skysight-inc/HackerNews huggingface dataset:
Link to the powershell script for those who need it:

https://blogs.technet.microsoft.com/ralphkyttle/2018/01/05/v...
Did Intel ever specifically 100% promise a certain performance in their advertising? Do they have contracts having such promises in them with vendors?
Nice! What usb dongle are you using for Wi-Fi, if you don't mind me asking?
Data processing where number crunching is the key problem may not be affected much. Data processing where fetching and assembling the data from many sources is likely to see larger slowdowns. Pure communications workloads are also likely to see larger slowdowns.
The Top 66 Developer Resources from 2017
I think people are underestimating how bad webapps are. I do... a lot of computing and by far the most CPU intensive applications on my computer are webviews. Either Gmail in chrome or slack. I'm actually going to be upgrading my laptop soon because slack+3 organizations crushes my laptop.

Do you think browser vendors have been pushing JIT research forward, investing in webasm, and building things like servo because websites are so fast and light on CPU?
They did mention that they were using a cloud provider. But that’s about it.
chrome://flags/#enable-site-per-process is a mitigation that at least raises the bar a little. :/
To me, one of the interesting bits there is the accidental timing of a comment.

From https://www.krackattacks.com

> We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

Note the date there that de Raadt was commenting on the discouragement of sitting on a fix for a month. What is the likelihood that he would be very discouraged to sit on it for six months? What if it was a three month embargo that changed to a six month embargo - when would the fix be released?

I would assume that those are questions that need to be asked prior to notifying a project.
So, I guess microdosing LSD is making people in Silicon Valley a little confused...
Works fine on mobile.

Until it's fixed you can probably just narrow your browser window until the hero image moves from the side to the top.
For the era, 64 megs was considered incredible.

For comparison, my first Linux box (a 386SX, 20 mhz) had only 4 megs of RAM.
IANAS, but I do not believe that immunity will be a gating issue - pretty straightforward solutions on that front including 1) ex vivo treatment 2) tweaking Cas9 to make it undetectable by the immune response 3) varying the Cas9 variant 4) Cpf1 orthologs 5) nanoparticle delivery 6) intracellular expression may not be inhibited 7) suppress the immune response 8) treating organs that do not engender the immune trigger (e.g. eyes). Some of the brightest scientists of our time are advancing the science daily, I would not think they would be stymied by something so obviously foreseeable and circumventable. This is definitely something to be addressed, but the recent headline and twitter echo chamber was dramaticized to maximize in-feed virality. Immunity is a distant third in terms of hurdles and already has clearly identifiable workarounds - efficient somatic delivery and enhancing specificity w minimal off-target impact are of far greater priority. Just my $0.02.
Brb, turning off all my cpus and gpus, can’t be adding more fuel!
Thanks! :) I didn't know about this
Right, that's what I was guessing and am not sure why I was downvoted when everyone is confirming that contrarian's post doesn't really make sense since UDP isn't very relevant here.
Someone please correct me if I'm wrong, but both spectre and meltdown seem to me to be local root exploits, not remote vulns. They can be used to break out of (say) a VM into the host hypervisor, and thence into other VMs running on the same hardware, but cannot be used to break into a machine from outside its hardware perimeter. Is that right?
I get the irony, but if you could magically visualize the entire internet security threat matrix, this would fall so far down the list and his other work is so high in terms of impact, that it would absolutely no sense for him to take even one minute away from his other activities to address this.
They do, and it's what runs the Intel ME.
There is a whole technical paper by Intel on this.

* https://news.ycombinator.com/item?id=16079910
Are there any devices offering a silent panic passcode? It would be convenient for travelers if "123456" unlocked the device and "987654" erased local information and unlocked the device.

That way a properly backed up device could be carried across a border with risk only of inconvenience, not of data loss.

(The passcodes I showed are my passcodes. :-) Nobody else use them, OK?)
> I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems.

> um. This is as radical as taking a stand that the sun sets in the west.

If all you're picking up from this is the emotional component (aka "outrage"), I think you've missed the point. The larger problem now is that Intel (in this case) consciously chose to ignore serious risks for their customers and is currently doing their best PR job to downplay the impact of those risks now that they have been exposed.

The reality is that these bugs are potentially catastrophic. But maybe we are supposed to simply accept that that is part of the risk of living in this modern world.

When large corporations make serious mistakes that are predictable and that others publicly warned about, they deserve all the criticism that comes their way.

My question is why anyone who doesn't work for the PR department of one of these corporations feels the emotional need to defend them from justly deserved criticism? They didn't include all the responsible stakeholders in their mitigation efforts, that decision put the users of those OSes at risk, and so the developers of those OSes are pissed about it.

