skysight-inc/HackerNews huggingface dataset:
My father was in AA, and I'm reasonably sure it saved his life, or at least lengthened it substantially. It was a major factor in getting him out of a spiral of depression and business failure.

For him, it put him in touch with a community that understood his depression (in a way that I, in particular, never did), and helped him work through that. Stopping drinking was ultimately almost incidental -- it was the initial goal, obviously, but that was only the beginning.

He also said he saw a lot of people come in to the program because they felt like they needed to tick a box labelled "recovery". Some of them had been sent by the courts as a condition of getting visitation rights for their children, or by well-meaning marriage counselors, or to prove to themselves or others that recovery was impossible. Very few of those people stopped drinking and changed their lives. If ticking the box was their goal, then arguably it's a success by that metric, but by the program's own goals, of course it wasn't.

From his point of view, AA is a tool, if you want to change your life, you can use the AA steps and community to do it,
and your odds are fair, although of course there are no guarantees ever.
I still don‘t get how variant 1 is fixable with negligible impact. Do we have any details on this as of now?
IIUC it's not possible to opt out at this time (short of reverting the patches). Linus expressed some concern about it: https://lkml.org/lkml/2018/1/3/797
MS Edge fails both the Acid 1 and Acid 2 tests on my computer :)
I wish Google would just adopt spot prices like AWS EC2, where you can look at the 3-month spot price history to estimate cost and to discover combinations of availability zone and instance type with extra capacity. GCE’s preemptible instances are “easy” in that there is no spot price to bid, but the downside is the total absence of information, since there is no way to look up capacity once your instance is shut down.
i guess at minimum it's worth asking how many major hosting providers have been fully patched at the time of disclosure. in addition to browsers and OSes.
We are going to see more of this sort of thing. The elephant in the health-care costs debate is, ironically, that we are becoming much more capable at it.
I wonder where that leaves Java, C#, Node.js etc. Do the VMs generate code that suffers from this?
I would love this as a service for generating fake users.
> It may even be time for dedicated kernel cpus/cores.

Oh yes, I agree! One needs to be able to phycically (un)lock the "kernel fpga" like a door without remote capabilities, except for server cpu's. Or whatever chip designers believe is a good "physical kernel embodiment" other than fpga.

EDIT: I know it's not really clever, but I would really enjoy hearing any solutions that doesn't try to fix it at the hardware level.
My company still actively uses it in production and development
Micro-interactions: a complete beginner’s guide
if youd like to cut past the fanboy fluff...
https://en.wikipedia.org/wiki/Apple_mobile_application_proce...

The Apple T2 chip is a SoC from Apple mainly serving as a secure enclave for encrypted keys in the iMac Pro 2017. It gives users the ability to lock down the computer's boot process. It also handles system functions like the camera and audio control, and manages the solid-state drive.
Not a legal opinion:

Seems like it would fit under Fair Use in USA but wouldn't be allowed under UK's Fair Dealing; I can't comment on other jurisdictions.
Qualifier: I'm working off articles and a few computer-architecture courses from college, so don't trust me too much here.

Taht said... Branch prediction and TLBs have been ubiquitous since about 1975. We're seeing vulnerabilities in ARM processors with unit costs of a tenth of a cent. We don't have to go that far back; if nothing else our toolchains and manufacturing techniques are far better. But if we're forced to discard speculative execution as a concept, which I think may be necessary to entirely prevent side channels, we'll be going way, way far back. Further back than the Pentium 4.

Fundamentally speaking, the power of out-of-order execution is not one of engineering. It's not like object-oriented programming or version control in that it simply makes it easier to engineer fast processors. It is more powerful on a fundamental level. And there's been so much theoretical and practical work put into it over the decades that it may take more decades to bring a different mathematical formalism up to the same level of development.

Let's just say that I really hope we don't have to throw out out-of-order execution. It'd suck. Hard.
How can the government investing too much money into infrastructure cause a decrease in the total amount of money invested in infrastructure?

It is self contradictory logic.

Price controls, such as what happens in the electricy and water market might cause that. But the government getting into the game, and spending more money on infrastructure wouldn't....
A lot of Maxim's offerings, at least, are startups that they acquired. That seems to be a large chunk of their business model, acquire rather than put in all the R&D themselves.

