skysight-inc/HackerNews huggingface dataset:
Thanks! I will use this if they don't understand my version of it.
Housing externalities of cities decisions to for instance build offices while not adding sufficient housing is not limited to that city, essentially pushing those externalities onto surrounding cities and having them pay the housing as well as infrastructure cost. As proven by our current long-lasting housing crisis this is not a good medium to long-term solution.

Because cities are too fine grained for containing most externalities office/housing/infrastructure decisions it is appropriate to move some housing regulation up to the state level as it is one step up from cities, and therefore the best place to coordinate between cities.
thanks for the head's up - I'm a bad thinker, this isn't the first time I've been shadowbanned.
> Because customers need support.

All the more reason not to let Comcast use it.
Touch screen is a big con for me. I've had an xps 13 for a brief time one year ago. It was the QHD model, I wanted the resolution. Well, the screen isn't bright enough and there is too much glare, almost like a mirror. It drains the battery faster, even if you disable the touch sensor. Although the colors were nice, white areas would look dirty, like there was some grayish pattern, probably the sensor grid. All this just drove my OCD crazy and I sold it.
Maybe some bits of Southbridge and TPM mixed together
> I mean, who uses touch screens for development?

Web developers who want to test using real touch input events rather than the quirky emulation found in a few browsers.

If you're developing for touch, in particular things like drag & drop, you want a real device.

Even if you have an iPad or smartphone test device too, it is nice to have that ability on your main development machine rather than jumping around.
NKorea may have accidentally hit it's own city in missile test
Apparently not, Manila is considerably more dense than both, at least unless I'm reading the table wrong:

https://en.m.wikipedia.org/wiki/List_of_cities_by_population...
I wasn't attempting to realize the top commenter's fear of

> unproductive debate about what consciousness is or is not

I'm just addressing the question of why you'd say yes: you might be ready to be put of your misery, and at that point, why would you say "no"? The resumption of "you" gets an afterlife, and nothing gets worse for the you that's about to die either way.
> only the part of the JRE and external libraries that the app really uses

Just curious, how the reflection and dynamic class loading things work when generating an executable?
How do you know this?

I think it's worth noting that it's entirely possible, that if you are a CPU execution pipeline designer that you think about memory loads/stores, L1 cache, branch prediction and speculative execution, and it occurs to you that the cache gets polluted by spec exec, and the branches can be security checks.

But the solution is simple. If the branch is important, wait for it. (Load it into L1 cache before the branch - use a memory barrier.)

The fact that this is not in any ISA docs is a likely pointer toward the possibility that it in fact hadn't occurred to them.

These attacks are the same as any new invention. Easy to see once you've grasped the concept.
> Why not kill the process instantly on a prohibited read, then? Do these prohibited reads happen too often to switch from "oh, that's okay, you can try again and do other stuff" to "the punishment is death"?

It's an interesting question. The pedantic answer is that they technically do actually happen all the time, that's just a page-fault. However in the page-fault handler you could just check what address they were looking at (And we already do, since we have to decide if we need to map a page, or throw a SIGSEGV), so effectively you could block them by checking the address.

But it's actually fundamentally a lot worse. On its own, meltdown might be preventable that way, but you can combine meltdown with similar patterns to the spectre exploit to achieve the meltdown exploit without raising the exception. The kernel then can't prevent this, because no exception is raised, so it doesn't actually know anything happened.
I would love to see an analysis of the productivity an hour before meetings. My guess is that it’s generally much lower than the baseline. And especially half an hour before
I didn't read it as whether whether the attack is impractical (because it is clearly quite practical) -- the parent was questioning whether it's practical (or not) that such an attack would be "planted" as a backdoor by an agency like the NSA. The attack comes off as quite impractical for something like a plant (sensitive to e.g. compiler output, requires locally executing code to snoop is already a red flag, and the 'bug' enabling this has really been considered a feature of every mainstream CPU for like 15 years, and not considered by many to be any kind of attack vector.)

Or maybe the idea is speculative execution itself was a dream of the NSA that was Inception-planted into the brains of CPU designers in the 90s; who knows what the theory-of-the-hour is regarding 3-letter-agencies and their capabilities.

Ultimately I think what we're really learning is that guarding against things like microarchitectural attacks on contemporary superscalar, OoO CPUs is going to be an uphill battle that we didn't ever think of due to incidental complexity (among other reasons), and will serve as a new class of attacks. Who knows how long this bug class will exist; we've killed some. What's also likely is that, like most security failures in the industry, this is a result of various things like basic lack of forethought/ill considered design, as opposed to plants (3 letter agencies aren't responsible for the vast majority of security failures you see, it's simple mistakes). But peddling conspiracy theories involving them gets you upvotes, so, you know...
Thanks. We’re trying to get our engineering blog off the ground with some posts lined up for the next few months.

