skysight-inc/HackerNews huggingface dataset:
* after one hour of inactivity.

The vulnerability may still be present in the allowed timeframe. This could just lead the investigators to carry around portable cracking devices to use at the earliest moment they can. A kind of technology arms race?
Let's not forget this one:

http://sasheldon.com/blog/2017/05/07/how-i-broke-cargo-for-w...
I’m sure there’s variation across groups, not to mention generational differences in assertiveness, but also consider the range of recordings which might exist. I was at the Museums and the Web conference a few years ago and there was a really interesting talk by a Canadian talking about the software they had to build to meet their agreements. Even with a single tribe you might have some recordings which were public but others which were considered tribal secrets (i.e. they restricted logins to verified members), some which were only for men or women, some which were only for elders or shamans, etc.
If the article is correct, that he bought those shares specifically to burn the shorts, then good for him. It's no coincidence to me that in a time where TSLA has the largest short position on the planet that there seems to be daily front page negative press. Having the CEO flip the bird to nay-sayers and triple down is a good sign. That kind of tenacity is what I believe makes him successful, "Screw you, I'm gonna make a Trillion dollars here!"

Disclosure: I have a small TSLA position, but I do consider it a high risk venture that has just as good a chance to buy me a house in 20 years as to go to 0.
Once the architectural registers are zeroed in a path that can't be speculatively skipped, the other values in the register file are dead and can't be exposed.
I won against them in small claims in Atlanta, and they sent me a W-9. I refused to fill it out and they still paid, after I got a court order approving a lien against their property. The judgment was for less than $200 though.

(17MS094034, Fulton County Magistrate Court, Georgia.)
Great article! I really like the notion of code ownership over checklists.

However I wonder how this would be implemented in reality. Write permissions in git are managed by having different repositories. Splitting up your code base into several repositories has serious drawbacks in terms of maintainability and deployment.

There is definitely something to code ownership and I‘m looking forward to follow up articles.
Mon Ami – Bringing play to dementia care
Thought it was effected by spectre - meltdown was the exploit that only effected a subset of the market. Meltdown is specifically due to load speculation happening prior to verifying access permissions.

Spectre is more generally due to load speculation modifying the cache while inside a branch speculation context. Basically it effected every high performance cpu in some way. Note that saying there’s a protected/safe branch instruction is only effective if the default branch code gen uses it, so I’m not including such mitigation’s when saying “not effected”. I believe that to be a justifiable decision.

Essentially the only cpus that weren’t effected were those with very little, if any, out of order execution. None of them are considered to have competitive performance.
Did you get any sense of whether or not Equifax intends to appeal the decision?

There was some discussion about 6 months ago -- https://www.reddit.com/r/legaladvice/comments/7h9tn2/i_sued_... -- suggesting that it looked like their strategy might be to lose in small claims court but to appeal any decision against them.

(And see also https://www.reddit.com/r/legaladvice/comments/7lz38l/tried_t... which seemed … more like it might be fan fiction rather than a real story.)
Oh wow, interesting, thanks for sharing! So it says:

> In addition, if a file has any file capabilities, these are stored in an alternate data stream for the file. Note that WSL currently does not allow users to modify file capabilities for a file.

I've never actually seen this used... I wonder what commands would trigger it?
How are the current placeholders for OneDrive implemented?
Contrast this with the Postgres addon community, which has a culture of pushing changes upstream until they no longer have to maintain a fork of the Postgres code.

Build a business on a fork, then compartmentalize it until it can run without modifying the core so you can get off the bugfix treadmill.
It was probably impossible to find a buyer.
I really like SHIF, if you have a physics-y bent it's great.
Seems like a great way to make money. Train everyone to be weary if you're cagey answering questions.

1) Short your stock.

2) Hold press event.

3) Get cagey about questions.

4) Profit.
> The attacker can do timing on his side

Yes, I mentioned that in my comment:

> We also need to prevent attackers from being able to time their code's execution remotely.

