skysight-inc/HackerNews huggingface dataset:
You don't need a spinner if feedback from clicking the button is sufficiently quick.

According to Google that would be around 100ms.

> Guidelines:

> Process user input events within 50ms to ensure a visible response within 100ms, otherwise the connection between action and reaction is broken. This applies to most inputs, such as clicking buttons, toggling form controls, or starting animations. This does not apply to touch drags or scrolls.

https://developers.google.com/web/fundamentals/performance/r...
Same source http://0pointer.de/blog/projects/the-biggest-myths.html lists it as most common myth number 2.

> This doesn't mean being fast was irrelevant for us, but reducing systemd to its speed is certainly quite a misconception, since that is certainly not anywhere near the top of our list of goals.

> That would have been a lot better

Yeah, I noticed that all the complaints about systemd almost never are about the init implementation. Instead people complain about journald (e.g. binary=plain text+time stamp instead of just plain text) or networkd or about Poettering or how there is some shadowy conspiracy. Honestly, I think if all the non-init parts had another name like "linux plumbing project" and were developed separately by non-Poettering, much fewer people would complain (even though the software is the exact same).

It would also make discussions much clearer if people said in the beginning what exactly they are complaining about, e.g. "logind is buggy" instead of "systemd is evil".
A simple but crucial distinction between government and startup / company: a startup / company can select the people it consists of.
> A downvote reasonably reflects the fact that it doesn't belong near the top of any list of the most interesting/relevant/accurate comments

Yes. But often it's not clear, and would be useful to know, whether it's the "interesting" or the "relevant" or the "accurate" part that was lacking. These are all along the lines of the categories that I mentioned. I do want to stress that I did not propose a "you are a worthless human being" category.

> Tom_mellior, I can't quickly find any heavily downvoted comments of yours.

It doesn't have to be heavy for the reason to be interesting. And for whatever it's worth, there is this one: https://news.ycombinator.com/item?id=21362694 where I was downvoted for explaining why I downvoted someone. This is OK, since the HN guidelines discourage discussions about voting. Still, I think some sort of "-1, ad hominem" feedback would have been useful for the original poster.
Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission:

https://assets.documentcloud.org/documents/5433555/Note-by-C...
I wouldn't say Reddit is all organic nowadays. Plenty of accounts gaming the website.
Personal and generational attacks ("ok boomer" manages to be a toxic blend of both) are not allowed on HN. Please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here.

Edit: it looks like you've posted a lot of good comments but also quite a few that break the site guidelines. Could you please take the spirit of the site—thoughtful and curious conversation—more to heart? We'd be grateful.
Ideas are easy, the execution is what's hard. If someone casually thought of a cold fusion reactor while taking a leak in the morning we would not put them on a patent for cold fusion reactors either. Where the ideas come from is immaterial, who fleshes them out is not.
Tagging on with a similar query. I am on Windows 10. If I were to run Firefox in sandboxie, would be the attacker have to deal with an extra layer of security or does it offer no help?
There are no* import taxes on any goods moved within the EU. That's a fundamental principle of the thing.

The fee to register a car for use on public road varies. It's very high in Denmark (120% of the value or something) but the place of manufacture doesn't affect that. Second hand imported cars still need to pay it.

* Exception is the duty paid on alcohol and cigarettes, depending how you define it.
They must've done some analysis on the percentage of free users that'll convert to paid. That analysis is valuable. Anyone here care to guesstimate an analysis, replete with the cost free users add?
The question is: can your job be automated in 50 years? Maybe it can. But the computer has a long way to go. I don't think we have enough evidence to give any estimate of when (if) that will happen.
Word2ket: Space-Efficient Word Embeddings Inspired by Quantum Entanglement
Returns in the same speed from Scotland (Glasgow) too. One request was as low as 16ms. Impressive.
By what specific mechanisms does, has, and can technology deliverthose increases?

What are the net gains provided by millionsfold increases in compute capacity and performance? How much such gains remain?
One question- do these vulnerabilities , including spectre and meltdown only help in stealing information or can they also hijack your computer to do arbitrary things?
> my data is being siphoned off to them by third parties.

they are not "third-party". If a site uses google's products (like analytics or recaptcha), then you could reasonably consider them partner sites to google.

Indeed, google is difficult to boycott - no one is diputing it. However, google obviously isn't very offensive to a large number of people, because there are very dedicated groups who dedicate time and energy into boycotting companies like nestle (which is _very_ difficult to boycott). May be a lot of laymen just don't think that their data is worth protecting (whether they are right or not remains to be seen).
Running scrum on a physical waterfall with dependencies.
If not everyone can afford proper care, that's a problem that you need to solve in the system that is obviously failing them.

