skysight-inc/HackerNews huggingface dataset:
The core concept that makes TPMs work (in this usecase) is the Platform Control Registers (PCR). The idea behind the PCRs is to allow the TPM to know that the overall system is in a known state.

In particular, there are 2 operations that can be performed on a PCR: read and extend. Read does what it sounds like, and gives you the current value of the PCR. Extend concats the current value of the PCR with a provided value, and hashes the result back into the PCR: PCR[i] <- Hash ( PCR[i] || data ).

The TPM also has a small amount of general purpose non-volatile storage (NVRAM). It lets you "seal" entries in NVRAM such that it will only give you them if particular PCRs have particular values.

UEFI along with most modern bootloaders and operating systems incorporate this into the boot process such that a component will measure all critical configuration parameters and executables before operating on them. To take your USB boot example, before the UEFI boots into your USB it will measure (at least) the bootloader on your USB drive. As soon as that happens, there is no way to get the PCRs into the required state without breaking the hashing algorithm. Even if your USB drive uses the window's bootloader, the UEFI likely measured other things, such as the device it was booting off of, and possibly your entry into the one-time boot menu [1]. Even if you get through all of that, the Window's bootloader probably measures the code it runs. By the time you get to code you can actually change without invalidating the PCRs, you are running inside of Window's userspace subject to normal software security measures; and Window's might have already modified one of the appropriate PCRs (or simply locked the NVRAM for further reads until system reset).

There are several potential problems with this:

1) It assumes that all of the components in the chain are secure and do the right thing. If you can convince one to run your code without changing what it measures, then you can attack the system.

2) It assumes the entire system is an atomic unit. If you can talk to the TPM directly, you can simply measure in the same values that get measured during a normal boot, weather you are actually booting, or have the TPM on a breakout board. The measurement inputs to the TPM are not secret. They are just hashes of firmware, kernels, etc.

2.5) What this paper talks about, none of the communication to/from the TPM is encrypted.

TPM backed FDE exists on Linux as well and is vulnerable to the same class of attacks.

Some systems have the TPM integrated into the CPU itself, which makes such an attack practically impossible.

[0] Or, at least the initial bootloader, which is then responsible for measuring the kernel, which is then responsible for measuring the core OS components, etc).

[1] Although, these things are done in a seperate PCR, and BitLocker probably doesn't use all of the PCRs. You don't want to brick a system by simply changing a random setting in the bios.
Not bait. There is nothing wrong with getting tech jewelry btw..

Its the same story with luxury cars. For the vast majority of people, something like a 250 hp crossover with part time AWD is pretty much the most functional vehicle you can buy. The driving use case for the average person doesn't depend on things like driving dynamics, higher horsepower figures, exhaust notes, or even interior trim. But if your dopamine circuits are trained on being in a BMW and feeling the leather and hearing the engine and experiencing short bursts of higher acceleration, then you are going to think that your current vehicle is better than the former, but you are not making that decision on anything objective.

In the same way, people like Apple products mostly for vanity. You can get a Pixel 8 for half the money of the iPhone and do all the same stuff as the iPhone.
That's why I said "cellular environment". The literal biological environment in which genes act. Not the household environment in which a human baby finds itself; that's indeed something else. But I'm saying that genes are not the complete blueprint of life even in this "low level" sense. (Never mind that gene expression is in the developed individual is subject to external factors, too).
It's hard enough stopping child pornography when there are real children used to make it...

But when the difference between the difference between the digital representation of a child and that of an adult just becomes a variable in a parameter space?

It'll be impossible to stop.

Child pornography is a byproduct of human trafficking, and that's where the focus needs to be.
Oh shi, not very reassuring knowledge spacecraft SW engineers allow signed overflow in their code.
> No amount of joining can produce anything other than a table/relation. The n+1 problem is introduced when you try to build those types of structures from tables/relations.

A trivial amount of lateral joins plus JSON aggregates will give you a relation with on record, containing a nested JSON value with a perfectly adequate tree structure, with perfectly adequate performance, in databases that support these operations.