I don't think it's impossible to mitigate.

First, not all use cases actually involve the attacker being able to directly invoke and then measure the timing of their code. Imagine, for example, that I'm using attacker-provided code to apply some image manipulation to a photo on my phone, then I post the photo online. The attacker doesn't have any way to know how long their code took to execute, and I can be confident that they haven't exfiltrated side channels through the image via steganography because their code was deterministic so couldn't have incorporated those side channels into its output.

Second, I don't think the space of timer noise techniques has been adequately explored. Timer noise is one of the main defenses browsers have deployed against spectre, and pragmatically speaking it has been reasonable effective. Yes, in theory there are lots of statistical techniques an attacker might use to get around it, but it certainly increases the cost of attack. We need to figure out how to push the cost of an attack out-of-reach, even if we can't make it completely impossible.
Facebook Watch, the platform this is on, is a VOD platform. Serialized entertainment video content on a video-on-demand platform is usually the raison d’etre of the platform.
> 2. The scalability of edge computing requires finer-grained isolation than process isolation.

Why? Browsers are moving to one process per security domain anyway. Workers spawn their own threads too. You have to make your processes more lightweight and optimize memory-sharing, but that's exactly what's happening.

There's also some vodoo one might be able to do on linux with the clone syscall which lets you spawn a new process which still shares the same memory as the parent.
You'd just have to organize daily deliveries from the Entanglement Man.
No clue! I don't use it and I uninstall it wherever possible, so I haven't really considered it part of the OS. :P But yeah, it's totally possible sync programs use it too.
The press kit from the Trump-Kim summit included a possible malware USB fan
Note, they are not just reserved names, they are reserved names with any extension.

So when a Unix user checks in a file named "aux.c" to your project, it will cause problems for Windows users.
I once heard that Jenny's number (8675309) in your local area code is almost always in these rewards card databases. I've tried it on occasion, never had it fail, and it always makes the checkout person smile.
Every error message ever written in R: "Error"

Hmmmmm, okay after 20 minutes of squinting at the script I see there's a lowercase letter at the header name of the last column somewhere in the middle of the 200 lines...now we can move on to debugging the next "Error"...
Depends on the game.
And that is a perfect example of why corporate management and other insiders are subject to all kinds of restriction on trading their company’s stock.
One thing that is getting lost in the noise they have like a 40% profit margin and many new properties are profit share with the developer/owner of the property. They are spending very aggressively on expansion but unlike Uber they actually have decent margins.
Polly.js – Record, replay, and stub HTTP interactions
while the supply of digital coins is infinite (you could fork btc, or any other chain, or create different coins that could then be forked)

This is bull. It's not zero cost to fork a cryptocurrency. It's not zero cost to mine. The supply of a digital good might well be very large. However, it will most certainly be finite.
It goes both ways. One can argue that setting up css build tooling would be time better spent elsewhere (and if you ever did corporate or legacy work that can be painfully true)

In many cases, a mindset of not doing needless extraneous work is the result of having seen crushing complexity, and it's a mindset that goes a long way. As the saying goes, better to be the master of your tools than a slave to them.
There are ways to fly reasonably fast with rather cheap technology, if you have some way of bringing the fixed-wing aircraft up to at least over about half the speed of sound. This would e.g. be easy to archive if you use something like a coaxial folding propeller, though if you try, you could probably get away with a single folding propeller, or at least without needing the coaxial nature to provide counter-rotation, as a large enough part of the wings should be outside of the whirl the prop creates, so it can provide enough force against the prop to keep the plane spinning relatively slowly.

