skysight-inc/HackerNews huggingface dataset:
In the context of Nazi Germany - the Nazis passed laws to strip Jews of German citizenship, so technically Jews were illegal.

https://en.wikipedia.org/wiki/Nuremberg_Laws#Reich_Citizensh...
While, of course, it is technically possible, it seems very reasonable to infer that we may be in a small window in which we haven't connected to other intelligent life. In just 100 years we have gone from being barely able to fly at all, to being close to becoming a multiplanetary lifeform.

The evidence becomes more and more every day that life is not a one in a trillion miracle but a natural product of certain environments. To assume we will never have contact with other lifeforms seems like a huge jump.
So then they just need a judge to grant a daily warrant and a fed walks up to the front desk every day to request the list.
Yeah, this is all technology from iOS devices.
Ah, sorry. My comment was specifically directed at Spectre (though I didn't say it), the more serious of the two.
...but those CPUs are still speculative out-of-order super-scalars aren't they?

We're talking about removing those features, on which our entire computing ecosystem is built, and expecting the compiler to be able to pipeline every execution unit individually.

dex2oat is where the work could be done yes, but we just don't appear to know as a field how to fill in processor pipelines like that - we just don't have that knowledge to do it, and nobody seems to be able to figure it out despite trying several times.
If "upgradeable" matters at all, you're not buying Apple stuff anyway. You may as well assume everything they make is an iPhone and make your purchasing decisions from there.
What's easy and hard in Rust isn't the same as what's easy and hard in other languages. As a beginner, don't try to learn Rust by implementing data structures, as you need to know a lot of Rust to do it correctly. Here's an entire book on writing linked lists, for example: http://cglab.ca/~abeinges/blah/too-many-lists/book/

What did you do so far to learn? How do you learn other languages, and what other languages do you know?
I'm not saying you're wrong, but you seem to be using a different definition of untrusted than the rest of the thread. Your code may not be perfect, but you certainly don't suspect it's launching a timing attack against your machine's kernel, and exfiltrating what it discovers, right?
Well, I think I should make it clear that I'm very well aware of what modern IDEs can do, and I think most Emacsens do too. In fact, their killer features haven't really changed much since the late 90s / early 00s.

What I never liked in IDEs is their features come with a huge cost. Their integrated features are great, but their implementations are so complex and opaque, when they inevitably go wrong, I can't just dive into a plugin and fix it myself. Emacs packages still goes wrong, but at least fixing them is a much easier affair. It is this reason, and that Emacs generally just come out with functioning packages for new concepts and ideas way faster than any other IDEs, I've vowed to avoid IDEs written in compiled languages like the plaque.

What I really mean is, I'd love to replicate IDE features on a text editor, but without the pain. Elisp is just a horribly outdated language and runtime environment to be honest. Everything is global, OOTB most of the modern FP constructs is non-existent in this FPL, dependency management is a mess, it's single threaded, it's a terminal app pretending to be a GUI etc, and oh god, don't even get me started with the default window management mechanism. I don't understand why so many people keep romantizing it.
Merrill Lynch bans its clients, advisors from trading Bitcoin-related investment
It's not just untrusted code, it's all code.

"Trusted code" is one exploit away from being untrusted code. And solving that requires not accepting untrusted input, which makes most general purpose computing useless.

Has there been any research into solving this problem at the hardware level? I'm imagining something like having hundreds or thousands of distinct processors on a PC all isolated each running only one process.

It sounds extreme, but over time I've basically learned to treat "optimization" as a synonym for "introduces side channel attacks", and without something that can protect against a large majority of these kinds of exploits, computers are only going to get less secure.
Makes you wonder exactly what they think they are covering themselves from.
The vast majority of your recent ancestors' matings were within the village or between neighboring villages. You're the result of dozens of generations of cousin-mating, and a few generations of not-cousin-mating.
There is a strong overlap between data science and devops, which is something not often discussed in all the data science/machine learning MOOCs.
Well, Apple's security track record is not exactly great (I mean, it's not as bad, but it's not OpenBSD, for example). There's the iCloud leak, and the macOS High Sierra password bug. Admittedly, those are software bugs - but does it make a difference?

I would argue that creating a closed platform creates security by obscurity. I think this will work to some extent in practice, but it allows Apple to put in backdoors.
The poor traditionally have much larger families. But counting surviving children, perhaps the rich make out ahead in the end?
Hurd on Mill is the Hurd on Mill of... oh wait...
They are still sticking to this line:

"This is not a bug or a flaw in Intel products. These new exploits leverage data about the proper operation of processing techniques common to modern computing platforms, potentially compromising security even though a system is operating exactly as it is designed to."

https://www.intel.com/content/www/us/en/architecture-and-tec...
From the spectre paper, https://spectreattack.com/spectre.pdf

"As a proof-of-concept, JavaScript code was written
that, when run in the Google Chrome browser, allows
JavaScript to read private memory from the process
in which it runs (cf. Listing 2). "

That looks like is the current limit of javascript base attack. It doesn't seem to be able to access system resources nor execute system command script (yet....).

