skysight-inc/HackerNews huggingface dataset:
There are security teams and/or methodologies inside all major CPU designers today that look at speculation and other side channels. Although these might still not be up to quite the kind of rigor that you see in traditional verification. That is to say, their unit tests and fuzzers and formal analysis and proving methodologies are all well set up to verify that architectural results are correct, my guess is that they don't all verify intermediate results or side effects can't be observed by different privilege contexts.

In many ways it is a much more difficult problem too. Going back to first principles, what execution in one context could have an affect on a subsequent context? The answer is just about everything. If you really wanted to be sure you couldn't leak information between contexts, you could only ever run one privilege level on the machine at any time. Not just core, entire machine. When switching contexts, you would have to stop everything, stop all memory and IO traffic, flush all caches and queues, and idle all silicon until all temperatures had reached ambient, voltages, fans, frequency scaling had settled. Then you could start your next program. Even then there's probably things you've forgotten -- programs can access DRAM in certain ways to cause bitflips in adjacent cells for example, so you've probably got a bunch of persistent and unfixable problems there to if you're paranoid. That's not even starting on any of the OS, hypervisor or firmware state that the attacking program might have influenced. So the real answer is that you simply can't share any silicon, software, or wires whatsoever between different trust domains if you are totally paranoid.

All of these things are well known about, but at some point you make your best estimation of whether something could realistically be exploited and that's very hard to actually prove one way or another. Multiply by all possible channels and techniques.

That's probably why you see a side channel vulnerability discovered every month by outsiders, but very few architectural defects (Pentium FDIV type bugs).

That said, this issue looks like a clear miss by their security process. Supplying data to an untrusted context, even if it can only be used speculatively, is clearly outside what is acceptable, and it is one of the things that could be discovered by an analysis of the pipeline.

Contrast with the recent AMD branch prediction vulnerability, which could plausibly fall under teh category of it being a known risk but was not thought to be realistically exploitable.

As others have said though, everyone makes mistakes, every CPU and program and every engineering project has bugs and mistakes. I don't know if you can deduce much about a CPU design company's internal process from looking at things like this.
There is quite a bit of overlap. Our program uses many of the behavioral techniques (CBT-I) mentioned in the book, but we also go beyond just CBT-I to help you figure out the underlying psychological drivers of your chronic insomnia and resolve those drivers one by one.

I wouldn't claim that our app is better than any of the resources you mentioned. The best remedy is what works for you. For some people, it might be reading a book on insomnia, or practicing mindfulness. A lot of this is also influenced by personal preference too (do you prefer reading, or watching a video, or listening to an audio to consume content etc).

Our app resonates with users who prefer shorter and more "bite-sized" content (especially video or audio based) that can be consumed by spending 5-10 minutes a day, but there are also people who prefer receiving more information upfront. Go with what works best for you!
the best bang for buck board right now is the esp32-s2 based s2 mini. Its great for doing anything usb attached (keyboard, gamepads, mice, anything really). Its about 2,50EUR at its cheapest including shipping without PSRAM and 2,60 with psram.
Interesting, but absolutely tragic that the authors of Plunder have decided to stick with the obscurantist, deliberately opaque and illegible manner of talking about their system.

I love the intention and think many readers here on HN are unlikely to appropriately value Urbit (and decentralization broadly), but it seems some of Urbit's lessons were not learned.
I think this is a genuine use for the blockchain.

Ideas like these have been around the "WEB3" space for a while, I remember a few years ago I was a part of "cent" which had a blockchain-based upvote system. The only issue, at least back then, was slowness of transactions and generally how much set up it required (you need a wallet, you need to put money on the wallet, etc).

It's very interesting to see Reddit's approach to this. And it's obviously related to their crack down of third party apps, as they seem to want to lock people into using the reddit app (the "easiest" way to set up the system).