Why is that unacceptable to you? Why do you consider that to be "wrong"?
Part of being a working conservative today is "might makes right", "the ends justify the means", and "the weak lose while the strong win". "Lying to get what you want" or "working over those rubes" is basically held as a virtue.

Through this lens, the point of having a conservative news outlet can only be to use it as a lie broadcasting machine.

I'm pretty sure if Peter Thiel has something to say, he has the resources to get the message out. In this case, he just wants a situation where there's a bunch of talking heads also agreeing with him as he talks because he is a total tool.
agreed. much ado about nothing here - already several avenues available to overcome any issues with immunity, if it turns out to be an issue at all.
I can deeply vouch for the performance and joy of implementing Full-Text Search with PostgreSQL and Django.

I just finished a a project where we chose Postgres's FTS over using Elastic Search. At the beginning, I was worried about what performance we'd see since we choose to not use ES. But after slight performance tweaking, we had even our least performing queries under 50ms.
It's OpenBSD, what else to expect? This is the result of them not respecting embargoes. All they have left is to vent.
Some places have no other choices for ISPs. I don't disagree that a VPN would help but that feels like it's simply dismissing that there's a problem.
No, he shouldn’t be seeing that regardless as it doesn’t match the grep regex. I don’t know what, though.

Edit: facepalm. Or should that be foot-in-mouth?
Charlie Munger explained something similar in investing. His dealmaking philosophy is “Look at lots of deals and don’t do almost all of them.” Combine these two quotes:

“In my personal portfolio I’ve sat for years at a time with $10 million to $12 million in treasuries. Just waiting, waiting. A lot of people can’t stand to wait. It takes character to sit there with all that cash and do nothing.”

“The wise ones bet heavily when the world offers them opportunity. They bet big when they have the odds. And the rest of the time, they don’t.”

Doing nothing most of the time is what makes doing something big some of the time possible.
Dremio: Working with Datasets
Very much this. In the real world, basically no one will make their house entirely bulletproof and never go outside just because of the possibility that someone could shoot them. Everyone knows that could happen, but is fine with the risk.

"100% secure" is unattainable, and to attempt to achieve it to the exclusion of all other concerns is probably a very bad idea.
"Significant network traffic" tells me almost nothing, that's a totally subjective description and you don't describe your workload at all.

A back-end MMO game infrastructure server I have some understanding of in terms of the kind of load it is handling.
I have seen Intel post benchmarks that are no longer correct. So, yes.
> That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017.

Correct, but it’s significantly better than OpenBSD’s timeline (which learnt about it from the media). Mitigation for Meltdown is possible within of a week, or two. It requires working through the night, but it’s possible.

Mitigation after it’s in the media is a whole different situation.
You obviously have never done mushrooms. You can’t abuse mushrooms. They are non addictive and self limiting.
fpu_excePTIon
I'm out of the loop but I heard it's the white hat hackers who exposed the flaw (probably they were at Google?).

Is the exposition carefully publicized so the flaw is not exploitable by malicious hackers?

Or does Project Zero expose everything, and a malicious hacker can read it and create code that spreads over the internet to harm computers?

I hope it's not the second case because that should cause global panic.
Is outrage not the way that almost anything moves forward these days? I feel that if not for the internet (the modern version where anyone has the ability to publish something that can be seen by many, regardless of tech knowledge) that we would be utterly powerless. It’s one of the few things that causes large organizations to actually care about anything. It’s almost an obligation these days.
Having a goal of making money for shareholders and actually achieving that goal (making a profit) are two different, separable things. I can have a goal of running a marathon and be unable to. Both can be true without contradiction. (And following up with two tired memes doesn't add anything to further conversation constructively.)
Some things are just not applicable. There's no point adding another padlock to the outside wall of Fort Knox. If untrusted users don't send instructions to the same physical CPU that you're using, Meltdown/Spectre are not relevant.

I also think that we need more information before we really see the long-term performance impact here. First, the patches will likely be optimized over time. Second, I am not sure that PTI needs to be run within guest kernels if the host already has the mitigation (effectively creating a double-hit from PTI in both the guest and host kernel), or that even if PTI is needed in both kernels now, that it will be needed long-term. We also need to figure out what type of Spectre mitigations need to be performed within the guest if the host system has the new microcode that selectively disables branch prediction.

The short answer is that it's going to take another 4-6 weeks before even the kernel devs have a firm grasp of what's useful/necessary to mitigate this and for things to settle into place, as Greg K-H blogged about earlier. At that point, we should have a more realistic perspective on the long-term performance impact.
Show HN: Migrate your files from GDrive to OneDrive with native file conversion
> Kubernetes has no advantages unless you're running a huge cluster.

