetic scrolling is easier with touch. With a mouse, you have to click the button, move the mouse, then unclick while the mouse is sill moving. Much easier to just flick the screen with your finger.
On Ubuntu?

I dual boot with windows and while your statement is 100% factual with Ubuntu, it seems to be better handled on windows. This appears to be a software issue; admittedly one which I think that they should be dealing with as a matter of urgency.

At least disable the thing while typing, Dell.
They didn't have time to finish painting the set, obviously.
I'm curious what those 5 metro areas are. (NYC is one, obviously.)
I don't really follow how you think this would prevent someone from building back their house if it burned down. As far as I can tell, the idea isn't to force property owners to build taller buildings. It's to not force them to build shorter buildings.
> USB-C is the superior connector: longer lasting, reversible, works for charging, alternate modes, etc.

...2.4GHz radio interference leading to wifi dropout on many devices when USBC peripherals are plugged in...

Ok, it's not the connector's fault, but still. USB 3 has not been a problem-free advancement.
That's a fine example of a goal that isn't SMART. Not Specific, or Measurable in the least. Attainable? Good luck to you, Mark...although you have a ton of resources at your disposal. Realistic? Probably not. Timely? Yes. Very.
When did the change happen? For instance, my sixth great grandparents were farmers in the mid west (Missouri). They had 12 children of their own. So, for my family, the poor having fewer children than the rich probably would have happened farther back than the late-1700s/early-1800s.
it took a really, really long time to transform wild plants and animals into useful domesticated varieties.

Really? The wild plants and animals were already useful. So from day one, the transitional forms to the domestic varieties were useful as well.

Without those, you really are better off remaining a hunter-gatherer.

There's not a sharp division between hunter-gatherer and agriculturalist. Sedentism preceded agriculture. As people accidentally dropped seeds around their dwellings (or discarded them with the trash), they gradually became gardeners and then farmers.
VJWT: Versioned JWT
Your mistake is in thinking the null hypothesis is that a species-wide, complex morphological feature is non-adaptive.
Hopefully Unix will be 100 years old someday.
I cannot say why he is downvoted but there are some mistakes in his comment. First, there would be 47 shareable elements as you have 46 chromosomes plus the mitochondrial genome. And then, any of the 46 chromosomes (besides the Y chromosome in males) can and do exchange segments with its homolog/sister chromosome of the same type (crossing over or recombination). While this does not happen all the time, it does happen, so you from some points in history you are inherating your genome from many more ancestors.
Thank you for this! I am still not fully on board with mixing my JS and CSS and when I dove into the source I was eager to see how you were handling it -- The webpack docs and tutorials are lacking when it comes to outputting separate CSS bundles and staying old-school.

This solved all my issues and is doing exactly what I want. Seriously, much appreciated!
They're still teaching them about branches, pull requests, commit messages, merging, and build statuses.

Not to mention that mixing data and code into the same versioning system adds complexity that I don't think is maintainable.

There is a reason we tend to version data separately from code.
I mean... yes?

Why would it be any different?
Seconded. Build quality on the 9360 isn't great, trackpad and keyboard leave much to be desired for a high-end laptop. CPU seems to be throttled to deal with overheating, so performance just feels lacking.

Coil whine, stability and WiFi (terrible at first) have improved after some BIOS updates this year. Also my trackpad has stopped rattling, probably dirt got into the gap and plugged it.

Dell customer service experience was also poor when buying. Next laptop I'll be going back to Lenovo.
Coil whine can easily be tested with this website (probably not a good link if you have epilepsy or Chiari malformations)

https://thume.ca/screentunes/

In my experience virtually all LCD displays have it to some degree, you just don't notice it except with certain patterns (like that one) that interact with the scanout mechanism.
Why does it matter if they can cause the CPU's predictors to guess incorrectly if they can't control the target address of the branch or memory access?

Example: "if (a < length) return data[a]". If "a" comes directly from JavaScript then they trick the CPU into fetching data[a] even if it's invalid speculation and thrown out. But if there's a safe barrier between "if (a < length) { prevent_speculative_execution; return data[a]}" then they cannot learn anything.

I concede that safely checking all data coming from JS code to the browser would be a huge task, but pretty sure it would work to fix the problem for JavaScript although not in general, between processes with shared IO pages and such.
They have deliberately hobbled Apple maps, Safari, Siri, and anything else that would be enhanced by big data for the sole fact for a secure experience .

They created Identificaton systems that are easy to use and deployed them to all iPhones .

If there is any company that actually cares about not monitoring your behavior it is Apple. They have the best track record comparing it to other big players .
Why Do We Need to Sleep?
> CPU registers leaking information between function calls is still a huge unmitigated issue.

How is that a security issue? It's in the same process.
> The reason 16:9 displays are now common is not because of movies. When they came on the scene most people said "Wow this is nice."

What's so nice about them (besides of course for movies)? Most content consumed on computers is textual (websites?), so why would you have something wider than taller?
"Those millions of potential eyeballs didn't find the Heartbleed bug."

Sorry, how would we be talking about it if they didn't find it?
Oh it would be, but we’ve known for centuries that the holy prepuce was actually...

According to an unconfirmed 19th-century source,[14][15] in the late 17th century the Vatican librarian Leo Allatius wrote an unpublished[16] treatise entitled De Praeputio Domini Nostri Jesu Christi Diatriba (A Discussion of the Foreskin of Our Lord Jesus Christ), claiming that the Holy Prepuce ascended, like Jesus himself, and was transformed into the rings of Saturn.

https://en.m.wikipedia.org/wiki/Holy_Prepuce#Literary_allusi...
They should, but I thought it was some sort of chipset limitation due to the usage of the low powered (laptop) Intel chip line. Which is why all these ultrabooks (under 15") have 16GB ceilings...
Life with Donnie
I recognize the positive spin, the fact of hardware vulnerability is still little understood, and the trust placed in the cloud ecosystems is almost absolute. I'm aware that I would be planning to go on a Microsoft like security commitment and the sheer resources available to Intel if concentrated on the silicon features capable of e.g. detecting a miscreant hypervisor look like the next wave of products and marketing. To achieve this spin, however, Intel needs to day much more than they have. They can maintain their current line but score points with sceptics by demonstrating how some attacks work on Intel processors in the wild. Coordinated with Industry wide patches, making more point which is missed here how Microsoft and others patched branches in November, the wrap is to offer all customers running on vulnerable silicon migration and s performance bump. This is not a cheap process, but the political climate almost demands resolution at this level.
This is somewhat orthogonal to the security goals I'm trying to tackle, but still very relevant to the ecosystem that currently uses JWT.

So I've opened an issue to address it before v1.0.0 is tagged: https://github.com/paragonie/past/issues/14
It's worse than that. It turns imaging data (illumina basecaller) into sequences, aligns them, turns them back into images (nucleotides go into the same channel for some reason), THEN uses 100x more compute to get a questionable 1% gain on indels.

Why.
I read this as saying "our lawyers do not want us to preemptively strengthen the case for legal liability for damages", and as being completely independent of plans for mitigation or future product changes.
AMD did things the right way competing for performance without sacrificing security. What's happening right now are the consequences of Intel's actions.
I think it's gotten better but if I want to get to a place and trust that I can get to a really hard to find place I use google maps. From a user's perspective I agree. But if Apple could or did, I'd use Apple's search engine over Google's (a la the use case for duckduckgo), just so I wasn't funding Google. But I make compromises like anyone else.