That kind of JS attack vector likely can be mitigated with web browser update.
AMD Looks Poised to Gain at Intel's Expense
Microcode updates are distributed via Windows update.
It only exists on paper.
Facts about Side-Channel Analysis and Intel Products
Typical use cases of Flexbox
Sort of pointless since a fugitive can easily lie about their plate.
Exactly. Or if the power supply is broken... or the CPU, or the RAM, or anything that requires the iMac sent off to servicing.

Also, I'd need another Mac to access the data, whereas with a USB-SATA enclosure I could use anything that runs Linux (as there are HFS+ drivers for it). For the new breed of cr.p Apple has forced upon us I'd need a Mac AND a Thunderbolt Cable AND the luck that the source system is still bootable.
Yes.

Compare the speed and fury of flamewars on reddit when people are tossing orangereds back and forth.

Yes, it's annoying to me to have to dig back through my profile (whichever it may be at the time) - but I find I will only do so when a topic is truly worth following up on - not simply to spite another stranger on the internet, which seemingly still goes on here to some extent regardless of the "feature".
Kernel (operating system)
Maybe. When it is your own hardware you can do a different risk analysis. If you control all the code that runs on the system you don't need any mitigation. Most servers don't run arbitrary code form the internet - at least not intentionally. (a security hole that allows remote code execution is a real issue, but that risk can be managed)

My company doesn't need to mitigate the risk of me using these tricks. I'm not going to, but even if I was I have many other ways to get at sensitive data if I tried. If I get caught I'm fired and put in prison which is enough mitigation.
Sounds like reading HTTPS cert/key details from other-peoples-VM's on cloud providers wouldn't be too much of a stretch. Especially with the memory dumping demo. Combine that with something that looks for the HTTPS private key flag string and it's sounding pretty feasible. :/
Unfortunately In this case the govt is already ahead of you.

It was several years ago when the UIDIA and the banks were arguing over who should be held responsible for incorrectly authenticated transactions and govt (aadhar authority) held that it was the banks who would be responsible, not them.

They want it treated like a service with an error rate- responsibility for the big picture is always pushed to the nodes.

This is just indicative that the govt has already built barricades and breaks in order to ensure that the aadhar system and its agency are hard to target.

While you can have public outrage (unlikely since this is technical discussion which can be spun in many ways) which could force the govt to act - mostly it’s going to be NGOs and PILs which deal with aadhar.

Don’t forget that the govt kept this thing alive even though it had no legal backing, and then finally gave it credibility via a money bill.

There’s been no privacy discussion or safe guards discussed legally or constitutionally - we have a SC ruling only Now.

Its unfortunate but the authority was built with many arguments and challenges already anticipated.

Simply put - It is very close to being out and out nefarious.
> For example, why do you suppose that inheritance via composition makes it not an ISA relationship?

I don't. My other message [1] clearly states:

class A(b: B) : B by b // IS_A via composition

My point is that inheritance can be achieved in many different ways, composition being one of them.

Inheritance is an architecture concept, composition is a mechanism which can be used to implement inheritance. They are complementary.

[1] https://news.ycombinator.com/item?id=16050458
> So how do we determine who is an illegal immigrant?

Good question. It must be hard for law enforcement to do this considering the laws protecting probable ones.
The majority of European (and other) countries require everyone staying at a hotel be reported, so it doesn’t become the hotel’s job to determine illegal vs legal, it just becomes a huge privacy issue for everyone because the government knows everywhere you stay.
fish shell forks and spawns threads. It handles this issue by ensuring that the children do not call malloc, which is indeed hard to enforce.
# My way

Setup:

1. Add mail account to Thunderbird

Routine:

1. Open Thunderbird

2. Check mail, close Thunderbird

3. Let the time pass, go to step 1
But Microsoft says they are not:

>In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer. Surface customers will receive a microcode update via Windows update.

https://support.microsoft.com/en-gb/help/4073119/windows-cli...
This comment crosses over the line where the thread becomes generically political. We need to resist that here, because there's nothing of value in generically political subthreads—they're all the same. People who want to fight the same fights over and over—and there are valid reasons to want that, obviously—need to do so elsewhere.

Of course the original topic is highly politicized, but at least it was an alloy, not the pure thing, and it's important to preserve that property in the comments.
That wont do it. The true data will still bias the results.
Why is this a bad idea exactly? I'm still very interested in the idea of using stateless sessions. Is it just that it's hard to expire sessions server-side, or is there more to it?
I'm in the same boat - I like to offer my view, then walk away, and let people react how they will.