I think it's good to offer flexibility for governance, but this is a complicated system so it'd be good for reddit to actually offer ready-made rules for subreddits to implement. One question that I'm left with, though, is how much control reddit will have over the token and the smart contract. I would expect for the system itself to be "governed" in such a way or is Reddit going to hold the keys of the kingdom. It would have been interesting to see a collaboration with other tech firms for a more open governance solution?

It'll be interesting to see the effects of introducing real market mechanics to the upvoting system. Overall, I'm interested.
Stopping breastfeeding can also deepen depression and increase stress (talking from experience here) so it's really a difficult choice here, depending on the level of danger the mother is to herself.

Hopefully some data is compiled in the next years on the actual safety for infants.
I had similar problem. I can't play Borderlands 2, but surprisingly turning off the comic outline effect in that game works. Obra Dinn is a great game, and I have to endure that by playing at the smallest resolution, which somewhat help. Also take frequent breaks, like 1-2 scene then hours of break. It help you think as well as I often found breakthrough by sleeping over the game.

The Case of a Golden Idol is a game in similar genre but in 2D, in case you can't get into this game. I'd say it's not better, but the last level in the main game is quite close to some of the harder puzzle in Obra Dinn.
I described an anti-smoking public service advertisement from when I was a teenager.

What virtue do you see in that?
Putting "automated testing" into the last 1% is the issue right there. It needs to be part of what you are doing from the start. You are done when your automated tests are complete and reliably green, not when some underpaid tester in Bangladesh gives their thumbs up.

Ideally your documentation is tightly integrated with your tests too, then it will be done as well and won't go stale.
It’s not a captcha
This is exactly right. Lightning is more resilient to damage. Lightning also puts the fragile part on the charger side and not in the device. Two of my USB-C devices developed loose connections after a year or so that replacing the charger wouldn't solve, a camera and a Windows laptop.
If my own bank/credit card blocked Firefox I would cancel with them. I'm pointing out that this isn't really normal or justifiable.

To your specific point about just moving elsewhere, complaining in public about bad industry practices is part of Capitalism and part of how consumers regulate the free market. "Take your business elsewhere instead of complaining" has never really been how this has worked; businesses don't get to opt out of being shamed just because they have a cancellation form, and they shouldn't have any expectation that users will or should be quiet about their bad business practices. The free market is not a replacement for criticism within social spaces; the free market works alongside that criticism and is reinforced by that criticism.

Public complaining is an essential part of how consumers within a free market coordinate with each other and educate each other about abusive corporate behavior, and it serves as an additional mechanism alongside boycotts and cancellations to help punish bad actors in the market.
Bros, it's over: https://news.ycombinator.com/item?id=37058051

The apparent drop in resistivity originally shown by the Koreans can be attributed to the Cu2S phase change. The crystal structure changes with temperature, and that changes its conductivity. The resistivity never becomes zero but drops sharply to near-zero. It's so cleanly explained, I can't believe it's not over so it has to be over.
Solar gamma-rays with energies >1TeV surprise observers
The solution should be to use IPv6 everywhere via 4to6 and 6to4 protocols. Then Ipv4 usage will become less important (as fewer people will want to maintain or use it), and ISPs will have an active incentive to switch (less network translation to maintain).

At that point, the main consumers of IPv4 will be old devices and legacy clients that for whatever reason can't support IPv6. Nobody will be paying for ip's otherwise, so ISPs can continue selling their business plans as normal, the rest of us can just use IPv6 and not worry about rent-seeking behavior from the exhausted IPv4 space.

I would guess, around 50-60% penetration, you will start to see real "only works with ipv6" behavior, and the trend will accelerate...its already at 30% which is enough incentive to at least try to get on IPv6 now if possible...
> I’m saying that if their models worked in a predictive way, since they have been established for so long and the value of confirming them is so high, they would have been confirmed by now.