You're absolutely correct. Kubernetes has its advantages, even in a single-node setup. What many others are pointing out is that it also has significant disadvantages, too.

> but then you want to control it remotely, right?

By the way, I do talk to Docker (Swarm mode or standalone) deployments remotely, forwarding the socket via SSH.

ssh -nNT -L /tmp/example.docker.sock:/run/docker.sock example.org
docker -H unix:///tmp/example.docker.sock info

(Needs user to have access to the socket, of course. If sudo with password-requirements is desirable, `ssh + sudo socat` is a viable alternative.)

But, really, there is Ansible for this. Declare `docker_service` and get it deployed (or updated) as a part of the playbook. And ELK (with logging.driver=gelf for the containers or application-level) for logging.

(BTW, what's nice about K8s is that IIRC it allows to exec into pods with just `kubectl exec`. With Swarm you need some script to discover the the right node and container ID, SSH into it and run `docker exec` there - no remote access.)
I'll trade you an 80's era mainframe that had all the bank branch offices of a small country online with only a couple of megabytes of RAM.
Quill.org Receives a $1M Donation from the Pineapple Fund
Sadly that doesn't fit OpenBSD's "Intel you suck" narrative.
More like two years.
The section 3 toy example is demonstrating that OOO execution can cause instructions after a faulting instruction to be speculatively executed, but in that example the subsequent instructions do not depend on the result of the faulting instruction.

AMD's claim is that the result of the faulting instruction can never end up affecting a later speculated instruction - ie, for Intel the bad access says "here's the value you asked for" and later says "actually you don't have permission, forget you saw that". For AMD the bad access says "you don't have permission, so no result available"
Because in the late 60s and 70s, US politicians needed scapegoats to blame for the social unrest, and the psychedelic movement with prominent figureheads like Timothy Leary was an easy target. Demonizing and criminalizing their drugs of choice gave them cause to imprison them and break up their social movements. So campaigns and institutions were established to proselytize the dangers of whatever drugs they were using, and laws were written and regulations established which simultaneously criminalized those drugs. Because the US political system is very slow moving and hard to course-correct, those institutions, regulations, and propaganda continue to this day.
EKS isn't generally available
It strikes me as odd that Project Zero is listed as having discovered this in mid-2017. It seems like this vulnerability and the browser mitigations being considered only just now were discussed quite some time ago:

This comment was on April 7, 2017:
https://news.ycombinator.com/item?id=14057091

And this one from 2015?
https://github.com/tc39/ecmascript_sharedmem/issues/1
Latency isn’t an issue today what so ever, it’s not like UDP also has a magical lower latency it had in the past because of smaller packets and slower computers but today?

Online games work today with fixed ticks and polling usually at half of full frame rate which means that the server updates and polls the client 30 or 60 times a second or any other even multiplier of the expected synced frame rate.
It never does anywhere for me. Good to know it's supposed to, though; maybe I've got something mapped weird, or the versions of the shell I'm using are old enough to be unwelcoming in this way, or I don't know what, but knowing it's not by design means there's a fix to be found for it. Thanks!
Hahaha, you guessed that right for me!
I disagree. Here's how I decide:

Do I need to manipulate rich data structures like hash-maps or nested lists? That sort of thing tends to stretch the capabilities of Bash to its limits and I tend to set the bar fairly low here.

Is the program oriented around commands? If I'm gluing executable scripts and binaries, using bash is often superior to a scripting language. Argument passing is more natural and convenient and the built-in support for the standard i/o streams makes it easy for the different commands to pass data between them. The number of variables or lines of logic is usually less important than the number of different installed commands I need to combine. (Or the number of variations on a single command)

Do I need to modify the environment in a significant way? In a bash script it's trivial to source in an environment script, which can be done conditionally or even interactively. This is usually more tedious to do in scripting languages.
You seem to misunderstand. It's not about not using CPUs or GPUs, but about what code runs on them, and how that code is accounted for. Who vetted for it and who is responsible for it?
Essentially yes, the exploits require code running on the machine that’s attacked. However, for example JavaScript runs on the local machine and is a demonstrated attack vector.

It’s also strictly speaking not a privilege escalation, it’s “see things you’re not supposed to.”, such as all sorts of secrets. The attacker does not gain any write or execution privileges, though.
and similarly Atom were mostly pentium on sub 20nm process (with added candies here and there)
I currently have the following system (up-to-date):

Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-104-generic x86_64)

I ran the following command:

sudo cat /proc/cpuinfo | grep pti

which returned:

fpu_exception	: yes

Note the instance of 'pti' in the word 'exception'.
The legacy of autoconf! People look at autoconf's output to learn shell, but autoconf output is full of bad practices, working around bugs in shells that noone's ever heard of.