There are solutions to these problems. One only needs to willingness to accept them.
> Why exclude memory safety from the argument? That's the whole point -- to fix those significant fraction of vulnerabilities.

Because while it's a significant fraction of those vulnerabilities found. (key worksd found, because they're easier to find) It's not a significant fraction of the vulnerabilities leading to exploitation.

My original argument was, security issues are preventable by increasing skill. You tried to claim that's merely an instinctual reaction of anger. My refutation is that, yes rust eliminates some memory safety issues, when used correctly, and when you limit yourself to a smaller subset of the language.

The two arguments, 1 isn't that also true for MIRSA C, and 2 does programming is rust lead to a lower defect count in any other metric than memory safety?

Because if exploitation isn't due to memory safety, fixing that class of bug doesn't improve security.

And I'll actually make a 3rd argument, Does a large rust project have a lower defect density than a solo project written by an expert, like you e.g. curl?
> Native js has everything jQuery has, except for the pile of often poorly maintained half baked "plugins"

The great things about these plugins is that you can strip them down to what you need and patch them yourself (remember lib or vendor directory). NPM and build tools make this a chore.
I think the idea would be to redefine "the object type" to make the trap value valid -- and to define the result of all operators on the trap value in some sensible way (similar to non-signalling NaNs in IEEE-754 floating point), so that, e.g., adding the trap value and any number produces the trap value again.
Users. Don't. Care.
> Precision Medicine, on the other hand, is an innovative approach that takes into account individual differences in people’s genes, environments, and lifestyles.

That seems to be a far cry from asserting genetic determinism. Can you explain what you were trying to communicate with that link?
Location: Kazakhstan

Remote: Yes (GMT+1 to GMT+8 preferred)

Willing to relocate: Yes

Technologies: React.js, TypeScript, next.js, Python, Django, React Native

Résumé/CV: https://drive.google.com/file/d/1SgsjArCP6Rc3KP2kjGtZZBblkZI...

Portfolio: https://nurymka.com (click around projects for more info)

Email: nurymka [at] ucla [dot] edu

Software engineer with a front-end focus of 3+ years. Previously at Robinhood, Twise.ai, FanAI. I have built and launched web projects to millions of users. I have built motion-heavy interactive experiences, analytics & charts, CMS-powered pipelines, and revamped web interviews. Experienced in JavaScript, Python. CS @ UCLA '20. Open to learn whatever part of the stack I can be most useful in!
Yes, it takes decades to build new nuclear plants. And the Greens in Germany (amongst other political parties) have been blocking new nuclear power plants for exactly those decades.

More pertinently: those nuclear power plants they shut off were already running. Keeping a plant running takes exactly 0 years.

(You can't really blame German politics here: they just deliver what German voters want. Democracy working as intended.)

> Renewables /are/ good for reducing CO2, as every kW produced by renewable is not produced by CO2-emitting alternative.

Yes, that's exactly what I wrote?

> Plus, they make you independent from foreign energy sources.

That's a separate discussion. Wind energy in Germany and burning German coal is independent of foreign energy sources. Burning Russian oil or importing electricity from photovoltaic in the Sahara are both foreign energy sources as far as Germany is concerned.

As long as you make sure that your foreign imports come from a wide variety of friendly countries, that's not too bad. Eg Germany importing nuclear power from France or wind power from British off-shore farms doesn't seem very concerning to me.

(I'm just using Germany as an example here.)
Yep, the [numerical tower][1].

Python's int is a bignum, but in Scheme you even have rationals built in. There's a notion of which numeric values are "exact" and which ones are "inexact" (i.e. floating point).