So, just run all possible materials through this hypothetical superconductor predictor model, and any that do exist would be found?
Unless I'm missing something this is completely unrelated to and does not substantiate your argument that drug approvals are harming patients with the "mostly harming" argument implying more harm is being caused than prevented by current approval processes.

Once again, source?

> This is obviously true.

As you only mentioned the FDA, and keep only mentioning the FDA, it is not obviously true that you are arguing against all Western drug approval agencies and not specifically the FDA.

> Are Americans, Canadians and Europeans all different species?

All being the same species does not mean all have the same regulatory framework and in fact they don't. I am sorry but I really don't understand any of the points you're trying to make.
I'd didn't work for Firefox OS either, and I'm not exactly sure why.

But it seems to have worked great for years for Chromebooks!
Somewhere around 2 full days. I usually stick it on the charger when I sit down at my desk, and less than 30 minutes is plenty to get it back to 100%. 0 to 100 might take around an hour.
This is 100% an ego project--count the number of "I" statements in your declaration above. Even in your stated reasons why you "struck gold" with this idea, the first three are solely about your effort and taste and resentment. The fourth is about your site "acknowledging the existence" of one billion unregistered people in the world. I'm sure their actual existence is already being acknowledged by others in their own community; they don't need some tech chucklehead adding a row into a database for that. It's laughably egotistical to think it matters one whit to someone whether your site has counted them for bragging rights.

I see absolutely no value in the result for humanity and especially not for the downtrodden billion. You would have done more philanthropy had you instead donated the funds to literally any other non-profit organization. I'm surprised you were able to claim non-profit status for this venture.

It's obvious you put a lot of work into this, and you're clearly capable of creating and executing a project. It even looks nice. So hopefully this can be a point of reflection as you decide what to do next with your remaining time on this planet.
One perspective is that it mimics society more evenly: if you’re one step ahead you also get to steal everyone else’s. Being a perpetual bug bounty is utility.

A more collaborative perspective is that the adaptable nature of the protocol adds to the confidence in it. Only new addresses created after an update of one program were affected. And now it is fixed already. Bitcoin use has pointed out flaws in other encryption methods before which quickly got fixed solely because there was a financial motive to fix it suddenly.

The primary thing that you missed is that the upgrade last year was not “snakeoil to mitigate this problem”, its just also an additional way to mitigate this potential problem, its just happens to also provide an improvement on 10 year old multisignature technology

But an overlapping analogy to your primary observation would be how insecure accepting credits over the internet was in 1995. That problem actually never went away, despite layers and layers of patches and payment processors and security standards, SSL, TLS, PCI Compliance v1 v2.. venture backed competitor payment processors with fraud detection

and yet nobody threw their hands up and said “we’re going to stop trying now”
a starter https://chat.openai.com/share/f9e6ad4a-5566-4a42-b1f7-e9ff11...
Privacy issues with SponsorLink, starting from version 4.20
Am I paranoid or is this a clear evidence that we cannot control nor contain AI as people will try to misuse it as much as possible for convenience and profit?
The article talks about AMD announcing a chip supporting 192GB memory.
Doesn’t seem unlikely at all based on his dad’s career/bio (see the Wikipedia page posted elsewhere in this thread).
I've noticed that finding a motor with a through-hole is a persistent problem. Have you experimented with a gear driven design to work around this?
Science paper, Aug 3 2023: https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.13...
> - OpenAI: you can host an OSS model if you want to

Just to confirm: you mean models like Facebook's Llama 2 and variants right? Since OpenAI hasn't released any OSS models.
I'd say the cost being wrong depends on the people. For a lot of people being in the state of unknown is better than random guesses with 0 expertise. Not everyone like to flaunt their ignorance

Not sure why r u so insist that only your way is right. That's ur choice of course
How is this different than p5.js?
‘What have I seen?’: Joel Meyerowitz’s life in photography – in pictures
Luigi Cadorna
And that's a problem. Often there are full of issues which eventually are all known but never fixed.