We’re also hiring! https://www.thread.com/jobs
> how would you get eye images on a regular enough basis for it to be useful

Could they be collected from all those devices with front - facing cameras people spend their lives staring at?
Absolutely not. As greenyoda said, there are things that web browsers just can't do, such as gain access to the file system or to certain OS APIs that aren't available in a browser. Sure, there may be a trending movement towards SaaS for a lot of apps (SaaS is super hip), but not every app can go that route.

Previous discussions on this topic:

- https://news.ycombinator.com/item?id=11748812

- https://news.ycombinator.com/item?id=4280463

- https://news.ycombinator.com/item?id=7762926

- https://news.ycombinator.com/item?id=5050700
Show HN: Basic GPU path tracer
Last year I was in the market for a new laptop for the first time since 2011. I really wanted an XPS 13 because it was Linux first and cheaper than a MBP. Generally what put me off was various issues relating to coil whine and general "lack of craftmanship" expressed by reviewers. The dell xps subreddit was a nightmare to read.

In the end I got a MBP and have no regrets, OS X is easy to use and Apple has always gotten the physical aspects of the MBP right. I'll consider XPS again in the future (~2-3 years) but doubt they'll be able to get to the craftmanship level of Apple.
It really depends on what you are trying to do with it, for example we have around 15 different integration test configurations that run every night for which VMs may better suited as we want to test installation and deployments automatically for 3 distributions (6 different versions ex. Ubuntu 14.04, ubuntu 16.04, centos 6, centos 7 etc..) and the last 2 windows server. The good thing is that they reproduce the customer environment.

But they have large down sides as well which slow us down. They are a pain to maintain as they are somewhat undocumented (you make a poc for 1 and management always wants more without improvments), a lot of edge cases cause issues which are tough to reproduce (locally sometimes impossible and waste a lot of time) and it takes them a while to start, run, etc.

This is not too tragic for nightly tests as we get the results in the morning but for tests which are started every hour, you do not want to wait that long to verify your changes work/didnt break anything. You can do these in stages, where you create different images based on the result of a previous job (run basic tests that cover base functionality that should always work, then run more in depth tests, then run performance tests at the end to ensure no significant degradation was introduced, etc..) and send out notifications asap in case of failure. The Dockerfile is essentially the documentation as you can see what is installed/configured. You can run everything locally just as it would in a k8 env. which for some reason every one always struggles with.

I am sure there are also edge cases with Docker that are a pain as well but the other selling points show it may be the right direction. You just havevto find use cases and evaluate them.
"Resume your consciousness" does not apparently mean to me what it does to others -- hence the thought experiment I gave. Just because there's a computer out there churning out bits that match mine (for some acceptable definition), in what sense would my consciousness "resume" if you killed me? Whatever sense that is, it doesn't interest me in the slightest. If I proved to you that such a machine already exists for you somewhere, would you feel fine being put to death?
you mean all these security researchers kept it a secret for the last decade or two?
Read TFA
I wonder if Heroku's woes are related to Meltdown/Spectre.
You're assuming that:

1. A world where Ghengis Khan or Emperor Tiberius, or Joseph Stalin were still alive today....

2. Would be no worse from the world we have, except a few powerful people would have not had to die.

The interests of the wealthy and powerful are not aligned with those of the rest of us. Death is one way in which dynasties and despots lose power - moreso if they have multiple successors.
Funny that nowhere to be found: the actual link to the fix and how to patch it.
To reiterate those types of arguments are a very serious logical fallacy and unsound argument called appealing to common practice.

How were they supposed to avoid an exploit that no one would discover for years? And exactly how is "appeal to common practice" a fallacious or unsound argument?

Exactly how much performance -- meaning, how much market share -- is Intel supposed to sacrifice to avoid the possibility of introducing unforeseen bugs?
The strange places this leads arrive almost immediately. Are you the same person after you take a nap? Doesn't your consciousness basically dissolve and then reconstitute itself when "you" wake? What about from second to second, between moments of inattention? Are we relying on the "stability" of your constituent atoms? On some "arrangement" of them? On a particular locus of sensation (the goo in your brain pan)?

What if we "clone" you by copying every other atom into a "left" clone, leaving the original in the right, and doing the reverse on the alternating atoms? Which resulting "clone" is you?

This way lies madness. Possibly twice.
From [1]:

> We reported this issue to Intel, AMD and ARM on 2017-06-01.

I don't think they have been twidling their thumbs with such a huge discovery without informing constructors.

[1] https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Do you have a proof of concept you can share for this type of attack?