[1]: https://en.wikipedia.org/wiki/Numerical_tower
> methane ... MUCH more dangerous than CO2

Eh, it's a more powerful greenhouse gas, but it's also gone after ~10 years.
> and the most accurate way to do this is to first isolate the pathogen then show that introducing it to a novel population recreates the disease

Yes, that's what the control group is doing in the challenge trial.
Time is saved, brain cells don’t need to ;)
How is desktop performance and startup times for you with Flutter? I tested some flutter apps like Flutter Folio and they seemed to perform poorly.
Like the mess after the French revolution?
Germany didn't need to build new plants, it already had some.

The "it takes decades" argument was used as the reason for not significantly renewing nuclear in the UK - over a decade ago.
> There is nothing that comes close to WebKit in terms of performance/battery life on Apple devices, even on desktop

Now this is a true gem.
Plenty of empty space to do fracking in Europe.

This is a case of ideology over strategic thinking for Europe, IMHO, and we've seen, and are seeing, the consequences of relying of foreign imports instead.
No, they bought a gpt3.5 license, with privacy related terms that are absent to the normal free version.
I'd like to mention the role of corruption in Germany in all this: Gerard Schroder who was essentially bought by the Russians the way I see it.

He initiated the push to close German nuclear reactors and push for renewables + Russian gas for base load to replace clean nuclear. After which he got a nice job with Gazprom in exchange for his "good work".

Russia won, Germany (and by extension all of the EU) lost IMO. EU essentially funded part of the war against Ukraine in the early days, because Germany had made itself (temporarily) dependent on Russian gas.

The only country in Europe who was immune to all of this outside influence and even benefittted: nuclear country France (the biggest net exporter of electricity in the EU last time I checked).
Yeah. At one point the company had over 700k paying members, almost half of which were from companies with over 500 employees. At the peak the company was the largest holder of Manhattan commercial office space.

The part the "documentaries" left out is that there was actually a really good business at the core. Giving companies of any size the ability to hire in any market globally and giving their employees the flexibility to live almost anywhere, while maintaining the amenities that tech workers have come to expect. We just had a chain of completely incompetent leaders who refused to see the company for what it was.

Adam used the company to launch his own montessori school for his children because that was more exciting and "visionary" than building a managed service provider model and leasing laptops to member companies and providing unified helpdesk/IT at every location (which would have absolutely printed money). He bought a literal glass factory (to make cool windows) instead of leveraging our network of small business owners to have almost zero customer acquisition cost for high margin businesses like managed book keeping or HR/payroll.
diskprices.com has a good concept but every time I tried to use it, I found that it has too many "garbage" listings (weird brands, 3rd party sellers, obvious scams, etc.), to a point that it would be easier to just search a few reputable brands manually on Amazon.

Again nothing against the website itself, just unfortunate experience in practice.
Slightly OT but has anybody built an aggregator for bio-related content on HN?
The initial premise was you can make an account anywhere and it works transparently anywhere.

The new premise after the "de-federation" update is it still works transparently so long you're a good citizen with nothing to be ashamed of, which is enough to make users feel the Fediverse lost its thing or something along that.
Let’s not delude ourselves, of course it was a huge factor
It sounds like you have no idea about what teachers actually do and how they interact with students.
TBH, I don't really think they compete in anything like similar markets.

You buy a DGX A100, or a cluster of them, for training and running large deep learning models (or for doing "traditional" HPC).

IBM's solution is more a small inference engine that is part of the CPU, so you don't need to move you data off-chip when doing a little bit of inferencing as part of some other workflow. I don't work with mainframes so I could be talking out of my behind, but maybe something like DL-assisted fraud detection as part of processing bank transactions?
It's 20% incidence in general, highest in Asian (Indian etc) communities - not completely correlated with melanin.
Then when neural rendering becomes a thing in games we'll have come full circle
"I'm stuck in the Taiga and a hammer is all I have"
There are many popular wrappers like axios that fix some of these things.
Curious about data protection here as Google Chromebooks famously had trouble with public schools in the EU. OpenAI may have the same or worse issues.
A well-written critique can help you put into words how you feel about a subject.
This argument of UI design needs to die a quick death.