The specific chips I know of have ARM cores in them.
It is a religion - they say its not - but you can literally say anything you want - the fact is that it is religious - it is a faith organization with prayer and supposed relief from a greater power and this idea that you are powerless- it is ultimately dysfunctional and like any religion benefits those that it benefits and doesn't those that it doesn't. I saw something where just natural people using less is better than active attendance and a good network of friends is what is working that and just not using - This is the whole thing where sometimes a faith does some good.. but really sometimes when addiction really is a mental health issue you need mental health professionals and hospitals and ways to protect society. NA and AA are part of that but not integrel and not even the best. The best thing is to treat the conditions that create it to focus the person on ... fucking cognitive behavioral stuff.. Oh and let everyone know that abstinence is is part of the problem not the solution. it looks like a solution but really you are just treating a symptom. I swear you make "relapse" so much worse than if you just had a drink - and if you are old.. older than 45 alcohol is terrible it keeps you awake you cannot drink less than 5 hours before you want to go to bed so no after work drinking.. got to get started in the morning and be done by 3 pm on weekends. That is life. - say you have 10 years of Sobriety - you are not going to be the same person when you drink again - your body is different - yeah drugs are a problem but religion is not the solution its only part of the problem and so is abstinence
Nothing about how it relates to the multivariate Gaussian distribution either.
The term is ominous because it is the common description of what happens when the core of a nuclear reactor overheats and melts. The theoretical result is a molten puddle of fissioning material that melts through the containment vessel then continues down into the earth.
Ok, now postulate that we can only invent things on the border of that map (because of technological limitations). Then you'll get a very complex dynamics, of the invention possibilities increasing and decreasing, some times fast, and changing almost unpredictably.
I doubt that a streaming provider would be able to starve out interest in third party music. Most active choice music consumption is essentially a nostalgic act, even when searching for the latest hit that you heard at that party last night. Music preference could almost be considered involuntary.

An "original content superspotify" would have to dominate all channels to ensue that customers are rarely overcome be the desire (and the resulting dissatisfaction) for third party music, or restrict themselves to the subset of the market that is never exposed to channels not under their control. Both of these options are what I would consider a likely base for economic success.
How virtual reality and biofeedback can improve meditation experience
CPUs should have a single instruction that wipes branch prediction caches. I would have it off by default, and add to the C/C++ spec this as a standard library macro or pragma. Easy peasy.

You only need to wipe between syscalls that have side effects. Number crunching AVX heavy subroutines should never have to deal with safety once entered.
This is kinda similar to GraphQL. I like this approach more though.
so i bought my cpu a few months ago. will intel replace it for free?
Conditional enum variants in Rust
Continuous Growth, Geography Extension and Technical Excellence: Plans for 2018
I'm not quite sure, but I think I remember reading that CoW (Copy on Write) was not there in the earliest Unixes. Might have been implemented at Berkeley some time later. Seem to remember reading this some years ago when reading about fork, because without CoW, fork's copying was expensive, particularly if you were going to exec another program in the child just after forking.
Good to read something positive about CPU technology today :). Beyond the obvious improvements for securing the computer, it is very interesting to see how the T2 chip not only operates the camera but most of all also works as a hard disk controller. So the "CPU" of the computer might be Intel still, but it is a bit of a guest in a system that is in fact controlled by the T2 chip.

As the T2 seems to basically the iPhone CPU it also shows how great a hardware is in current phones now, if using that chip creates a faster flash memory controller for the biggest Intel CPUs.
Bow New Hampshire
I've been reading up a bit on these attacks and I was wondering if there are any particular requirements to implement them in an arbitrary language?

For example, can you implement the attack with Java but without JNI? i.e. are syscalls required to be able to leverage the exploit?
Are Intel's 8th gen processors affected by Scepter and Meltdown?
This might sound silly, but to get a position at Google is it mostly experience or just white boarding practice?

Is it possible to go from new grad -> first job -> Google? By that progression I mean what sort of background is required language/stack/etc aside from studying and practicing?
what's the life/balance if any like? is it super high stress like is reported?
https://meltdownattack.com/

> Why is it called Meltdown?

> The bug basically melts security boundaries which are normally enforced by the hardware.
What Fitbit's 6B nights of sleep data reveals about us
I find it funny how, even after publishing this post, the author hasn't configured a http -> https redirect for his own site.
I give 2-3 phone interviews/week at Dropbox, here's some advice
I'd love this built in. It would work better than anything I could create!

But until a feature like that exists, I'll stick with mine.
In the good old days everybody just used HTTP, FTP and telnet and NIS. Old archs also has other bugs we forgot about / never discovered.
Just one antidotal data point, but I haven't had to think about SIP and I updated my OS soon after it was released (I did wait a few months for any issues to surface). The only near-concern I remember was the directory Homebrew used, which either was a non-issue or was addressed over the course of updates. I didn't do anything. I feel like through the course of work I would have hit corner-cases caused by SIP or other macOS "protections."

Out of all the protections added over the years, I only really regularly encounter GateKeeper. I don't generally mind because I know what it is. I don't feel like I'm limited by these things, they feel more like running as non-root user and having to run "sudo" when needed. It makes sure anything silly I might do is done intentionally.