I don't quite see how an attacker would take advantage of this is a real-world scenario.
I doubt that people whose lives/finances have been ruined defending themselves against vindictive/overzealous prosecutors and litigious citizens would agree that this is not a dangerous precedent. Being dragged through the courts based on outdated or unreasonably applied laws can ruin a person's finances or reputation even when they successfully defend themselves.

The minors on trial for sex crimes for sending nude pictures of themselves, as well as innovative business being stifled buy outdated protectionist regulations, may also have something to say about it.

Outdated, unreasonable, misinterpreted, and in some cases know unconstitutional laws, can be used as tools to attack and harass.

The fact the Constitutional action is not being taken to remove these laws and regulations from the books is not an argument for them to continue existing, but rather an argument for the need to change how the government operates in regards to updating and clarifying the law.
You could go precision though. Which is what I did. Precision 5520 has an Ubuntu option and works flawlessly with Linux. 32-64g of DDR4 and 12h of battery with the 9cell upgrade

I should know. I’ve been using one for nearly a year.
they don't show/track nsfw websites, and i would like to see those.
Drinking Wine Like the Romans Do
These exploits are the result of the games we play to get high performance when memory is slow but processors are fast (speculative execution; caches).

It's time to figure out how to make RAM dense, cheap, AND fast, so we can finally eliminate the cache layer from the ridiculous hierarchy of storage technologies.
The least productive people I knew simply did not worked much. They did spend time in work, sometimes a lot of time, but ultimately most of that time was slacking around and then pretending that 10 minutes task actually was difficult and took whole day.

So like, avoid not working on the job.
Apple fixed the KPTI bug in 10.13.2 which they released over a month ago.
Their proof-of-concept only reads memory from the browser it's running within, right? Violating browser sandboxing, yes, but does that mean it would also (theoretically) be able to access the memory of other programs?
The idea of running untrusted code on your computer, and trying to isolate it, seems to be broken for now. I'd also be surprised if this is the last such hardware bug we hear of...

As for Javascript: I use uMatrix in Firefox, with a default rule that disables all JS unless I explicitly have whitelisted it for a certain domain. Some websites break and don't show content. I intend to just skip those websites.

The reason I set this up was actually to prevent tracking, but now it seems that it's good security practice too...

The web is getting more and more annoying anyway, and I waste way too much time with it, so reducing my reliance on it seems like a good idea in any case.
The best open source project for someone might not be yours, and that’s OK
Texttop – An interactive X Linux desktop rendered in TTY and streamable over SSH
Thanks, that's an angle I hadn't considered before. (I still don't follow the argument about continuity of experience by gradual mind upload, but we can probably chalk that up to different intuitions about consciousness).
Are you referring to callbacks from kernel mode to user mode?
I think the resounding answer has been over the years that written proofs aren't more fault proof, they're just better at hiding the faults because they lack explicitness. There has been a recent push for formal verification because it's easier to actually find issues with the proof.
I think that only scratches the surface of pissed for Linus. He barely even swore.
A year without coffee
I think you have it backwards. Monolithic kernels are by their very nature more complex to reason about due to all the communication backchannels made possible when everything sits in one process.
But you do need an Engineer to hit the merge button for you when a build is green.

This is okay now, but could become a major pain when your company grows and Nancy in Accounting who is an aspiring writer starts making _hundreds_ of copy changes with pull requests every week. You're going to really wonder where all your engineering time went when suddenly you have a dozen Nancy in Accountings...or a hundred.
Because they knew it was an obvious security risk?
They weren't making a trade-off because it was not a known risk. No one had any reason to think that speculative jumps would lead to a large security hole.
Dave Fischer's Home Computer
meta comment - but when I first saw this comment it was in reply to carwyn's top level comment but now it is a top level comment unto itself? that makes a lot of the replies not make sense now - was this comment moved?
Out of interest, do you know if the process of uploading the microcode via the OS independent of the BIOS? ... e.g on something with an unusual boot ROM like a mac or a Pi (pretend it had an x86) would the kernel not care? i.e it's just a CPU instruction?
I think that the intent of that was for virtualisation (before we had real virtualisation)
you'd use a cell/refcell/box or just wouldn't get this excercise as everyone who got past it in rust know it's not easy and critically it's not supposed to be easy.

it's difficult in rust because recurrent data structures are super hard to reason about in general in terms of borrowing and ownership when AOT compiling and you unfortunately must know this to be efficient at rust; this realization is one of the stages of learning the language.
I have to disagree with this. If the function is larger, then the mental cognitive overload to understand (and follow the flow) is much higher. If a 1000 line method is divided into 10 methods with each 100 lines, and if those 10 methods are named appropriately, then it would be much easier to understand the flow. It also gives a high-level picture of what the function does, and if needed, I can always jump into particular sub-routine.
It doesn't matter. If you call a library function you're giving that library license to run arbitrary code in your address space. An RPC is another matter.
Ahhh, that's what I missed. I thought the "speculative execution" people were talking about was executing the tricks on the copied data after the illegal read.