Talking therapies already scale just fine, as you say the therapist is paid well and the people that actually need them are a vast minority. If they become the vast majority (where you would actually need to scale), something is systematically wrong somewhere else and that needs to be addressed outside of therapy.
Well, it's not just years, every day of that means money that gets shifted. I couldn't find the article I read years ago about one of the companies involved, and their string of similar projects in other countries, but here's something to give you an idea how much this thing reeks: https://www.bbc.com/news/world-europe-36185194

When I read "embarrassingly poor planning" and similar phrases in articles about it, I have to think of someone who "clumsily" spills coffee on the dress of Marilyn Monroe, for lack of a better image, and then "embarrassingly" ends up with his head planted on her chest, because he "stumbled" while "hastily trying to make up for the mistake with a handkerchief". Sure, that's one way to put it. But beyond all the plausible deniability, someone is benefitting, one way or another.
That does say a lot about the mindset of such sites. Instead of showing off their superior quality and reassuring the users that they are indeed that better than the competition, they would instead lie to the user and offer worse experience.
“How to spot a vegan”
Another common option is a "toast notification" (see android) or other separate confirmation message to acknowledge your action.

"Sent X" or "Finished Y!" is sufficient to distinguish a failed ajax call from a successful button press
AMD and others are fine. Just have security people on the team during microarchitecture design.

Spectre variant 1 is probably unavoidable so security inside a single virtual address space is kinda dead. Use separate processes and mmu.
Another neat graphviz trick is using vuejs (or now sketchviz!) to provide the UI, then layering JS to make the nodes clickable as a visual programming interface.
"RFC'ing"?
Please don't be a jerk in HN comments, and especially not when someone is sharing their work. Would you mind reading https://news.ycombinator.com/showhn.html? Note these:

Be respectful. Anyone sharing work is making a contribution, however modest.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.
I don't believe it's strained like the real thing, but added whatever to make it thicker.
Overclocking desktops in 2019 is only extremely rarely a productive use of your time.
Westworld Season 3 Teaser: Incite Anthem
GSMA represents network operators. They don't coordinate standard.

3GPP makes the spec and sends it for ITU for ratification. 3GPP has 7 organizational partners: USA represented by ATIS, ETSI for EU and CCSA for China. GSMA is one of the 17 invited market representation partners who can provide advice and participate in consensus decision making but have no vote.
depends on the information you steal.

If you steal passwords, then you can use said password to hijack whatever the passwords are protecting.

If you steal private keys, you may be able to use said keys to impersonate the victim (like via ssh into their remote machines).

But if you're asking if speculative vulns could directly lead to remote code execution, then no (since you already have given the attacker a measure of control, as they are able to execute code already).
Nice pointer about NTP steps and time-smearing, can anyone recommend a good website for dealing with these issues?

I may not be working on real-time systems at the moment, but I’ve had enough exposure to them in the past that I’d like to scratch that itch.
>Like it was a "safety hazard" to have too many people at once in the smoking area behind the textile mill. It is a slippery slope to try to tease apart what is, and what isn't, interference right?

No. It is a necessary thing to do and what a legal system ostensibly exists to do.

A slippery slope in what direction? In the direction of too many rules being illegal or too many things that could impede organizing being allowed?
API Design-First vs. Code First
I have the same view. 100ms is fine for actions that require round trip to the server, in particular when you hide the latency the way multiplayer games do. But for things that are just local UI operations, if you're taking longer than 16.7 ms, you're doing something wrong. A typical videogame can update the whole screen and all game logic in less than that.
Here's a classic from NNG on 'UX time scales': https://www.nngroup.com/articles/powers-of-10-time-scales-in...

You can infer from there that anything around/under 100ms will feel like direct manipulatio, interpreted by the person in the post as 'no request was sent to the server'. The same interpretation might not result from a non-technical person, it will just feel 'different' or they won't notice what happened and submit it multiple times, if there is no success message.

You can also trace it back to one of their 10 heuristics: visibility of system status. If users cannot perceive a change because it happened too fast, the UI has failed and users don't know what happened. One of the reasons some websites add artificial delays, as mentioned in other comments, is not only to signify 'work' being done, but that flashing a spinner for a split second is also a bad experience. You're better off normalizing every action to take at-least-one-second, and ensuring the state of the system is always clear.
I remember attending a talk about speeding up web UIs once and it got to Q&A time.

I’d read some article about how if you respond too quickly, users can begin to doubt that any work is really being performed, and I’ve experienced that feeling a handful of times over the years myself.

Anyway, I asked the speaker that and everyone just kind of laughed, which it does seem a little absurd on the face of it.

