skysight-inc/HackerNews huggingface dataset:
> The platform will never forget, there will be no second chances.

Or worse. This reminded me of this recent comment:

https://news.ycombinator.com/item?id=17694032

The paragraph in question:

> After an agent had been terminated, their punishment points would decay over time until such a time they reached zero (or another configurable threshold depending on how desperate the company was for warm bodies), at which time they would be sent an e-mail to their personal e-mail (which was collected during the application process), inviting them to “re-apply”. Being an early telephony company we also would send them a robo-call with the “good news”. This process was known as a “life-cycle” and it was common in certain labor markets for employees to have many such lifecycles.

Seriously, give it a read and cry, if you haven't...
That's how I felt about "thinking fast and slow" but it may be that I didn't grok it's meaning, or that I'd already been exposed to some of it's contents.
ISO 3103 (standardized method for brewing tea)
Howdy, former Matasano pentester here.

FWIW, I would probably have done something similar to them before I'd worked in the security industry. It's an easy mistake to make, because it's one you make by default: intellectual curiosity doesn't absolve you from legal judgement, and people on the internet tend to flip out if you do something illegal and say anything but "You're right, I was mistaken. I've learned my lesson."

To the author: The reason you pattern-matched into the blackhat category instead of whitehat/grayhat (grayhat?) category is that in the security industry, whenever we discover a vuln, we PoC it and then write it up in the report and tell them immediately. The report typically includes background info, reproduction steps, and recommended actions. The whole thing is typically clinical and detached.

Most notably, the PoC is usually as simple as possible. alert(1) suffices to demonstrate XSS, for example, rather than implementing a fully-working cookie swipe. The latter is more fun, but the former is more impactful.

One interesting idea would've been to create a fake competitor -- e.g. "VirtualBagel: Just download your bagels and enjoy." Once it's ranking on Google, run this same experiment and see if you could rank higher.

That experiment would demonstrate two things: (1) the history vulnerability exists, and (2) it's possible for someone to clone a competitor and outrank them with this vulnerability, thereby raising it from sev:low to sev:hi.

So to be clear, the crux of the issue was running the exploit on a live site without their blessing.

But again, don't worry too much. I would have made similar errors without formal training. It's easy for everyone to say "Oh well it's obvious," but when you feel like you have good intent, it's not obvious at all.

I remind everyone that RTM once ran afoul of the law due to similar intellectual curiosity. (In fairness, his experiment exploded half the internet, but still.)
Parents were talking about kings, not about service people.
It will likely benefit their users. AMD's EPYC processors are cheaper for the same performance as intel's, as well as allowing more memory per processor.

As they allow more cores per socket this can also often massively reduce per-socket licensing cost, if you have the misfortune of using software which requires that.
Cast Iron Bathtubs on Feet and Pedestal Basins
> Clearly, they don't have an answer to AMD at all. If this is true, their shareholders should be asking serious questions about why they've nothing significant to show for all that time and money spent when they were raking it in without a serious competitor.

But they have lots to show for that money!

Brand change implementations such as "Gold" and "Platinum", which gouge the customers more than ever before.
Neural Mechanisms of Sustained Attention Are Rhythmic
Look at the default mitigation; the full one disables HT. Unless you're a cloud provider, the default is probably enough.
I was in college in the 70s, so yeah, it was a fun time for me when I think back on it. Who wouldn’t want to hear Aerosmith live in a club with maybe 80 people there before their first album.

But I walked to class cold and wet on many days. Gortex hadn’t been invented and I couldn’t afford a car. When I got my first real job I bought a car, but I carried a toolbox in the trunk. Cars broke down frequently and with no cell phones you were on your own if the car stopped running. A car accident could kill you in a 35 mph crash. I also carried a state highway map and a city map of around 100 pages in a spiral bound book because there was no GPS.

The best medicine available seems primitive by comparison to today. I had classmates that wore leg braces due to childhood polio. People were still dying from rabies, TB, and even Smallpox. There were cholera pandemics. No MRI, no CAT scans.