But not only that, the entire illegal operation can be fenced behind a speculative execution with a simple "if" branch. And illegal reads happen in that kind of context all the time because (for example) that's how every FOR loop ends.

There's really two places where pipelining and speculative execution are causing this problem - the obvious one where the CPU is allowed to manipulate protected data before everything gets blown away (except cache loads of legal data, hence the problem), but a second one that means that reads of protected data happen all the time in normal branch prediction misses.

When it happens in normal flow, you can't punish it by killing the process. Reading protected memory in a speculative branch isn't some digital "attempted breaking an entering" that you can clamp down hard on, it's totally normal behavior.

I get it now, thanks.
Square peg in a round hole. It sounds "non-engineers" means content managers and they just invented a really crummy CMS. Surely they could at least use Jekyll or something and let the content managers use markdown. They're shifting the cost of dev time to content management resources when they could just spend some cash on a commercial CMS like Contentful or Prismic that is easy to configure and far safer and more scalable.
"This year I'll try to destroy the US political system a little less"
Honestly we knew about this in the 70s. Mainframe/time share systems had lots of protections against attacks like this. The problem is mainstream computing when cheap/single user and attempted to build a multi user/untrusted code execution environment on top of it. Now it's come back to bite us in the ass.
I think you don't need a GPU to crack an old password (with crypt?) limited to 8 chars.

Better than that only the Windows LM Hashes
I suspect there is a mutual understanding with his constituents that his job is to prevent big new development projects. It explains to me the half-assed talking point, since almost anything is more palatable than 'the wealth of my constituents depends on restricted housing'.
>Worth noting that many of the claims around Spectre are wholly un-demonstrated.

This is untrue.

https://googleprojectzero.blogspot.com/2018/01/reading-privi...

Variant 2 is Spectre.

"This section describes the theory behind our PoC for variant 2 that, when running with root privileges inside a KVM guest created using virt-manager on the Intel Haswell Xeon CPU, with a specific version of Debian's distro kernel running on the host, can read host kernel memory at a rate of around 1500 bytes/second."
It depends on the device firmware.

So if you happen to have a good device, it just works, if not it can be a big pain yes.

With Rust, currently, there isn't even the option with a good device firmware.
I don't think I've seen a modern IDE that doesn't either have vi/emacs keybindings included or has a rich enough ecosystem for someone else to do so. I'm someone that cut my teeth in Linux, on many distros that never had pico/nano installed but to this day I still have to lookup basic references just to get anything changed on those systems. If I have the access, I immediately install nano because I can handle those keybindings a little easier.

I feel like Atom or Visual Studio Code are good pseudo IDEs but a lot of people hate the Electron tax. I spend most of my day in PHPStorm (ugh php) but I have both Atom and VSC installed primarily to understand the life in between a seemingly more 'dedicated' IDE like PHPStorm over this in between both editors seem to fill. They're primarily editors with IDE layers on top and for the price of $0 it's a good place to cut your teeth if you can stomach the tax. The JetBrains IDEs do have generous evaluation periods but I don't think you would be in an extremely comfortable place at the end. It took me a little more than 30 days to become as intimately familiar as I am now but like the bigger Visual Studio at my last gig, there's parts of PHPStorm I just don't touch and maybe never will.

This is probably not the best answer but there really isn't a one-size-fits-all kind of transition either. I think the most rudimentary concept that sold me on a proper IDE over an editor was syntax checking. Editors like emacs or vi may have better support for that than Coda or Notepad++ but knowing the script won't compile immediately vs deploying broken code and finding it there has more than paid for the difference. The most powerful feature of PHPStorm for me is setting breakpoints and having the Xdebug integration give me a peek at everything visually. There are still cases where I debug with echo/var_dump statements but if I can attach the debugger, I can do so much more. The likely biggest draw for a JetBrains product is the refactoring capabilities. Again, some editors likely do refactorings really well but when my refactoring in Notepad++ involved just find/replace it really isn't comparable in the slightest.

I think at the end of the day productivity gains through workflow changes are something I'm constantly looking to adjust. Even though I'm very happy with PHPStorm, I have VSCode and Atom primarily as a means to reevaluate my understanding on an ongoing basis. I realize for a lot of people "if it ain't broke, don't fix it" is perfectly acceptable though and if you feel really productive, chances are you are.
> inside