Even so, I'm not going to argue against anyone else being more vested in the ongoing conversations, and this would be useful for them.
You might consider "good" to be "relative to what other people at your level might be earning", but relative to cost of living and taxes to support a single person, €4.700 is very good, and your friend should be able to easily get by.
Microcode updates come as normal Windows updates.
Right, however even this is harder than it looks. For example, what happens if exec fails? How do you print an error? Answer: very carefully - certainly not with printf!
On interviewing and building inclusive teams: When “consistency” backfires
This needs to find its way into the hands of every manager of companies that make processors.
I'm not sure that'd help - as someone else observed in another thread, loading anything into a cache requires evicting something else, and that eviction can be measured. You could do something like maintaining a full duplicate of the cache and tracking deltas, but I feel like that's back in "rearchitect the CPU from the ground up" territory.
The blogpost does explain this if you bother to read it.

>And how do you determine how many meatspace people are voting for something? This problem was confronted by Satoshi and his answer was proof of work.

This is quite simple, people can agree on a representative in a democracy, hence it must be possible people will be able to agree on a blockchain to use.

As state previously in the thread, long range forks are not a concern as any state S with atleast N ancestor states will not allow any state S' to become valid if it is not a descendant of S. Therefore it can be concluded that after N blocks, a fork becomes impossible.

The remaining problem is therefore short-range forks caused by someone burning a lot of stake. Forking will inherently burn all your stake in the other chain while you burn everyone elses stake in yours. Any such fork attack then must last for more than N blocks to become permanent.

The blogpost dives a bit deeper into the fork prevention mechanisms but the TL;DR is that nodes will prefer keeping a chain over switching to a new chain significantly, going up exponentially as the new fork becomes older. In essence, a fork must take over the network almost immediately or the new fork will wither and eventually die out in favor of the original chain. (The speed of a fork is roughly a function of the time delay between the first and last node receiving a block in percent with respect to X, the amount of permanent control an attacker has)

The later part of the blogpost also explains that the weak subjectivity only poses a problem for nodes that have been offline for more than N blocks and in case an attacker can control large portions of the network for extend amount of time. It does not matter if a node sees 100000 other nodes with another chain until N blocks have passed or in the other prevention mechanism, the gravity of the new chain becomes greater than that of the current chain, which can take a while.

As suggested in the end of the blogpost, if a node stays offline for extended amounts of time, there is no safe way of knowing the state of the network, thusly the best option is to obtain a recent blockhash from a friend, a block explorer or their software provider. Human social interactions would be the prefered option, the trust on the network being in the right stake would thusly be equivalent to the trust you place in said friend. Or your software provider or blockchain explorer.

It can be argued that any entity which is sufficiently powerful to cause disruption over the chain consensus for longer than a year (the proposed value of N) then they will also be able to overpower any other proof of work algorithm or pursue alternative methods to disrupt the network.
"no known breach or defect"

Except for the many thousands that have been known, from every exploitable vulnerability that's allowed an iOS jailbreak to every security fix in every patch in the nearly two decades of OS X (and System 7/9/etc before that). These types of things are fairly complex pieces of software. It doesn't matter if the software is ultimately compiled to hardware circuitry or executed by a CPU -- bugs come from complexity, not from the medium.
It looks like they expose some MSR to control the branch predictor, see:

https://twitter.com/aionescu/status/948753795105697793

https://twitter.com/aionescu/status/948818841747955713
I am surprised it has taken this long.

In the Marklar days, this was something we speculated about as a Clone-defeat mechanism. Essentially a hackintosh blocker.

I look forward to following the discoveries made in this subsystem.
This is a pretty interesting move, particularly when you consider that consuming media is one of the biggest use cases for smart speakers and Roku already gets bundled into a lot of TVs.

I'm not sure that Amazon or Google will be thrilled with the idea of integrating an SDK into their speakers, but I could imagine Sonos doing so.
I stopped drinking four years ago.

What is consistently missing in the conversation about addiction is Alan Carr's book "The Easy Way to Stop Drinking" and "The Easy Way to Stop Smoking"

reddit/r/stopdrinking is also an invaluable resource.
Lenovo has BIOS updates that specifically mention CVE-2017-5715 (Spectre). I wonder if this is an Intel microcode update.

https://pcsupport.lenovo.com/de/en/products/laptops-and-netb...
I don't see user-mode linux, QEMU, or KVM on that list, or am I mistaken an they are affected as well(so maybe some amd users are safe?). Another reason I advocate every spinup should have FDE by default with a ssh key entry shimmy at initram, or is this runtime cpu acccess so it gets anything live? If so that's scary.
No, instead we should all be required to report our interactions to three letter agencies, just so they have a "helping hand" with locating (suspected) criminals...?
I kinda doubt they'd be able to turn off branch prediction and speculative execution entirely and still be able to claim that

> the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant
I think that's the reason why blogs without comment function gain ground. On the one hand static blog generators are practical, but they also are a confession that not every blog has a lively community.
Yes. It's very good. I listened to it for the reconstruction part, but ended up listening to the whole thing.
They also mention that they were made aware of the issue only a few days ago, probably like us on HN.