I've had way more issues with SELinux than anything Apple has added to their OS.
I really wouldn’t worry about it too much at this point. The cat is out of the bag; there’s waay too much legitimate money involved in the weed business now, especially in California. There are a dozen storefronts within a few miles of me right now. California, Oregon, Colorado, and Washington are recieving hundreds of millions of dollars in tax revenue. On top of >60% public support for legalization, all the feds can do at this point is sit back and watch. It would be a governmental overreach not matched since the days of internment camps if they were to attempt enforcing federal law around this, not to even mention the political suicide of siding with the few people who still support prohibition.
The Biggest Technology Failures of 2017
Why not use melpa-stable?
>Cortana or Siri exist without obvious nefarious purpose. //

It's not nefarious, but what happens if you ask a question like "open a website where I can buy music" or "find me a powerful new computer", or whatever. Is there no bias in Cortana/Siri towards MS/Apple? How about if you ask "is Siri or Cortana a better voice assistant?" ...
It only tells us that Microsoft prefers for whatever reason their own NT kernel, "Fact that WSL is a subsystem to NT kernel" tells you nothing about the quality of the BSD kernel.
I haven't started playing around with Rust yet, but I'm interested in it.

If you're using Rust -- tell me, what are you building in it? And what do you love about Rust in your experience while building it? (Get me excited)
"The Red Hat Performance Engineering team characterized application workloads to help guide partners and customers on the potential impact of the fixes supplied to correct CVE-2017-5754, CVE-2017-5753 and CVE-2017-5715, including OEM microcode, Red Hat Enterprise Linux kernel, and virtualization patches."

The numbers seem to be for patches on several Intel CPUs for all three of the disclosed vulnerabilities. [reworded]
After 15 years of class action appeals, you’ll get a voucher for $15 off of a retail-packaged processor.
> they didn't have the cycles to write everything down!

hahaha that was a good pun! Do you have a link to Jann Horns personal blog or Github? I've not never heard of him before.
Ripple co-founder is now richer than the Google founders on paper
Comments moved to https://news.ycombinator.com/item?id=16068163.
Reading Kernel memory (Meltdown attack) is extra bad but regular user processes being able to read each other's memory (Spectre attack) is also very bad and not solvable by isolating the kernel.
So... it reads a string that was declared at the top of the file?
OK, i'm glad you weren't meaning that: many who say such things do, and perhaps I was cautioning by inference. Good point re authoritarian pseudo-democracies. what counts as representation is a difficult and complex issue.
Spectre relies on tricking the CPU into branch predicting its way into accessing protected memory, no? Is it not possible that we can keep most of the performance benefits of speculative execution by somehow having a built in "Hey, never ever speculate that I'll want to access this region of memory" sort of thing?
Assuming the compiler knows what it's doing :)
> It's "not very good" not because people are this or that...

Denying reality is for daydreaming; it will not get anything invented. Sufficiently advanced technology may be indistinguishable from magic, but it isn't actually magic.
This is true, and so far, nobody has a better idea.
(IE i would expect that unless someone comes up with one, that hardware CFE in its current form dies and won't happen for Intel until the processors are changed in a way that mitigation is not needed)
Aviation-grade quality and testing for SQLite
Porting roguelike game to WebAssembly
One related thing that might be of an interest to you is to check out https://www.rust-lang.org/en-US/friends.html ; many of our production users have linked blog posts explaining more details about what they're doing.
By default, they start out at the highest level of security, assuming an always-on network connection. It can be adjusted downward, which those of us reading HN are likely to prefer.

Signature verification alone may confirm that a release is from Apple, but it doesn't confirm that the release hasn't been superseded due to security issues. (Or marketing, if you're conspiracy-minded.)

The "Medium" setting allows older versions of MacOS, so although the article doesn't say, I suspect that is doing signature-verification alone, and does not require a network connection.
> On most Macs, there are discrete controllers for audio, system management and disk drives. But the T2 handles all these taks. The T2 is responsible for controlling the iMac Pro’s stereo speakers, internal microphones, and dual cooling fans, all by itself.

Translation: T2 is a southbridge, but this time with a camera controller, and a TPM in addition to the normal disk, audio codec, peripheral bus, and GPIO functionality.
Which one did OSX partially protect against? Also, which one allows JS execution to activate the attack?
Wasn't Intel's transactional CPU Memory the solution, but it also failed to to bugs?
I would also assume this means exploits on a machine provisioned with multiple VMs from different customers would allow a malicious customer to leak data from another customer's VM located on the same machine.
New evidence that America was populated ~20000 years ago
Pretty well, thanks. What I'm wondering is: The attack is using the data fetched into the cache from a speculative indirect jump to do a timing attack and discover what's in the former, correct? Why can't the CPU mark the cache area it fetched in the speculative jump as "stale" and discard it? Why wouldn't that fix the problem?
This library is a great example of clean and beautiful php code out in the wild!
Thanks to incidents like these, I'm very happily employed. One of the perks of working in infosec.