The technology I'm referring to (a ramjet) is unfortunately not too efficient, but the low-tech nature of it, at least as far as manufacture is concerned (design benefits greatly from modern computational fluid dynamics), makes the manufacturing cost of it, including a fuel tank, come in at about 10-100$. It's basically a fancy shaped pipe with something like a fuel pipe or so coiled around it (for cooling and to ensure sufficient temperature of the fuel), which can just be hydroformed from a seamless section of stainless steel pipe. They guzzle fuel, but as long as you either have an electronic valve a microcontroller can adapt to e.g. a simple flow meter or pressure sensor, along with a temperature probe, they only need the fuel to contain enough butane/propane or so to self-pressurize, and otherwise require the fuel to not tar/char/soot up any of the fuel nozzles and such.

Theoretically, though one might prefer to run it on liquid hydrogen in that case, the same technology, but with different tuning could run a similarly rather cheap Mach 2~3 (at surface level) reaching thing light enough to be lifted by a pair of movers or similarly build men. That would be hard to do without going for the hydrogen, and that is unlikely to be prevalent on a small pacific island.

Both of these potential things do fall under the category "Your scientists were so preoccupied with whether or not they could they didn't stop to think if they should.", the latter even under the category "ITAR want's to have a word with what you made there.", due to the necessary automatic navigation and speed, as well as technological level of materials used, as high-tech airframes are expensive.
The passages quoted there are considerably less incendiary than the text surrounding them claims, e.g. the very first one concludes that they shouldn't use their professional sites to fight harassment, only their personal accounts. Fighting against lies and harassment is not "pushing an agenda and silencing one side of the issue"--and I want to remind you, again, that the corruption allegations against Quinn are provably lies.

Regardless, in the worst case, since the GameJournoPros mailing list has not been publicly released that I'm aware of, your source and mine are equally cherry-picking to support their views.

You should be aware, however, that the source of your cherry-picks is Milo Yiannopoulos. Milo has, ironically, also been implicated in organizing journalists to push a narrative, only his journalist friends are literal, self-described Nazis. https://en.wikipedia.org/wiki/Milo_Yiannopoulos#Leaked_Breit... So I would be very, very wary of taking him at face value on any subject involving women or politics.
Deterministic code cannot receive a side channel. It may, as you point out, be able to transmit on a side channel. It might even be able to "reflect" one side channel into another one. But these risks seem both less severe and more easily mitigated. At least, the history of attacks of the latter types is not very impressive.
Having high karma and highly rated posts won't stop you from being arbitrarily banned for no real reason however.
> I don't know where the 4% comes from

Originally from the Trinity study: https://en.wikipedia.org/wiki/Trinity_study
DOS originally had no directories.

When they were added Microsoft could have chosen to put special devices in their own directory (eg C:\dev on each device, or reserved D: for devices, or any number of other schemes). Instead they decided to make these special device names be implicit members of every directory on every drive.

Similar to make treating whitespace as significant, the decision to be compatible with the relatively few existing users doomed many, many more users in the future to endless problems. Backwards compatibility has a non-zero cost to users too!
Is there a name for this phenomenon, where a category is defined so much by "weakened" examples of it (e.g. your average 1/10th programmer, or your average mostly-just-a-library-clerk librarian) that, upon seeing a central example of the category with all the features the category is denotationally supposed to have, it actually seems non-central (i.e. "not really a librarian" or "not really a programmer")?
If you want to explore that topic more, check out "The Sports Gene." Spoiler alert: it comes to a similar conclusion. It's one of the best books I've read though!
Would it have been possible to bring up the stress and anxiety this data breach has caused? Personally, this has been the case.
> You seem to have back pedaled from your original absurd claim.

Not at all. The GamerGate movement began with people looking to punish Quinn for her infidelity, and people who already hated her game jumped on the bandwagon to invent conspiracy theories to explain why it was well-reviewed. These people jumped to the demonstrably false conclusion that she had traded sex for reviews, and that narrative, unfortunately, went mainstream, and caught the attention of people who legitimately cared about journalistic ethics and weren't aware of the previous facts.