Autoconf output is expected to run on buggy shells with broken empty-string comparison. Your scripts probably aren't.
I do mean TV channels. I meant that first part about there being plenty of legit, respected, analytic conservative news sources. There's just not an actual news channel for the right.

I believe that anything that could draw viewership away from Fox would be good for us as a nation.
5222 is pretty much used for all Epyc games I don’t think that I has anything to do with XMMP tho.
My first 486DX PC also only had 8MB of RAM until my parents through it out when I was a kid. I was personally shocked as well when I saw that this 486 PC had 64MB.
reasonable touchpad?

You want to look for windows precision touchpad support. Turns out the problem with windows touchpads was not the hardware, but the crappy drivers touchpad vendors make. Microsoft made their own drivers and if you can get hardware compatible with those you'll have a much nicer experience.
> But why is tripping considered abuse? Particularly in cases where overdosing is difficult or impossible (like with marijuana). These requirements just seem asinine.

It's heavily associated with '60s counterculture in general, and more specifically hippies. Some users were starting to talk about entirely new (to them) kinds of spiritual experiences that didn't fit with Western religious traditions. Prohibition was seen as a valid tool for keeping these "subversive" people under control and blunting their effect on wider society.
It does match the regex. "pti" is a substring in "exception"
Payment services (PSD 2) – Directive (EU) 2015/2366
What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model.

Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this machine's life?

BTW, my machine is just a normal desktop/laptop, so no server stuff running or expected.
> They acted in good faith.

The PR spin and misdirection games isn't in good faith which completely demolishes this line of defense.
For pure computational cases Meltdown vulnerability remediation might not impact you as much. Meltdown fixes would affect applications that do a lot of syscalls - lots of socket IO, IPC stuff, small and frequent disk IO ops etc.

You'll probably see a wide variety of benchmark results anything from no impact to things like above. So just make sure you measure carefully with your own workload.
You should blame whoever gave advance notice to Apple and allowed them to patch the issue, but didn't do the same for FreeBSD.
It’s naive to assume that your system is perfectly secure in preventing unauthorized code from running. But that’s just in general.

He is right, though. It would take two vulnerabilities to pwn him: one allowing remote code execution and then another (Spectre/Meltdown) to gain access to privileged data that shouldn’t be available in that context.

Too many machines put on too many hats. A single (physical) “secure” server should do as little as possible and run as small a codebase as possible. And never run - sandboxes or otherwise - code that isn’t authorized.

We seem to be forgetting that in all this. If you only run code you trust, you are safe. This can only happen if you run in trusted code on your machine. We’ve taken running untrustworthy code in a “sandboxed” environment to mean “not running untrusted code, when it’s totally not the case.
I'm in a similar scenario, we basically get freedom of choice over OS, with the caveat of being responsible for our own installs of course. This works well small scale with competent devs you can trust to take care of their own OS (we help each other out if needed obviously, but the point is that you become fairly self sufficient in that respect, no "IT dep" needed).

I know there are reasons this can't happen at large corporations such as security... more to do with contracts and culpability than measurable security improvement AFAIK.

I can't quite imagine _not_ having control over my work environment in this way in a job anymore and do greatly appreciate it. It's not all about familiarity, there are many objective reasons using certain proprietary OS can be a significant drain and inefficient, even more so for development work. This freedom would be a significant factor in considering a new job for me, even over pay because it's a big part of my "happiness" and "sanity" factor in the job.
Their repos are here: https://github.com/empirical-org
I'm wondering why people who are unsatisfied with municipal tap water don't just buy "spring water" or "distilled water", both of which should have less weird stuff in them. And they are standard products available at most supermarkets. Distilled water in particular should be pretty much pure H2O.
Despite being intensely skeptical of anything veering towards association as causation, I have always insisted that a psilocybin trip when I was 20 years old was overwhelming responsible for a series of achievements and positive changes in my life in the years following.

My lack of words or explanation for this has left me embarrassed to talk about it. Seeing these studies is bringing up a lot of dormant curiosity.
Interactive tutorials from katacoda:
https://www.katacoda.com/courses/kubernetes
A graveyard for good domains you let expire
Vaadin/flow
I ran Slackware on a 486 (DX133 I think) with 8mb of RAM in 1999.
Can any of this be exploited from Javascript? That would be a humongous can of worms.
>they’re likely living better than John D. Rockefeller did

When you make absurd conclusions, you should examine your premises.