I was studying programming. I had to walk to campus at night to punch cards. No internet, no terminal, just a place to drop off cards so that you could pick up your output in the morning.

I was middle class in the 70s so I had it much better than many others. Most of us grew up with a single wired phone in the house, only one full bathroom, one black and white TV that received three channels, no DVD, no CDs.

A VCR player in 1975 was big and heavy and cost over $5000 in today’s dollars so none of us owned one.

Ubiquitous discrimination, bigotry, and prejudice made it harder for many to be middle class like I was.

Even in the 1970s, life was still much much better for me than my parents that had grew up on small farms during the dustbowl days of the Great Depression.
The work just doesn’t matter in the grand scheme of things other than providing jobs for other people. But if we look at it from job creation point of view then just about anything can be viewed as valuable.
Microsoft had a market share around 95%. Quite a difference there.
Dynamic Interplay in Frontoparietal Network Underlies Rhythmic Spatial Attention
"you can easily get the complete works of Shakespeare"

Leonardo was not a publisher. The works you could describe "complete" were either individual works of art or reproductions (by him or others).

e.g. https://en.wikipedia.org/wiki/Lady_with_an_Ermine

And so on.

Leonardo kept notebooks for himself, and are filled with miscellanious topics as paper was expensive. The so called codices (Codex Atlanticus and the referred Codex Arundel, etc.) are collections of his notes.

The only published work that was graced by Leonardo's pen was the book "Of Golden ratio"[0] by Leonardo's friend, the mathematician Luca Pacioli, for which Leonardo provided illustrations of solids. You can find a digitized version here

https://archive.org/details/divinaproportion00paci

The solid illustrations start at page 140.

While to modern eyes Leonardo's work may appear 'ordinary' it is infact groundbreaking - he innovated many of the things in visual presentation which we now accept as 'standard' or 'common'.

And to a physicist it is most astounding that he came up for example with Newton's third law and the law of friction in his studies hundreds of year before they enter the historical knowledgebase. Sadly he may have been history's greatest inventor and artist but he was also a procrastinator extraordinaire. He planned many books but never completed single one.

Yeah, Isaacson's biography of Leonardo was pretty awesome [1].

[0] https://en.wikipedia.org/wiki/De_divina_proportione
[1] https://www.amazon.com/Leonardo-Vinci-Walter-Isaacson/dp/150...
I consider the ability to work with legacy codebases an essential skill. If you can’t do that, you’ll be changing jobs like other people change underwear.

Any codebase that sees real usage will accumulate cruft, odd behavior and legacy code over time. Dealing with that and assessing what’s worth refactoring and what’s best cut or even just left as it is to reach a business goal is the skill that differentiates a seasoned engineer from a code monkey. That shitty legacy code is often what brings in the money to sustain the company, otherwise it would have been turned off long ago.

Microservices don’t help much in that regard: each micro service can look squeaky clean from a code perspective and the whole system can still behave in shitty, unpredictable ways. (Been there, seen that)

It’s also not about fitting in: taking on a shitty codebase and transforming it into something better is an outstanding skill and requires constant communication with all stakeholders, especially when you want to cut legacy stuff. It’s certainly not something for people that prefer a quiet corner.
Destroying unique historical monuments is not thrown upon in the time of war, so perhaps there is a solution. /s
How to suppress unused method inspection in IntelliJ for a specific method
Former Facebook security chief says it’s ‘too late’ to protect 2018 elections
Dont forget Puma series of broadband modem chipsets bought from Texas Instruments in 2010. All defective, 3 generations and hardware is still not fixed, just this month Intel released some half assed software patches.

https://www.theregister.co.uk/2017/08/09/intel_puma_modem_wo...
Going to go off on a tangent here.

Yes and no. By raw numbers it certainly is in a state of decline. But put in context, it may have been inevitable. It has everything going against it.

DotA is a team game.

It's incredibly complex. Not easy to pick up. Mastery requires 1000's of hours. And it's miserable to play at the start.