I guess it’s also pretty far from most peoples minds given the web is caked in unnecessary bloat a lot of the time :)
Reminds me of the OMG cable https://techcrunch.com/2019/08/12/iphone-charging-cable-hack...
Hacktoberfest Is Now Open Source
I found Linux From Scratch[1] invaluable when I built a system with it almost two decades ago (but I assume it's still awesome). The trick is to not use the automated build portions and read and follow their page on every step. It takes a while, but you come away with a much better understanding of how the system works.

1: http://www.linuxfromscratch.org/
Your web browser runs untrusted code. On a computer that never runs untrusted code you can do that.
A quay is a the platform you load or unload containers to. It's usually paired with a wharf in a harbor.
It’s interesting what kind of talent one needs for a factory. Engineers? I doubt... These will be simple workers, couple equipment operators with some education. All the blueprints are coming from Tesla’s HQ anyway, so not much engineering needed. There is also Tesla in Germany that does all the engineering: https://teslagrohmannautomation.de/de/
> "accelerated decline in the conventional white milk category."

Overall it's not looking like people are drinking less milk, they simply want more variety and this company seems to be having a hard time in all area's from Walmart to slowly upcoming alternative milk replacers.

Seems also in part they haven't innovated enough in new types of product to draw more customers.
> in this hyper-politicized era

People are still largely extremely de-politized. The fact that people are starting to have opinions that they care about again, and this is immediately viewed as extremism is very telling.
> AMD (and ARM OoO chips) are vulnerable to Spectre variant 1 (bypass in-process array bounds checking) but not to the vast majority (any?) of the other issues which are Intel-only.

> AMD chips don't have the feature that speculation failure is determined at instruction commit time when it is already too late, so most issues just can't happen.

Putting memory permissions check in retirement stage of the pipeline couldn't be accidental, I say...

Sounds like a great "efficiency hack". Till it fucks up.
The interface on that go-to instance is quite slow. The infinite scroll takes a few seconds every scroll to catch up.

Also the actual content there seems lacking. Lots of non-English content (would it not be better to have some language filter?) and further down feet-tickling and NSFW videos...
How Airplanes Fly: A Physical Description of Lift
> It's a link in the SF Bay Area, and the server is in Texas, so it has to get out there and back. That's at least 50 milliseconds right there when measured by a boring old ping.

Am I the only one surprised by this 50ms ping? I can reach cloud servers in the SF Bay Area from Paris in 50ms - and I'm on wifi. Surely SFO-TX should take much less time..?
But will it keep the touch bar?
Perhaps it would help if we stopped dubbing other people as cancerous tumors?

I was reading about the decisions behind the nuclear bombings of Japanese cities near the end of WWII.

I wonder how it felt being a physicist that contributed to the Manhattan Project after those droppings.

By the way, the Wikipedia pages are in interesting study in how to downplay certain... aspects.
Please don't respond to a bad comment by feeding it, which just makes the thread even worse. Flag it instead. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.
Other than splitting off HPE, the HP of 2000 was pretty much the HP of today. As far as I'm aware, they're still major players today in all the markets that they were major players in back then, and none of those HP or HPE business units had to go through a collapse and start over.
Nope... how would someone have used (with assistant technology) the web back in the day if that would break it. You have to do some extra work for a good user experience, for these users anyway - so i don't take this as an argument ( as i said - if a screen-reader or other tools would fully relay on html-semantics to work - it wouldn't work).
It is funny how cultures and legal systems differ. In US corporate culture, it's very ingrained that things done with company property belong solely to the company, and that the company has a right to look at company property and data at any time, for any reason.

A big portion of one of my information security jobs involved looking at employees' browsing history and emails daily. Sometimes to investigate potential misconduct (something dumb like a manager wanting to see if someone's slacking off, or something serious like suspicion of stealing information), but usually to investigate potential security issues (like if we believed a computer visited a malware-associated web page, we wanted to see how the computer ended up there).

In the US, pretty much no one bats an eye that this is considered necessary and normal. Employees who don't want to be snooped on are free to use their personal devices at work, like their phones, which of course we have no access to. But it's considered very normal that if an employer gives you a computer to use for work, that they can inspect that computer and data to and from it. No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property.

For infosec operations people in European countries, how are these things handled? How do you investigate potential breaches which originate from endpoints? Do you have to ask the employee if you can look at their browsing history? What if it's a potential misconduct investigation, where tipping someone off may result in destruction of evidence?
>Don't force your views on others

That's funny, since that is all the military does. I think what you meant to say was: "Don't force the view that you shouldn't force your view on others onto others"
It can be used to defeat ASLR, which is a way to make exploiting code harder. However, defeating ASLR just makes it easier to deploy an exploit against a program, but you still need the exploit.

