skysight-inc/HackerNews huggingface dataset:
An unprivileged attacker with the ability to execute code

That sounds like a contradiction --- if you can already execute code, I'd say you're quite privileged. It's unfortunate that their demo doesn't itself run in the browser using JS (I don't know if it's possible), because that's closer to what people might think of as "unprivileged".

The attacker has no control over the address from which data is leaked, therefore it is necessary to know when the victim application handles the interesting data.

This is a very important point that all the Spectre/Meltdown-originated side-channels have in common, so I think it deserves more attention: there's a huge difference between being able to read some random data (theoretically, a leak) and it being actionable (practically, to exploit it); of course as mentioned in the article there are certain data which has patterns, but things like encryption keys tend to be pretty much random --- and then there's the question of what exactly that key is protecting. Let's say you did manage to correctly read a whole TLS session key --- what are you going to do with it? How are you going to get access to the network traffic it's protecting? You have just as much chance that this same exploit will leak the bytes of that before it's encrypted, so the ability to do something "attackful" is still rather limited.

Even the data which has patterns, like the mentioned credit card numbers, still needs some other associated data (cardholder name, PIN, etc.) in order to actually be usable.

The unpredictability of what you get, and the speed at which you can read (the demo shows 31 seconds to read 12 bytes), IMHO leads to a situation where getting all the pieces to line up just right for one specific victim is a huge effort, and because it's timing-based, any small change in the environment could easily "shift the sand" and result in reading something entirely different from what you had planned with all the careful setup you did.

Using ZombieLoad as a covert channel, two VMs could communicate with each other even in scenarios where they are configured in a way that forbids direct interaction between them.

IMHO that example is stretching things a bit, because it's already possible to "signal" between VMs by using indicators as crude as CPU or disk usage --- all one VM has to do to "write" is "pulse" the CPU or disk usage in whatever pattern it wants, modulating it with the data it wants to send, and the other one can "read" just by timing how long operations take. Anyone who has ever experienced things like "this machine is more responsive now, I guess the build I was doing in the background is finished" has seen this simple side-channel in action.
The best of the worst case.
Gotta love that Intel spin machine working in overdrive
Kind of off-topic, but with the direction GitHub is going with features and 'embrace, extend, (and to be determined with pkg repo) extinguish', I wouldn't be surprised if GH comes out with a Sentry competitor by 2021.
Is there an approved list of major cities where we have collectively decided that this behavior is just "okay" and "normal"? I'm growing a little tired of this mantra that because we can point to some place that indeed has it worse (or way worse) than SF/Seattle/LA wherever that it's not a problem or we're wrong to thing it is.
Yea the 'correct' approach is often to to both:

- You check for consistency issues on the client-side UI level, and give the user instant feedback when something is not right.

- You also create a db trigger to enforce the rule in the database itself. This way you, as a developer, can write your code with the assumption that the data is gonna be consistent when it comes from the database, even if something went wrong on the client UI level at some point.
I agree with the search, but being a map is where OSM shines.

When I visit google maps a see a bunch of colorful boxes and notable locations, I have no idea why it chooses the notable locations it does but it appears to be either paid or some sort of SEO shenanigans, a local curry place is list but one of the biggest train stations in the country isn't (Southern Cross in Melbourne), recently they've also tried to cover the map with the "explore" panel.

When I look at the same area with OSM it shows the train station and shows me the street names with the street names all those colored boxes (buildings) are information, without them they're just noise.
Designing Dark Themes for OLED iPhones
Sure -- for a good example, GPUs go partway there by not speculating (they still have cache hierarchies though). It works because GPU workloads have massive data parallelism, so while one group of threads (a "warp") is stalled waiting for data, the cores can just execute other threads. Sun/Oracle had built a number of Sparc chips along this line too, e.g. the Niagara (Sun UltraSPARC T1) tolerates memory latency by having a bunch of SMT threads (8 per core, IIRC?) rather than OoO scheduling.