The fact is, no matter what interface you use, you are going to become accustomed to it, and over time you are going to be just as efficient at doing stuff.

I can easily make arguments about iPhone shitty notification system compared Android, or lack of easily accessible settings, but we both know that people who use the iPhone don't really have an issue with it.

This is the same "vim vs IDE" pointless arguments that people used to have.
> Nuclear doesn't suck CO2 either.

Yes, agreed.

> Moreover a single nuclear unit costs billions to build, billions to maintain, billions to dismantle, all under control of a single entity/company. Whereas renewable costs are much more spread, can be managed by many different companies, etc.

The government should ask nuclear power companies to post a bond upfront to pay for the dismantling.

I don't think the whole 'single entity' thing is that bad. Nuclear power plants are still relatively small compared to the whole power infrastructure of a country. They are not more concentrated than eg hydro-electric generation from dams.

Just to be clear: I'm not arguing against renewables here. I'm arguing against turning off nuclear power plants that are already running, and have modern-enough safety features.

(Though I would argue against giving direct subsidies to both nuclear power plants and renewables. You should tax emissions, and let the market sort it out. You can even re-distribute the take from that tax to all voters, so that the average person doesn't have any extra tax burden.)
Wow that is saddening to hear.
I don't trust Google enough to feed them my data though. I don't even use a google account on my Android devices :)

OpenAI and Microsoft aren't a lot better but it is somewhat better at least.

So Gemini isn't an option for me. Curiously enough, LLaMa 2 is, even though it's from meta, but the fact that you can run it at home is of course a real winner for privacy.
Hold my beer!

https://alive22-dev.turnaroundhealth.com/static/javascript/q...
An RTOS defines a stricter latency envelope than a mainframe, almost into "deterministic latency" range.

For example, you can say "this operation will take at most 3ms" in an RTOS, and it'll never exceed that number. If you're running on a fixed-frequency system, you can even say that I expect an answer in 2.8ms all the time, every time.

In a mainframe this is a bit relaxed. You can say that latency is <3ms 99% of the time, <3.1ms in 99.999% of the time and <3.5ms in 100% of the time.

IOW, you never think/say "somebody is running a heavy load on the host, and I also slowed down because of them".
VR headsets are already borderline impossible for 90% of the population to operate. Kid gloves / rails experience is the only way normal people can use it.
> US managed to do more about their CO2 emissions than Europe. That's because thanks to fracking the US move a large share of their energy generation towards natural gas, which burns 'cleaner' than oil and coal

The climate benefits of the lower CO2 emissions from burning gas, instead of coal and oil, are partially offset be the greater methane emissions. Then again, you can't compare natural gas CO2 + CH4 emissions to only CO2 from coal, as coal production also releases CH4.

As long as methane leaks from the natural gas supply are below 4% or 5%, gas is better than coal.

https://www.nature.com/articles/s41598-021-90839-7
I remember the numerical tower from Scheme. That was an interesting concept. (Though mathematically, you might want something with a more complicated structure than a tower. Eg p-adic numbers would sit below integers, next to rational numbers, but not below them.)

Python has rational numbers in the standard library. They are easy to use there, too.
This is dangerous for security, because now your math operations are no longer O(1) and might allocate memory.
> but trying to go 100% renewables is very expensive.

Any source for that claim? I mean, yes it’s not exactly cheap. But neither are the alternatives. Expensive compared to what?

I’ve seen several studies that indicate that going 100% renewable will be cheaper than the energy infrastructure we have today. Either in a 2050-perspective with the technology/prices we have today (Marc Z Jacobsen). Or on a shorter timeline assuming continues technology and price improvements (Tony Seba).

> Sadly, the final nuclear reactors were shut down last year.

I think it remains to be seen which path was the right decision. France has recently had some very expensive and long outages. They had to import power from Germany for long stretches during the energy crisis. France has also had some downtime due to hot weather, something we’ll be seeing more of.

Most of these nuclear power plants are old. And if they can’t be relied upon as actual base load, what’s the point?