It doesn't immediately give code exec, but generally it wouldn't be very hard to turn arbitrary memory read capabilities into privilege escalation. As long as you know what the system is running.
That article has some inaccuracies, particularly around brute forcing iPhones in DFU mode which is nowhere near as practical as they make it sound on newer models with Secure Enclaves.
thanks, captain :)
To me personally, any time something is advertised as "written in X" makes it seem like it's not really worth the attention, as the "written in X" is apparently its primary selling point.
People are definitely making packages, just to make packages and look good, and do other things good, too, I guess. Just to mention the triumvirate of awful that exist, in this case is-even, is-odd, is-number: That's at least trying hard to act like an influencer. Or influenza. One of those. I don't care, it's vapid junk.
Dear Elon Musk, Australia Needs a “Roo Mode”
Surely if you emulate a processor without speculative execution with good fidelity (Such as a good NES emulator) then the program running ON that emulator can't deduce anything from speculative execution?

Is the answer (for home users) to just sandbox some processes under an emulator layer? I'd be happy to just sandbox some sensitive processes like my browser even if it took a huge performance hit, so long as some other apps like games did not take the same hit.
Is it possible for the usb powerbank to carry a virus? It might not be as safe as you hope. Of course it shouldn't accept any data, but considering how poorly ports and devices are often secured, I bet that quite a lot of them do accept data.

But why do USB devices even accept unauthorised data at all? There's probably a good reason for it that I don't understand, but it seems to me it's rather obvious that blindly accepting data from unknown devices is quite a big security risk. And yet I keep seeing these new data port standards (USB, thunderbolt, etc) that just blindly trust whatever gets connected to it, and allow it unreasonable control over the device. I guess the reason is that you want to be able to plug a new keyboard into your PC and have it just work.
To avoid distraction. Majority of calls I received from landline numbers, are from robocalls.
>It's not for beginners.

Maybe true, but it's not just for experts either. OpenBSD's unfriendly reputation ensured that I languished in Linux land way longer than I should have, convinced that I was too dumb for anything else.

If you can navigate directory structure, use a package manager, and uncomment lines in config files, you can use OpenBSD. Try it already. It's good.
Check out Zenodo [1]. It lets you generate DOIs for Github releases.

[1] https://zenodo.org/
This is definitely on my list.
As a local, I would disagree...
For the same reason you try to avoid machine learning models from overfitting. If you train a cats vs. dogs machine learning model but all your cat pictures are indoors and all dog pictures are outdoors, the model may inadvertently learn to recognise indoors vs. outdoors instead of learning cat vs. dog features, and will fail miserably on an image of a cat outdoors.

In your case, first of all, it's not 100%. Suppose 90% of attacks are by Xians and 10% are Yians.

Profiling Xians over Yians might mean that you catch 90% of attacks. Maybe 95% if you search some Yians.

On the other hand, learning to properly identify threats, independent of Xian vs. Yian, might allow you to catch 99.9% of attacks.
I don't use Apple, but https://play.google.com/store/apps/details?id=net.openvpn.op... works great for my phones and tablets.
> and then switch to Google Flights

Which will most likely show non-bookable outdated prices more often... there's always a trade-off. There might also be some browser/geo profiling going on.
Yes that’s the book, although I got it very cheap through the Humble Python bundle which I think recurs periodically.
There have been more Chrome/Firefox 0-days than speculative execution vulnerabilities exploitable in Javascript (0). Sure, there is a chance that the Chrome/Firefox teams missed something, but there have been sighted no exploits since the release (of spectrev1) and the browser fixes.

It's not a crazy threat model to have on a personal PC, the risk is so very minimal. If your threat model is that strict you shouldn't be running JS anyway.
I wrote a comment system for articles once that was super-duper fast.

The result was that it turned into a chat, so we had to add a "fake delay" for people to treat is as a serious comment system.
Uploads all of your speech to a company centered in one of the more privacy-hostile regimes, is strictly for-profit, has a set of policies subject to change at any time, policies are hard to read and therefore difficult to track changes in, unclear when the microphone is truly on and uploading. The list actually goes on but I feel like you get the idea.
Our smart TV lets us swap between our five (!) profiles. Each has different trackings and recommendations (other than Star Trek TNG, which apparently three of us have watched ;)) You might consider making a new profile ("cududa2" or something) and see if that has more diverse recommendations. Try adding / watching some of the ones that are novel compared to your other list, and see if that helps.

I agree, though, I'd really like to have a _full listing_ of shows.
Sure. But the substance of what I was saying still stands no?
Pure functions, immutability and other software superpowers
A rather peculiar math book: the Opera Magistris