The problem is that single-thread performance is really important for a lot of workloads, because (i) parallelization is hard, (ii) even for parallelized workloads, serial bottlenecks (critical sections, etc.) still exist, and (iii) latency is often important too (one web request on one core of a server, or compiling one straggler extra-large file in a parallel build, for example).
People are bad at understanding risk. Tell someone that this change will save the company enough money to bump the share price by $2, but there's a one-in-a-million chance per flight that it will cause a crash that will destroy the company instead. Do you go for it? A lot of people will hear "one in a million" as "basically impossible" and say it sounds great. They'll probably rationalize it further by deciding that you're being paranoid about the risks. And then a while later you have a few hundred dead people and a company with a shattered reputation.
Weird, weren't GitHub and friends restoring these repositories for these unlucky users?
Material Design Guidelines for Dark Mode
Yes but they probably can't subpoena corporate data/emails to complete the necessary due diligence. They need the FBI to seize evidence, if that even exists.
In this chase, "ch" is pronounced as "k", not as one of the two German ch-phonemes that don't exist in English.
This is what happens when you are trying to do manufacturing “Silicon Valley” style
What about having "real" Firefox is the important part?

Is it supporting Mozilla, or supporting browser engine diversity, or is because real Firefox has more checkmarks on caniuse.com?
Doesn’t criminal negligence exist in the US, along with a number of other statutes that could apply? Not to say they would face trial here if the events occurred here, but there are laws that would apply given sufficient evidence of wrongdoing.
> I actually think YouTube (as a hosting/sharing platform) is a net-negative for the internet because there are already millions of videos that were embedded in pages that are no longer working because YouTube removed them, the account was deleted, or any number of things. If the internet worked the way it was intended, these videos would have been hosted on the site rather than embedded and would be still working.

If it wasn't for YouTube, most of those videos never would have been embedded in those pages in the first place. If the situation you describe was in any way feasible, people would have done that in the first place instead of using YouTube. You're asking for an imaginary free lunch type of situation.
I believe we need to do away with “the Kaiser’s trick hour” and restore a truly reliable, truly American sense of time
Stand up for your code and certify it like a mechanical or civil engineer certifies what they make or don’t wear the title of engineer. It’s time to take on all the qualities of the sobriquet not just the status and the salary that was appropriated.
" and there's no reason to believe a similar focus on the other companies' products wouldn't also find unique problems."

Sure there is. Just like the first round last year, intel totally through AMD under the bus to save face and stock price. That is the reason to mention AMD literally, to keep their stock price from crashing.
> It seems to fit pretty well the descriptions of the "rudeness" and "boldness" in common Israeli culture.

Also seems to be a pretty accurate description of SV/startup culture too...
its in all high end dog foods.

that are killing dogs (degenerative cardiomyopathy).
You can compute with less than that. (all links are to the same thing)

https://github.com/xoreaxeaxeax/movfuscator

https://m.youtube.com/watch?v=R7EEoWg6Ekk

https://news.ycombinator.com/item?id=18991404
Semiaccurate's theory, based on their impression that only 1-2 fabs are dedicated to 10nm, is that it has some of the things they're planning on using in 7nm, and they might as well make some chips to sell while they debug them.
There are (at least?) three different ways "ch" can be pronounced in German: Throaty as in "Buch", a slightly altered "sh" sound like in "Bücher", and just as plain "k", like in "Lachs".
What I'm getting at is you live in a city, not a college town. Cities have large populations which means some of the citizens are anti-social and derelict. It all comes with the price of living in a city (especially in the United States).
Please don't break the site guidelines by making insinuations about astroturfing without evidence. If you're worried, you can email us and we'll look at the data. People reach for this image to explain why they're seeing a bunch of posts they disagree with or dislike—but the overwhelming majority of the time, it's simply that the topic is divisive, with lots of users on opposing sides.

https://news.ycombinator.com/newsguidelines.html
Indeed, the Modern English descendant of the Old English cognate word (still present today as a Scottish dialect word for "salmon", supposedly), would be "lax" - https://www.etymonline.com/word/lax
Here is an interesting thought: in UX design and when building a startup we are encouraged to interact with users to learn what they want and need, then we craft the experience and values around that. Does this ever happen in civic planning? Do city planners ever talk to the public, to design experts, to community leaders? I honestly don't know, but I suspect the answer is NO.