The community is toxic. So random teams in a public match when you are new to the game compounds. Even if you aren't new, one way or another random teams can quite often be a frustrating experience that you just don't feel you have control over.

Compunding even further is the fact that once you start a game you are locked in for 35-55+ minutes. That can be 35 painful minutes of feeling crap.

Compare that to rising battle Royale games, and you get solo games you are allowed to be bad at and slowly get better in. And the time you spend in it is directly related to how much fun you have. And the games have a definite time cap. And the mechanics are simple. This holds true for a lot of other up and coming online casual multiplayer games.

Point is, Dota is destined to be niche as a game that is played.

What i would love to see is how the game can change externally to become more accessible to viewers. From client changes to community changes to changes in presenters, valve needs to step up to help people participate as spectators. The potential for the game to generate significant money lies in their pro circuit and it looks like valve is really stepping up their involvement here. Hopefully this continues.

The (somewhat poor) parallel is something like rugby or squash. Fairly arcane rules. A lot of people don't remember when they last played the game. But they can still be heavily invested in watching.
If they show reproducible results, then I don't see a problem. If they don't, well then you know it is either dodgy or not rigorous enough to take seriously.
I think you're onto something, but it's that the lower levels of Maslow's hierarchy are pretty much completely satisfied these days for all but the poorest people, so the meaning of those levels are eroded. Once upon a time, a good stew and a husk of bread were enough to make you feel genuinely satisfied with your life. These days a delicious greasy dinner with ice cream for dessert barely registers because you're chasing mates and self-actualisation and stuff.
> Without end-to-end documentation of the entire build process for the final image, and secure hashing of the binary, open source means nothing. And even then...

And even then, you need to trust the machine. In many cases, these machines are using terribly old processors (sometimes even using the venerable 68000), and building a corrupted clone could probably be something doable.

The corrupted processor may have a different behavior, depending on the situation, such as the exact time of operation (ie. it would not be detected by random tests before or after an actual vote), or the analysis of people voting (ballot might be modified only during peak hours, to limit detection)

I'm baffled to see that democracies still engage in electronic voting systems.
Not to mention said designers probably had no chance for advancement and unless they learned on the job, they actually lost time to advance their own careers in places where their talent matters.
Broadwell and Skylake brings nothing much substantial.

Ironically, Broadwell's 128MB L4 cache did bring a substantial performance boost to a whole range of real-world applications, but it seems it's so expensive to manufacture that they've subsequently dropped the feature except for Apple's iMacs and expensive laptops.
Could you build on the always-unfair system along these lines? (C11ish, sorry)

void
do_work(the_work_t *w)
{
/* for simplicity here, rather than e.g. w->contenders */
static _Atomic int contenders = 0;

contenders++;
for ( ; work_remaining(w); ) {
take_mutex(w->m);
do_some_work(w);
drop_mutex(w->m);
if (contenders > 1)
reschedule_this_thread();
}
contenders--;
}

This depends on the OS providing a cheap and fast reschedule_this_thread() mechanism that effectively guarantees that if there is only one other contending thread with work, that thread will end up holding the mutex. (If there are multiple such threads, an arbitrary one of them will end up with the mutex, rather than the thread that just dropped the mutex.)

One could of course only check for other contenders every few times through the for loop if reschedule_this_thread() is expensive or slow, or if contenders is especially hot.

contenders is explicitly not a locking mechanism and should not influence the policy of any code running while the mutex is held. It should also be a per-mutex counter.
Windows Updates used to pop up an EULA to be agreed upon before installing certain anti-malware related software, not sure if that's the case anymore with Windows 10 auto-install-and-reboot procedure. I wonder if Intel could/would try to have Microsoft insert another click-to-agree EULA for this upcoming patch?
Ethics and Aesthetics
I developed this habit for a few years during adolescence, which I think was a reaction to the anxiety that developed at that time of life, relating to things like social pressures, academic challenges and parental expectations.