Updateability is the defining advantage of software over pure hardware solutions. If you don't use the advantage then you are stuck with just all the disadvantages.
WeWork says ‘substantial doubt’ it can stay in business
Which is a useful data point.

But the wide variety of samples indicates that there isn't convergence yet on what the intended process is. Until that happens any conclusions are just data points - nothing more, nothing less.
I'm glad you found something that works for you! It's easy for someone suffering from chronic insomnia to just accept that there is nothing they can do (especially if they have experienced it for a very long time). It's great (and motivating for many chronic insomniacs out there) that you found a way to resolve/ cope with your insomnia after 20 years. Thanks for sharing your experience!
Having just visited a few National Parks there were many cell towers with modern LTE cell radios connected to an old and badly under-provisioned microwave link. In busy parks like Yellowstone the cell service was effectively unusable. The background traffic from the phones in people's pockets (checking email, checking for updates, downloading map tiles or getting directions, etc...) was enough to bring the entire system to its knees.

I was thinking that they were way overdue to replace those microwave dishes with a Starlink terminal.
It's some miracle that an LLM-based virus hasn't already taken control of industrial systems.
That’s not going to be a problem. As support will be the first function to be replaced by LLMs.

They will start worrying when revenue is continuing to decline even after burning through the third CEO.
If anything needs to be radically improved with svelte it’s bundle size and IDE tooling
The 50 mile rule is an IRS regulation that is being increasingly enforced.

https://www.irs.gov/irm/part1/irm_01-032-001
>invest in tooling which makes it "cheap" to do the right thing. However this is not easy to pull off.

Automated testing FTW. Then you can change and refactor and extend all day, as long as the tests are all green, you are golden.
IMO Python imports behave like the bash source command.

This is why people use the `if __name__ == "__main__"` so the majority of people will address it in all their scripts even if they don't know the reason why.

It's a feature not a bug IMO. You can use importing a .py file as a singleton hack. You can also use `refresh` to re-load a module, to clear it of any runtime overrides.
ASK HN: How do you go about finding/predicting side effects of code changes?
I find that sometimes I try to think of everything and test stuff that I create, but then later on you find it had bugs. Is it unavoidable?
I‘m not even sure it’s an equilibrium. I’m in tech for around 25 years now, I feel developer productivity and output is not the same but lower today.
> I'll never understand why there's such a dominance of luddite thinking, bad takes and conspiracy theories on HN, when it comes to the topic of mental health

I imagine there are many professional forums filled with people who know topic X inside out therefore assume they must also be an authority on unrelated topics Y and Z. But I also suspect there’s something about software engineering, perhaps the ability to succeed despite being deeply antisocial, or being very male dominated that means women’s mental health in particular is always going to be a dumpster fire discussion topic.
It's almost like a giant company like Google have ~100,000 employees, with a complex incentive structure at different levels that are encouraged to do different goals. While I have almost completely de-googled my life a few years ago, it is just stupid to attribute malice to anything they touch -- they have plenty of good contributions, certain parts of AOSP being an example.

I would be happy to have that on a GrapheneOS phone for example, if I hadn't went with Apple.
Why Clip Art Was Everywhere Until It Wasn't [video]
HN may be Solariana, but they should spend a week in Dallas, Chicago or Kansas City. Bustling. People mingling. Going to the office. Oh the humanity.

Perhaps Elon will take all the intros to Mars. I should write a scifi on that…
The science behind the claims is being scientifically discussed and the preponderance of available evidence provide no experimental or theoretical support.

We're separately discussing the author's credibility as the claims cannot be verified by anyone but the authors. One example of a time we do this is the "disclosures" section of any academic publication.

Are you arguing someone with a conflict of interest and history of making fraudulent arguments should not be placed under heightened scrutiny?