When I moved to Japan it was sort of strange to see residences and businesses in the same building. The longer I live here the clearer it becomes that zoning laws have a lot to do with good civic planning. Of course there are side effects to open zoning, communities don't always look as beautiful (but I think the blame also falls on planners / lack of community effort), but overall loose restrictions allow for more useful places. When I lived in Irvine, CA, I had to drive everywhere to do anything. The sad thing is many people choose communities like Irvine precisely because it is structured this way (I did initially). In truth, you can visually tell how depressed everyone is and how hard they try to make themselves feel better. Despite the average income being below 100k for couples, people are driving 50-130k cars, living in places they can barely afford all for the sake of image. I would argue that the image issue stems in large part from loneliness and a feeling of isolation.

In all, I agree that perhaps the issue is not any one factor, but all of them combined. Rise of technology, fall of communities, poor civic planning, increasing income disparity are just the tip of the iceberg.
> That sounds like a contradiction --- if you can already execute code, I'd say you're quite privileged.

If you're in a VM, you have no privileges over the host CPU, you can't switch to another VM or to the host itself. That's what's meant by unprivileged here.
What they need to do is integrate their BaRT and Muni cameras, feed them images of felons with outstanding warrants and alert authorities when they ping so authorities can check it out.

But, as always, the SF supes are entranced by high-viz lo-impact measures. It’s their MO.
It should take a couple of days, also Intel is coming off continuous losses.
HackerNews: Huueerrggg Huawei can't even write secure code

Cisco: Hold my beer
Yes to clarify I believe OP is implying: there are more Yiddish words in current American English than there are Yiddish words in current British English.
According to this it's getting safer.

https://www.sfchronicle.com/crime/article/Homicides-fall-acr...
_Please_ stop parroting this line incorrectly.

Security _ONLY_ through obscurity is not security. Obscurity is a perfectly valid layer to add to a system to help improve your overall security.
You put it on a bagel and don't call it lox? The world is a strange place.
It's still a bit editorialized since this only affects ACI mode, not the default (and far more common) NX-OS mode.
Erlang was built in Prolog. Hence my analogy. It was not meant to -be- Prolog, and so doesn't support many of the things Prolog does, by intention.
What cities don’t have fentanyl overdose issues. Let’s forget about it, other cities are worse.
Short, frequent words are more likely to appear genetically related by chance.

Source: https://www.pnas.org/content/110/35/E3253
I’m amazed at how much power this city body is.

There used to be an easy solution to this: vote for change. The problem, in my opinion, is that San Francisco has passed the political event horizon of single party rule. There is a monopoly government with no hope for competition and a huge welfare state that keeps the machine moving along. This won’t stop until they run out of other people’s money or Roombas are sophisticated enough to clean up streets. Of course, they’ll ban those too.
I don't agree with that statement.
As a stand-alone physical machine is expected to be secure in its own enclave an I think it's within reason a virtual one would have the same expectations.
Nexus 9000, running ACI, not normal NX-OS, as opposed to the ASR 9000 series which are common internet routers.

Cisco model numbers are fun.
Is that really true? Granted I'm working on low volume stuff (1000's of units) in a niche B2B setting, but the times for rolling out a new rev of a board can sometimes be measured in quarters. Changing traces/components can have unforeseen effects for even fairly minor things, you can't just have a Tier1/2 CM tool up without a round of DVT. I doubt boards with the same PN change very often if at all, but I'd be curious to know if i'm wrong.
> Hardware engineers chose not to provide multiple sensors to validate AoA, hardware engineers did not provide a human-capable override. MCAS was designed to not be disabled by pilots, because doing so would make the plane a different aircraft according to the FAA.