I can recall visiting the bathroom multiple times per evening to find new hairs to pluck out of a particular area on the side of my face, as a form of procrastination and distraction from stresses I was feeling.

I think it stopped when I finished high school, and I haven't exhibited this particular habit ever since.

However, it was in the year after I finished high school (1995) that the internet started becoming a thing, and I jumped on board quickly and developed the habit of frequently checking things (news sites, and, ahem, discussion boards) online.

I can't help but ponder that if it weren't for having a phone in my pocket and being able to reach in and check Twitter or HN every time I needed a dopamine hit or a distraction from anxiety, I might instead be carrying tweezers in my pocket and plucking hairs every hour or two :)
That’s already the case! The history API only supports the current origin. From MDN:

> The new URL does not need to be absolute; if it's relative, it's resolved relative to the current URL. The new URL must be of the same origin as the current URL; otherwise, pushState() will throw an exception. This parameter is optional; if it isn't specified, it's set to the document's current URL.

https://developer.mozilla.org/en-US/docs/Web/API/History_API...

The exploit in this article clones the appearance of Google results and competitor websites but leaves the user on the exploiter’s domain, so users who are savvy enough to notice the URL wouldn’t be fooled.
Theft/Piracy Types of Cybercrimes – You Should Know
Exploring IT Outsourcing: Ukraine vs. Poland
I also grew up in Richmond, and in fact my dad worked at Best. The corporate headquarters up in Ashland had a really impressive collection of modern art.
Welcome to the real world. I had the same thoughts when I first joined.

Learn to enjoy the feeling of thriving in a mess. Don't let yourself become fragile by it. Try to slowly turn that frustration into appreciation that you're growing as an engineer. Being an efficient, competent and likable worker even around ambiguity, spaghetti code, pressure and less-than-optimal communication will make you a rich and happy engineer.

The industry is much more than just hard skills. Build trust and improve as you go.
How to Avoid Cyber Attacks and Tips to Cyber Attack Prevention
What's not cool at all is the fact exposed here that Google lets anyone trick their users.
See also 4month old reddit

https://www.reddit.com/r/MachineLearning/comments/8ctksk/did...

Would be happy to hear from the creators about what was the hardest part to implement, and future plans.
Could you put an example of a real web API (maybe the github API) and show how you would call it with your library ?
I'd rather assume that it is in place to keep kernel and distro devs at bay.
This destroys the logic of free trade, competition that countries and a plethora of global organizations like IMF, WB promote and enforced aggressively over the last 40 years especially when looking for markets in other countries.

But if its only applicable to a favoured set and suddenly has all sorts of qualifiers when it comes to your own markets then the whole thing collapses. And everyone can see its politics with a fig leaf of process designed for one way benefit and as a system cannot deliver mutual benefits.
Intel are still ahead in low power mobile (laptop) CPU race, and the clear leader in the laptop market. Who knows for how long, though?
It's like almost every Apple Store works (when you're buying more than just accessories).
> So to be clear, the crux of the issue was running the exploit on a live site without their blessing.

Well, he wasn't running it on someone else's site, right? All the code ran on his site, so at worst he was guilty of trademark infringement or — if he copy-pasted HTML or rendered the same text — copyright infringement (which he could have avoided by just being a proxy to them, I think).

Or did I miss something? It doesn't sound like he did anything to other sites themselves.
And some people are sick to their back teeth of listening to new devs come in and whine about poor code without understanding any of the context. Perhaps you do know better than everyone else, but you ought to make damn sure of it before you open your mouth
>Should I just go and basically say that this person did a bad job?

You wouldn't be correct in saying that. That person delivered a project that works. In the beginning of a project, that's all that matters.

>I'm so frustrated and depressed by it.

Should you feel like that? It sounds like you're working to make things better.