Combining both available evidence and author credibility is completely valid and leads one to the conclusion that this is incorrect until proven otherwise. It's not like we're solely dismissing the claim because the authors have poor credibility.
I have a hypothesis that 1/8 of fatherhood is treating the most interesting things about your life like a FOIA request is needed to get you to tell them.
I would say they are both a problem.
Without seeking to contradict your main point, it's worth noting that "These symptoms are curiously unheard of in Asia" could be genetic. In the same way that most westerners are OK(ish) with alcohol, but many asians aren't- they 'have a genetic variation that means their aldehyde dehydrogenase is either ineffective or less efficient' [1]

[1] https://www.thenakedscientists.com/articles/interviews/myth-...
"People say otherwise" because it's not true. I run my own email and I do just fine. The last blacklist I had was from Hotmail about five years ago
What's so failed about it
A quick look at the plots make me think this paper is legit and lk-99 is not a superconductor. Nice plots covering down to low temperature, unlike the original lk-99 papers which always seemed bizarre to me.
Small world; it seems like Mark's Dad worked with Charles Townes, inventor of the maser.

I got to meet Dr. Demitrios Matsakis last year. He also worked with Townes and was the US Naval Observatory's Head of Time Services, helping advance the state of the art in time synchronization during his tenure.

It seems like there's a generation slowly fading away who have stories of a different era, where massive new achievements in physics and earth sciences came year after year. It doesn't feel as frequent these days, but maybe that's due to living in the now, where history hasn't yet judged what were great or mediocre discoveries?
Sounds likely but I also don't get the subheadline "Oppenheimer and Edward Teller hired my Dad at the Berkeley Physics Department."

The elder Watson could have met Oppenheimer at the Institute for Advanced Study in 1947-48 when a fellow there. But Oppenheimer was long gone from Berkeley when Watson became a faculty member in 1957.

Anyway, this comment is almost longer than the article so I'll stop here.
Neither of these are in the EU and won't solve the problem for the EU, they'd still be dependent on other countries. The point is to bring the production to the EU.
As I understand it this isn't really a Spectre style bug, it's just a straight up bug. It's pretty much the hardware equivalent of use-after-free.

Simple to fix with a microcode update. No serious performance implications.
> Writing documentation is always a time sink, though, in my experience. Or maybe I'm just not good at it :P It's usually an additional day of work overall, though.

And it saves you days and days of re-discovering truths about your code weeks/months/years down the line. Sometimes those rediscovered facts are not even true which will come bite you big time.

Integrate your documentation with your testing. That makes it easier to create and maintain. You don't have comprehensive automatic tests? Then that's your problem right there.
Those operating the estate have a fiduciary duty to the stakeholders, meaning they can't pursue litigation where costs would exceed potential value nor when it would have a more significant negative impact on value than protections.

From this most instances of infringement do not justify legal action as the parties in violation have little to no money (fan fictions etc. Can't get blood from a stone) and in many cases the pursuit of legal action would "harm the brand" in a fashion that would far exceed the value (a 1% reduction in consumer engagement is hundreds of thousands if not millions in value).

Copyright is not the same as trademarks, you don't have to pursue every single violation in order to maintain protections.
Finger already exists.
In the US? It's an incredibly slow process with a designated separate court system with seperate labor laws. Oh yeah and solidarity strikes are illegal.

https://en.m.wikipedia.org/wiki/Solidarity_action

The police can't be defunded but the US National Labor Relations Board had to resduce it's staff by 50% from 2002 to 2022, with bipartisan support!

https://thehill.com/opinion/congress-blog/civil-rights/37839...
And thats a good thing in Germany with is known for its sunny weather.
Genuinely curious how these events fall in place. I'd like to know how long a selection process like this takes, were there other cities in the running, and how did Dresden become the choice. Is the best similarity with how car companies like VW and Honda choose cities in the US?
I'm a loyal Intel customer because their stuff is, in general, straight up less janky and more practically reliable than AMD's stuff. I agree that Intel knows how to do software in ways that AMD simply doesn't.