And that's still continuing--you see a lot of well-meaning people in this thread who are still not aware how much of the sex-for-reviews narrative and the GameJournoPros narrative are outright lies.

> Its hard to find any neutral source that aggregates all the factual information. Does this website cover everything? Do you have an alternate source?

That site may work as a timeline, but whatever your position, I think we can agree that GamerGate's own wiki is not an unbiased source.
I find this whole “owe $18b in rent” thing that’s come up recently interesting.

They only "owe" $18b in rent the same way any company leasing office space "owes" their landlord money. The word "owe" is thrown around here in relation (almost exclusively to WeWork) to imply they're in arrears to the landlords to the sum of sum of $18b.

It isn't anything like that - they have leases over the next 10-15 years with a contract value of $18b.

Over the length of their leases they have an $18b obligation, but that isn't the same as the way "they owe 18b" is used colloquially to mean currently in arrears/default.

It is the same as entering into any agreement - over the agreements length you have an obligation, which if you can't service you're insolvent.

I guess I find the narrative that they "owe" $18b to imply a far greater extent of distress than the reality of their leasing obligations actually entail.
I think you probably do need to execute the should-fault FP access in a not-executed speculatively executed branch (à la Meltdown), so that the exception doesn't actually fire and the kernel doesn't reload your own FP state.

(Since you can only learn a small part of the state each time, you need to have the other processes state remain in the FPU while you repeat the process to learn the entire AES key or whatever).
I use Google Photos and iCloud photo syncing. Pictures and Videos are automatically downloaded to my Windows computer.

https://support.apple.com/en-us/ht205323
AFAIK the entire idea dates back to the days of the 80286/80287 (and 80386/80387) when accessing the coprocessor was slow, and a TSS switch (Linux used it until the late 1990s) set that bit for you.
Never submit to the bullshit tastemaking of some pedantic asshole.

They will bleed you dry, in an effort to extract conformity from you.

If you don't like my code, write your own fucking compiler, and I'll have my code interpretted by it. Not you.
>very few companies can create the kind of global footprint that WeWork now has

If other companies were able to lose $900m/yr and still operate I bet they would be able to create that type of global footprint
Ah Linus - enough said. The UMF spec wasn't intended to be a standards paper. You might be able to tell it isn't formatted as such. Based on the comments in this post - it has at the very least helped spark interesting feedback and debate.
If you have the need to talk to someone, you can find low cost Therapists.

They are usually students, but I found they were better than the licensed MFCC, and PhDs. The sessions are recorded, and listened to by a licensed therapist.

I believe most medi-cal doctors will prescribe antidepressants. Yes--the medi-Cal system is not great. The drug formulary is workable though. There are some very good medi-cal doctors though. They don't have the much time with the patients, but if you go in with depressive symptoms they will prescribe. A nurse might give you a depression screening. They never worked for myself, but I was told I'm not really depressed. And as my doctor always said, "All my patients are different."

The average medi-cal doctor writes prescriptions for psychotropic drugs daily.

Hang in there. I don't know your age, but the twenties/thirties are a bitch. Just a cluster puck of hormones, expectations, etc.

Don't let this society drive you nuts. The economy is suspose to be blissful. I don't see it. I just see the wealthy getting ahead. I notice so many very unhappy people. We are at a weird time in history?

If I had a do-over, I don't think I would have tried so many anti-depressants. I fell for the advertising. But--but, I'm no Psychiatrist.

Oh yea, too much alcohol can make depressive symptoms worse. I'm not preaching, but I know first hand.

(A bit off topic, but sometimes not having great insurance is not a bad thing in the long run. I have met a few people with good insurance that are vastly overmedicated.)
Jessamyn isn’t a random Joe. But any random Joe can in fact make a Wikipedia entry, as long as it comes with verifiable facts, that’s kind of the point of Wikipedia.