I hereby nominate 2018's song to be Billy Joel's We Didn't Start the Fire.
FWIW, as someone who currently resides in a recreationally legal state (Oregon), everyone I know who uses marijuana both medically and recreationally chooses to do so with legally purchased Marijuana. It's more convenient, safer, and typically higher quality than an non-legal state.
What you need are some use cases. Imagine going to a website that had some JS that could read memory of that browser process. I'm not sure what's in Chrome's memory and the process is shared (without site isolation enabled) by iframes and referring pages and what not IIRC.

But basically, imagine you could go to a certain website and they could open bankofamerica.com in a hidden frame and if you were logged in, they could possibly find spots in memory that had that site's information. Or Google, or Facebook, or whatever. Could be worse depending upon how Chrome's password manager stores passwords in memory.
There's no such thing as app ideas
Whether we want a computer which can think like a human is a separate question. The Turing tests is only concerned about whether we have such a computer.

Of course you can redefine the word "thinking" however you want, and state that a GameBoy can think according to your definition. That does not really teach us anything though. The point of the Turing test is we have no objective definition or measure of whether some entity "can think like a human" or not, so the best we can do is to test if it appears to think like humans. That is not saying anything about whether is is "good" or "bad" to think like a human. I am certainly happy that computers and machines in general does not think like humans!
"The real solution to opioid death is adequate treatment for pain"

Like.... medical marijuana?

Hard to believe you wrote those three sentences without putting two and two together.

Regardless if I partially agree with you, further criminalizing marijuana is also NOT the solution to opioid deaths.
Flamegraphs and benchmarks
More about Secure Boot: https://support.apple.com/en-gb/HT208330
Every modern compiler usually has extensions that allow for bits of assembly to be inserted alongside the usual C or C++ code.

Unless the compiler is also patched to either disallow inserted assembly, or to modify the inserted assembly (this being both hard and dangerous), someone who wants to exploit the bug will just add their own inserted assembly code that exploits the bug, and a patched compiler won't help one bit in that case.
What do you mean with that? All js I get via websites is source code. Often minified but that can easily be reversed.
Congrats Phill and Max! Glad to see some Toronto exits.
I put a note about spot instances at the end (the economics of spot instances are a bit tricker for calculating cost-effectiveness due to price variability).

Although the cost of a K80 preemptible instance on GCP is now close to the approximate cost of a K80 spot instance on AWS, so there's a bit of competition.
In all fairness, they disabled SharedArrayBuffer and diluted clock precision, so afaik the JS attack vector can be eliminated for patched browsers (FF did the same).
I'd rather have linkers go down a similar road that the Linux kernel went on a over a decade ago: provide binary patches in a table (essentially alternative machine code) and have the linker patch the correct alternative depending on the CPU and it's bugs. The Linux kernel already contains an "alternatives" segment which is exactly this kind of list of patches. It would be trivial to add such a table to ELF and PE formats and have the runtime linker process that while it's plowing through the code anyway.
Ubuntu anouncement on Spectre/Meltdown
That is why there is a big fuss about it
Agreed. dlopen() should wipe branch prediction caches by default, we need to add additional flags that turn this off.
Hi, the main focus of the post was not to totally focus on geometrical interpretation but rather on why we use eigenvectors and all. I could have made it simpler, had I chosen to represent all of them geometrically. Thanks for your review, I could have done better.
Deploying to AWS in 2018: Dockerizing a Rails App
Race does play a huge part, BUT I don't think it's all about race, I think part of it's also about the elites vs poor... elites always have access to drugs without enforcement when they choose or want it.

Poor people are the ones hurt most by drug use/abuse the ones put in jail/etc.. it just so happens poverty is higher among minorities and so it does affect the black population more...

From a party-line standpoint this has almost always benefited Republicans (hurt minorities) because majority of minorities vote Blue.

Thankfully he's allowing U.S. attorneys to make the decision and HOPEFULLY most of those will make better choices on how to prosecute or NOT prosecute legal marijuana sales.
The youtube video says:

"This video has been removed for violating YouTube's policy on spam, deceptive practices, and scams."

LOL!
Note one of the mitigations for this is that Mozilla (and I'm guessing other browsers) is reducing the resolution of performance.now()
>there's no shortage of clever hackers in the world.

Are you sure?
> The original coordinated disclosure date was planned for January 9 and we have been driving toward that date to release fixes. Due to the early disclosure, we are trying to accelerate the release, but we don't yet have an earlier ETA when the updates will be released.
As someone specializing on a different field, this comment reads to me as if you were an astronomer being excited about discovering a gigantic meteor heading towards the Earth :)
No KPTI does not address variant 1.
Kubeflow: Machine learning comes to Kubernetes