I think going 100% renewables could have some major benefits in focus (no need for government to spend resources on regulating nuclear power) and synergies (you get lots of excess cheap electricity that can be used to make hydrogen which can be used to decarbonise steel and fertiliser production, and you invest more in battery R&D which also benefits cars and off-grid applications).

We’re also starting to see that advanced geothermal could become a viable alternative to nuclear. I believe that would be a huge Hail Mary to the energy transition because it’ll be easier to get people from the oil and gas section aboard. That will give a lot more political willpower for the transition.
Yep, cloud is really just an infinitely scalable mainframe.
The choice between .NET Core and .NET Framework for application development is significant in the ever-evolving software development landscape. Microsoft develops both frameworks, which has its own features, advantages, and use cases.
A group in Norway ran a pilot plant producing iron from sulfide ores back in the 1950's. Their paper quotes achieving 85% efficiency and around 4.7kwh/kg. It feels like with eletrowinning you can get the cost down to a few hundred dollars a metric ton. Scrap is around $200/ton. So not grossly uneconomic.

I think the devil is really in pre-processing ore. Whatever process can do that most cheaply is likely to win out. If you can figure out how to use waste like red mud so much that better.
Shopify is a sponsor! I wonder how that came about.
Crash-only software works for Erlang, and I think people expect telephony switches to be reliable. (Swift also crashes on overflows and runs your phone.)

Most of your examples would be just as bad if they started having unbounded incorrect behavior, and an overflow you didn't know about could lead to that. So don't get the math wrong!
There has been some research mostly into gay men. But honestly the transgender data set is much richer. At the end of the day it is a minority that is being politicized so not exactly being investigated, but once you figure it out it is like shooting fish in a barrel there is so much easy research. Before this it was (simplifying but not) brain scans for the most part. It was mostly unknown.
This article is talking about elementary, middle and high schools in Oslo municipality. The grant you're talking about is for higher education nation wide.

Even still, they use quite a lot of money too.
It's always seemed crazy to me that the TPMs are separate chips rather than being integrated with the CPU; at least in the same package if not on the same die. That would make the bar for attacks like this much much higher.
Compare and contrast the query execution stages of PostgreSQL and SQLite. How exactly do they work? Please be as precise as possible. Try to avoid imprecise terms like "simple", "suffering", "system layer", and "hack."
Slow metaboliser here. If I drink a coffee at 11am my heart rate rises and doesn't return to normal until the following morning.

There are other genes for it too, like one that affects the degree to which coffee causes anxiety. And plenty of others that we haven't found, presumably.
> Right now my sense is that it’s like we’ve just invented transistors. We’ve got a couple of consumer products that people are starting to adopt, like the transistor radio, but we don’t yet know how the transistor will transform society. We’re in the transistor-radio stage of AI.

Sounds about right. We've stumbled upon a fundamentally-new unit of compute and made it available to (most of) the world overnight. No other technology has materialized at global scale so quickly, so adaptation and remixing is going to take time.
I in no way claimed that I proved OKRs are bullshit. I only stated that they have been ineffective in producing actionable data at the companies I've been at. If OKRs work for you, great. It doesn't mean that they are a universally good solution.
I read Ars multiple times a week. It's not Pulitzer-winning stuff, but certainly more thoughtful than The Verge. Can someone help me understand why it's being panned as losing quality?
Further proof Monero works as intended!
Don’t want to jinx it but I’ve been running a pihole on a RPi 3 for a really long time - at least 6-7 years and the only thing I’ve had to do is an occasional upgrade.

I like the convenience and the fact that I’m blocking about 4M domains.

My TV is also forced to use it so ads don’t update on Android TV.

Not sure if NextDNS supports custom domain lists or not.
I love noise cancelling headphones in public.

Many shops, cafes and restaurants insist on playing music I really hate. Certain types of popular music make my skin crawl.

My favourite tech product of recent years has been effective noise cancelling headphones I can keep in my pocket to block that out.