This Simon Sinek interview about millennials in the workplace might resonate with your situation: https://www.youtube.com/watch?v=hER0Qp6QJNU
Smart plug flaw gives hackers access to business networks
Correct, which is why I said "Ubuntu and derivatives". Debian is upstream of Ubuntu, not downstream.
Breaking into the Finance Government Account of Every Portuguese Citizen&Entity
The legal aspects of honeypots were discussed a lot when they became popular. Just two examples:

https://www.symantec.com/connect/articles/honeypots-are-they...

https://www.researchgate.net/profile/William_Yurcik/publicat...

And they are still discussed, for example in the light of the new EU laws:

https://jis-eurasipjournals.springeropen.com/articles/10.118...
> Why would the legal risk ever be over?

I can imagine some scenarios:

- A company is bought by another one which has a different legal policy and voids some legal restrictions even retroactively

- By some other way, the "illegal" knowledge in the paper became "public knowledge", so that company lawyers will have a hard(er) time convincing a judge that the respective paper is of any danger and thus the author to be prosecuted. For example: After these microcode patches, people will of course privately do benchmark the performance differences. So some years later, the order of performance differences are kind of public knowledge.

- With time, companies have a much less legal interest to sue people for disclosre. As long as there is a high commercial interest, companies can be very "sue-happy". On the other hand, each of these lawsuits is a PR risk for the company. If the respective product becomes outdated, the ecomonical advantage of a lawsuite is much less than the probable PR loss.

- The researcher now (later on) lives in a different country that has a different legal system where there is much less legal risk. For example, in Germany, it is very restricted what can be included in the general business terms (in opposite to the USA).

In all of these cases, it can become much less legally dangerous to disclose the real identity of the author. On the other hand, there exists an incentive (academic credit) to do so.
You're making it sound like it's something bad but it's in fact what draws a lot of players and what makes it a game on a completely different level.
Wickr has a new plan for dodging internet blocks – The Verge
> Adam Levitin, a professor of law at Georgetown University, told me that if the lawsuits are successful, the banks will be on the hook “for hundreds of billions of dollars” and will likely go bankrupt.

I'm guessing that these lawsuits were not, ultimately successful?

Trotter's case ultimately failed: https://law.justia.com/cases/idaho/supreme-court-civil/2012/...
So US/AU government backdooring AU citizens is okay, but if China has access it's bad?

People actually think like this now? We just collectively rolled over and accepted mass surveillance?
This exploit uses the history API, which allows JavaScript to change the URL in the browser URL bar to another URL with the same origin without actually causing a new full page request. The same-origin policy has always been in place, because it would obviously be a huge vulnerability to allow any web page to pretend to be a different website.

Changing window.location is different: it allows you to change the browser URL bar to any URL (including google.com, etc.), but it actually causes the browser to do a normal page load of the new URL, just like if the user had clicked a link to the new URL. Thus there is no spoofing vulnerability exposed by the window.location feature.
> I'd argue the most interesting and important research is done in this way

Links please :)
> I offered 10 people the opportunity to live like people lived in the 1970's

Do I also get a dozen brothers and sisters? Eat food, drink water and breath air without having to constantly worry about being them polluted or toxic?

> would only have a black-and-white TV with 4 stations and a gramophone record player..

Sure. I would rather have a gramaphone record player or cassete player (which is more like 70s i think) that played ABBA or BoneyM than a 4k lcd tv that plays Lady gaga or Justine beiber or what ever crap that is "trending" today.
Go buy a copy of "Working Effectively with Legacy Code" by Michael Feathers.

Start there. That book changed my career. Just look at the chapter names here: https://amzn.to/2wnPHfi

Chapter 6: I dont have much time and I have to make a change

Chapter 7: It takes forever to make a change

Chapter 13: I need to make a change but don't know what tests to write

Chapter 16: I dont understand the code well enough to change it

Chapter 17: My application has no structure

Chapter 22: I need to change a monster method and I can't write tests for it

Chapter 23: How do I know that I'm not breaking anything?

All the stuff is gold. It applies to every language, every work environment and every client I've ever been at.

This is the #1 book I have my teams read.

edit: Formatting and addl chapters
Honest question: is AMD any better? Do they somehow manage to avoid Spectre / Meltdown without a slowdown?