There are almost a million pages for living people, according to this https://en.m.wikipedia.org/wiki/Category:Living_people They’re not all famous, they just usually have publications by them or about them.
It's affected by spectre, but not meltdown.
IMHO, the real innovation here is 3 fold:

- A fresh presentation on small suite / desk rental + some trendy common area space (vs legacy players like Regus which had gotten very tired)
- Having space that's largely built out. Companies can spend $50 - $100+/ft getting space ready for their use
- Bridging the mismatched term expectation between landlords (desiring 5-10 year terms) and smaller tenants (desiring 0-3 year terms).
> Because that is the commonly understood definition?

It didn't come from general use by the population.

At some point academia decided to use a definition that deviated from the mainstream.

Certain fields of academia have a long history of doing this and it has led to millions of average people being mis-informed.

> As lay people we do get confused when we don't understand those terms.

Yes even the well educated hn reader gets confused - and so how do we fix this?

Either we have to fix academia or we have to fix reporting on academia.

Especially because the majority of the population does not have the education or time necessary to properly investigate for themselves.

Propaganda by any other name...
> The problem is, how do you build a back door that can only be used by people with valid (and just) warrants?

That's an interesting technical problem. A lot of people dismiss it as impossible out of hand, but they are underestimating what you can do with modern cryptography.

You make it a distributed back door that requires several independent third parties to cooperate to use it.

You choose the third parties so that no particular warrant seeker will be able to get enough power or influence over enough of the third parties to force them to enable the back door unless they think the use is valid and just. (You can actually design it so that the warrant seeker does not know who the third parties are).

Some aspects of this may be too complicated to be practical, but it is not impossible.
Could you point at the part where I blamed immigrants? I knew when I posted that the HN crowd would likely hallucinate that I had done so no matter what precautions I took, but I want you to poke at that hallucination and watch your hand go through it.

I want you to understand that your mind created this mirage in order to protect you from the cognitive dissonance of telling someone to enjoy ruin at the hands of competition while simultaneously enjoying stringent protections from the very same kind of competition.
This is a great example that shows how poor most non-web debugging and logging. The ability to mix and match data types and presentation format is extremely useful. Almost everywhere else we just have printf. And that’s printf going to stdout — there isn’t a universally deployed format to even allow it to travel easily over the network and be viewed on one of many useful and advanced viewers.

I think part of the problem is that programmers rarely want to get into these supportive details; they just printf and get on with it.
"It's really not a sincere attempt to create [X] as it is to masssively enrich early adopters by encouraging use by normal people."

So it's basically a trash startup.
>One startling finding in the report was that the hiring agents who were deemed most anti-black (according to bias testing) rewarded black referrals more than the nonbiased white employers

I don't have access to the study - is there any explanation of how they concluded if one was bias or not? Seems like this is a fundamental component of the study and yet their own results seem to contradict its outcome.
Hey, thanks for that citation. That was really helpful for me to understand this critique of the data. My reading is that the 40% figure still represents the switch to Autosteer, but because the first cohort contains both AEB and non-AEB data, we don't know how much of that 40% improvement to allocate to Autosteer vs how much to allocate to AEB. Makes sense.

It's too bad that NHTSA didn't present the AEB-only cohort in the report (i.e. pre-AEB vs AEB vs AEB + Autosteer instead of just pre-Autosteer vs Autosteer).

I respectfully disagree about TACC and Autosteer (or put another way: my experience with them leads me to the opposite hypothesis, and thus my burden of proof is flipped from yours). Hopefully between Elon's promised quarterly reports, NHTSA's current and future investigations, and Tesla putting more cars on the road, we'll get better data on this moving forward than we've gotten to date.
Yeah I’d say that modern OoO Arm implementations (A57, A72, ...) are worth trying to speculate into trapped VFP state. Lazy FPU is definitly a thing everywhere.

My hunch says that chips affected by 4a could easily be fair game (4a is speculating reads into priviledged regs... I wonder if 4a would work on regs that are trapped, not inconceivable)