I have two comments. One replace hardware engineers with 'management'

The second when I've read people talk about validating the AOC readings it makes me twitch a bit. Partly because my day job involves firmware that manages a self organizing sensors network. Validation of sensor data sounds easy until you force yourself to conceptualize what the system can know based on the actual data it sees and not your perceptions.

More there is a strong tendency to over focus on the ordinary case. And not all the edge cases. Very often dealing with edge cases is the fundamental problem. Consider designing the front end of a car. The primary design goal is actually 'passengers don't die when you drive it into a tree'

Problem with the MCAS system is it needs to work under all the edge cases, not just when the plane is flying in smooth air while the pilot is pulling the nose up. Like during a hard turn into wind-shear.
Online shopping isn't a necessity for the most part.
From where is the idea that the sound hasn't change, can be?

That is a incredible claim. Is common that all the languages across history to have an explanation in how was pronounced or have sound samples of how the people talk about?

Because that is the only sure way to do that claim.

Just taking in account the changes I see in my own city, is impossible that words not change the sound. Heck, you can bet it change among people in the same HOUSE!

ie: I truly want to know how this can be proved...
That loophole of govt getting things from third parties without due process needs to be plugged.
> if you can already execute code, I'd say you're quite privileged.

I always interpreted "privileged" to mean "superuser". I.e. unrestricted. Or possibly the case of one user and another user. Having a program that can determine the URL you are visiting in the browser from memory when running as the same user is a different class than something that can do the same when run as any non-root user on the system. There's a reason it's common to "drop privileges" in a daemon after any initial setup that requires those privileges (such as binding to a low port).
I know why it exists, and my point is they are not trying to show a gazillion txn/sec on 1MB of data. You are looking at a dataset that is several TB's. They have far surpassed the point where a vendor is trying to cheat by putting all the data in L1 cache and claiming to be fast.
Triplebyte
Intel's 10nm is a write off. Everything about it is a mess. They're basically trying to get some SKUs out in real volume to save some face, and then try to get their 7nm out in time.

TSMC plans to have their 5nm+ in volume in 2021 (5nm ships next year).

As for how Intel's 7nm stacks up against TSMC's 5nm+? We have no idea. We can't even go off of Intel's 10nm process cause its a complete clown show. Needless to say, by 2021 Intel's prior process advantage will be at least greatly eroded.
Wasn't it said that English isn't a language, but a bunch of midget dialects in an overcoat who trap nice languages in alleys, beat them, and rifle their pockets for loose grammar?
A similar initiative is The Land institute https://landinstitute.org/
They actually just got one of the crops they’ve been working with into a cereal.

It’s seems like crops that better perversive the balance of our planet will have a huge impact on the longevity of our tenure here on earth
Well if you have to ask... it's probably incredibly expensive. The Wikipedia link list customers as international airports, universities, etc., and calls it 'quite expensive'. Probably out of reach for private homes.
That is because they are all old white men and are being replaced by women getting into the industry. Don't need to be bitter that the SJW crowd has replaced you.
So effectively it did turn it into a DLC, making GP's post 100% correct.

I am past caring for or trusting their lame excuses at this point.
I’ve flown in many an E190/195 and almost as many E170/175 that I can specifically recall. The small size of the cabin is a large negative for many people. Carry on bags don’t fit near as well; the galley is small so food service is weak; for people afraid of flying, the living room experience in a 787 or A380 is far superior. I didn’t find cabin noise levels to be especially pleasant (nor unpleasant) in the small Embraers, but they’re amazingly nice in the 787 and even a step better on the upper deck on the 380.

I fly small piston aircraft for a lot of our travel, so even an A319 or MD90 is top luxury in some sense.