Are smaller actors left behind?
Redhat: Kernel Side-Channel Attacks
As of today, no US airlines operate the mighty Boeing 747
You say that, but best practice for systems that have that option (say, internal SAML IdPs) still means you do per-peer keys with the annoying key management problem so that you get cryptographic binding instead of relying on a bunch of broken RPs to validate audience restrictions (spoiler: they don't) and in some cases IdPs or middleboxes that need to add audience restrictions (spoiler: they don't either).

What you get is that the peer can't forge tokens. But you're trying to authenticate to them; they already have full authority. So what are you fixing? (I'm not saying it's "nothing", but I am saying it's very little, and it's definitely plausible the increased risk isn't worth it.)

What do you mean by "tiers" here? The specificity of that word suggest you don't just mean "peers", but at the same time clearly symmetric systems win at nested delegation. (krb5, macaroons come to mind)
Why would Ubuntu need to be notified? Fixes for this are going to be at the Linux Kernel level or (at most) Debian upstream. Canonical shouldn't need to do anything?
Well, he is a senior developer with wife and son.
My CS background before my first job was:

Grew up interested in computers, learned a little BASIC.

Took two intro CS courses during undergrad at an Ivy League school, but majored in the humanities.

Years later, attended a bootcamp.

None of this took place in MA.
And remember, cross-continental trade is old. People from the African continent have been having children with people from the European continent for thousands of years.

One of these in no way implies the other. Do you have a shag with the baker every time you stop by the corner shop?

You've been indoctrinated with the multikulti propaganda, try to extract the poison, there are people who can help.

Asians and Europeans have admixtures with non-Sapiens human species, Neanderthals and Denisovans.

Africans also have non-Sapiens admixtures, but different species.

No Africans have Neanderthal admixture, and no Asians or Europeans have the African admixtures?

Why? How does this jive with your thinly sourced theories?

Whatever theoretical breeding patterns of this sort you want to propose,
it is in practice entirely negligible.

And like I said, I know it's not really you who is thinking and proposing it. You're just parroting your indoctrination. You can do better. We're here to help.
I can confirm that it is also the case in Italy and Mexico. My family and I stayed there recently. In both countries, they took copies of our passports to send them to law enforcement agencies as part of the hotel check-in process.
You probably mean T1, as the repo covers MacBook Pros and not the iMac Pro. While I agree that hardware support isn't where it should, it's getting better. Hey, we even have a working driver for the internal keyboard since several months. ;)

No, seriously: Currently most effort is going into mainlining Bluetooth support for the current MacBook Pros (I expected that to land in Linux 4.17, although it still might get squeezed into 4.16) and preparing the keyboard/touchpad driver for mainlining as well.

The Wifi issue is really a shame, but as far as we know it's entirely to blame on Broadcom as their Linux firmware has an issue preventing it to work properly [1], something which can't be fixed by somebody outside of Broadcom.

And to be clear: That so much stuff isn't working under Linux with the current MacBook Pros isn't really something to blame Apple for. What Apple simply did is what they always do: Rethink how they can improve stuff and they did a great job with it. E.g. it makes perfect sense to connect the internal keyboard via SPI instead of via USB, simply for power-saving (and probably complexity) reasons. As Apple is the first vendor to do such things there are simply no Linux drivers for it yet. Or look at Bluetooth, which is now connected via UART. It appears that this will be the way to go for all vendors in future, but only a few are already doing it, so there are still some rough edges which need to be smoothed out.

[1]: https://bugzilla.kernel.org/show_bug.cgi?id=193121
Track the progress of multiple projects in GitHub
Ask HN: Is Intel still selling chips with the vulnerability?
If they are, when will they start selling chips without it?
Only under specific software configurations that are not enabled by default, or confined to a userspace single process (which is bad for web browsers running Javascript but not nearly as bad as the Intel-specific attacks). So while AMD is somewhat vulnerable, the most severe and easiest to exploit vulnerabilities are pretty specific to Intel. In a pedantic sense you were right, AMD chips are affected, but it is literally not on the same level as for Intel chips.
85 Books Recommended by Derek Sivers – Bookadvice – Medium
They will update 90% of the chips 5 years old or newer, which I assume includes Ivy Bridge and later. But the bug affects older chips, too. Important to keep that in mind.
well it is sealed off from us and Intel, but do any US security agencies have their hands in there? How would we know?