I don’t think people generally feel like they’re “settling” in a 737. I just got off a 737-800 BOS-ATL in fact. I do feel like I’m settling when I strap on an E170/175 on a short haul flight. I put them as clearly superior to Saab 340s and Dash-8 aircraft, but that’s about it. It makes taking the train (Amtrak!) seem worthy of consideration for BOS-PHL type trips.
Becoming a programming language and enabling awesome creative, aesthetic, and cultural expressions. Both processes feeding off each other.

HTML, CSS, SVG, etc. are wonderful things that I hope we perpetuate.
3 Year Timelapse – Raw Land to an Off Grid Homestead
I'm working on something like that right now, it's called listhub.xyz.
But I guess I'll stop working on it now that your thing exists. Or we can join forces if you want.

My idea was to be an alternative to all these hand-curated lists we see on awesome-whatever on GitHub and other sites like https://justmeat.co/.

The idea was to allow flexible schemas -- like every link could have a name, a description, another related link, a number and so on.

Later I was also planning on adding a simple API so people could generate static sites with the data imported from their lists.

And also a GitHub exporter so people could maintain awesome-whatever lists outside of GitHub but still keep them there.

Oh, also allow people to suggest items to the lists (with all the required metadata) and have them accepted or not (much better than opening a GitHub issue or PR for the case of awesome-whatever lists).
Comments moved to https://news.ycombinator.com/item?id=19915594 which is currently on the front page.
Several results in a quick search would refute that.

Sticking to a single brand[1] shows it's significantly high in iron. It's the only brand I recognized, but several other brands have similar nutritional content.

[1]https://www.bobsredmill.com/pea-protein-powder.html#nutritio...
No it isn't. There is no core tenant of unions that say they have to protect you from consequences when you commit reprehensible actions.

A union that did literally nothing but negotiate salary would be a perfectly valid form of union. The appropriate balance is somewhere in between.

And who said anything about the company asking for stuff. I've worked union jobs where we were overly protected. I wished we were less protected because it would have meant not having to clean up after the (rare, but especially noticeable) coworkers who don't give a fuck.
I'm so tired of hearing programmers complain about how useless programming interviews are.

I'm currently in the process of preparing for interviews. I'm almost 50. I'm currently talking with FANG and other well-known Silicon Valley unicorn startups so I don't feel any ageism yet. I hate it, though. But it's the reality of the industry right now. I don't pretend I'm above it, so I will do whatever I need to get a new job.

Yes, I hate them with a passion. Today I had a phone screen with a company and I was so nervous, I think I'm suffering from PTSD from how completely random the question will be, and how random the evaluator's perception of me will be based on said question. But I accept it for what it is. I'm auditioning for a role as "senior programmer", just like an actor would. That's the reality, and if I'm going to get myself a job that pays ~$400,000/yr in total comp, I will jump through whatever hoops I need to.

The OP was saying he was doing one programming question per week. Really? I'm doing 5 per night, and even more on the weekends. As I get closer to onsites, I'm going to be studying 8 hrs a day on weekends and leaving my kids to my wife.
That's not evidence of anything, it's just an outline of someone's screwball opinion. Just like 'NASA is a hoax-making organization (Moon stuff)' does not contain any evidence but simply outlines, in shorthand, a screwball opinion.
Regulations should apply where the product is sold, or used, not where it’s manufactured.
Pretty impressive when you consider this was in 1996!

I really like his ability to take out code and 'shoot it'. Back to the drawing board. It's a quality of a great engineer, to be able to reflect on what's been done and admit it's not good enough.
It would be interesting to know if this was a pinned certificate. I'm guessing it is. Probably have to run a debugger on the play store process.
That's dependent on your definition of integrated. Uber drivers never go into Uber's offices. They never meet Uber staff or managers (the actual employees of Uber). That's possibly as far from "integrated" as you can get. Uber drivers have a very similar relationship to Uber as it's customers do -- but you wouldn't argue the customers are integrated.

They may be essential for Uber's business but that is different. Customers are also essential. Contractors can be essential.