skysight-inc/HackerNews huggingface dataset:
This is very cool, thanks for posting.

DJB's attacks were from a remote attacker's vantage point. But your paper also takes on Osvik and Tromer, who used "spy processes" to continuously probe local caches to create traces that could be analyzed for key information. I know your paper mentions branch prediction and says you don't have results for it, but what's your take on whether Aciicmez's BTB attack is going to remain viable?

I thought the BTB attack was the cleverest and most disquieting of the bunch, in that it suggested that we don't even know enough about the x86-64 microarchitecture to predict what side channel vulnerabilities we might have in software AES.

Regarding the paper itself: the most provocative claim it makes is that we're trending towards "complete mitigation" of cache side channel attacks. You give two reasons: AES-NI and multicore systems.

The AES-NI argument seems compelling but a little obvious, in the same sense as one could have argued that peripherals that offloaded AES would also blunt attacks against software AES. AES-NI blurs the line between software and hardware AES, but it's still a hardware implementation.

Another argumentative point that could be made here is, AES-NI mitigates cache-timing attacks against systems that use AES. It doesn't do much good if you can't use AES, since the most popular block ciphers that compete with AES are also implemented with table lookups.

I found the multicore argument a lot less compelling, since it relied in part on the notion that attackers wouldn't easily be able to predict the cache behavior of their target multicore systems. It seems to me that the most likely environment in which cache timing attacks are going to be a factor on the Internet is shared hosting environments, in which attackers with the sophistication to time AES are easily going to be able to get a bead on exactly what hardware and software they're aiming at. Most users of AES are also using off-the-shelf hardware and software.
Honestly every time I see one of these it seems like another shot at a straw man thats been worked over like a cheap piñata.

For a lot of folks, applications and startups the valley has advantages, but likely for a far larger amount it really doesn't matter as much. But really anyone who's making a blanket statement for or against the valley is just talking out of their ass.
There's at least one US company I know of called TechShop[1] who have 5 or 6 places around the US with pretty well equipped workshops, along with instruction/safety classes etc.

On the more DIY front, Hackerspaces[2] are a sort of community/timeshare approach to various equipment, and are much more widely spread,[3] but since they're largely community-driven, the range of stuff available varies widely.

[1] http://www.techshop.ws/

[2] https://en.wikipedia.org/wiki/Hackerspace

[3] http://hackerspaces.org/wiki/List_of_Hacker_Spaces
I don't remember Patrick having any slides. Only half of the speakers made any use of slides, with Jessica the most effective (to me) and Weebly/Pinterest/Spolsky tied for distant 2nd.
Actually it can. I'll leave it up to you to figure it out. Proving that the adjusted algorithm works in all cases gets into some interesting number theory (think Galois Fields).
Because they have more points - you get extra points for referrals and completing a set of 'Getting Started' activities.
>The purpose of this brief chronicle is not to criticize the practice of medicine.

Perhaps that wasn't his purpose, but that was the result. And it is a scathing, justified criticism, especially coming from an experienced doctor.

My father died of lung cancer, and we went through similar experiences with the health care system.

Before claiming that something is not a criticism, we have to ask whether or not we can imagine a better outcome, ask what is getting in the way of that outcome, and then make a change. This could be something small, like moving patients around less, and with less resistance. (The purely informational resistance in medical care is appalling, and this story shows it's real human cost. Electronic patient records is not about assuaging "people who can't be bothered to fill out forms".) Or it could be something huge, like revolutionizing what late-stage cancer patients, and their families, expect, and how they will be treated.

If you get late-stage cancer, the health insurance company should hand you $100,000 in cash, a large supply of morphine that can be easily self-administered, and a ticket to Hawaii. Huge bag of weed optional. The message is clear: you're going to die soon, so make your peace with it. Talk to your family.

My father fought until he fell unconscious, his personality ravaged by whole-brain radiation and chemo, in complete denial. He never got a change to face his sentence with courage, and he never really talked to me before he died.

So yes, the practice of medicine needs to be criticized.
> universal healthcare for fighting cancer seems like trying to stop a fire with gasoline

Tell that to the unemployed dad whom, twenty minutes ago, I directed to take his son to the ENT. He has had a swollen left tonsil for 5 years (last time he saw his pediatrician). Now he presents with 1 day of left ear pain. There's a mass hanging off his ear drum. Cholesteatoma? Unlikely. Maybe bullous myringitis. But at this point this kid's whole left pharynx is suspect and 5 years of infection starts one thinking about scary things.
Maybe look into Fab Labs. They're not so much a franchise as they are a community outreach / educational thing. The program was started by MIT. The complete hardware specification totals to around $50,000, which isn't too bad.

http://fab.cba.mit.edu/about/faq/
See also, underscore-cli https://github.com/ddopson/underscore-cli
Show HN: LESS mixins to create golden ratio grids with Bootstrap
>> This language shootout has been criticized before. <<

Criticism can be uninformed, out-of-date, self-serving, mistaken... ;-)
When I was still at SFDC (January), postgres was being cautiously looked into as an Oracle alternative (along with HBase for certain parts, which has definitely been happening). Glad to see they are going for it.
How Do Tech Corporations See You?
Free TrueCrypt Hard Drive Password Cracking
How does that handle duplicate elements?
As a general rule, I never browse to any links from Michal Zalewski. If he's gonna pwn me, I'd like him to have to work for it a bit more. ;)
I rather spend my time with a useful solution than this path. Also it's a BS question anyway.
There are definitely Makerspaces and Hackerspaces around to facilitate this stuff. I'm a member of one called Site3[1] in Toronto. We have a variety of milling machines as well as a laser cutter, 3D printer and a new DIY 3-axis CNC that we are putting together right now. Membership works on a monthly fee like you might expect, and each member is given responsibilities for maintaining the shop. I think there are equivalent spaces emerging in many major cities in North America.

[1] http://www.site3.ca
Harmonizr: Bring tomorrow's Harmony to today's JavaScript
Yeah that was tried over 10 years ago with AllAdvantage.

http://en.wikipedia.org/wiki/AllAdvantage
It is extremely unlikely that you'll be able to sort a random sequence of 1 million 10 digit numbers like that, or ANY method for that matter, unless the particular sequence is highly compressible. You won't even be able to store the answer in the average case. You'll need 10^6*lg(10^10) bits to store the raw input, from which you'll be able to save about lg(10^6!) bits because it's sorted. That comes out to more than 1.7 megabytes.

Edit: the exact amount of bits necessary is ceil(log_2((1e10+1e6-1) choose 1e6)), which is ~1.756 megabytes.

Edit edit: see udiv's comment below: that 1e10 should be 1e8 of course.
True. The problem states, though, that the code can be placed in ROM. I agree that this isn't realistic for a JVM.
I've done CNC machining at TechShop in San Jose. Very nice facility. Learned their CAD/CAM softwares pretty quickly, and found the whole process to be straightforward. In addition to CNC milling, they've got a water cutter, plasma cutter, router, laser cutter, and a bunch of non-cnc tools - mills, lathes, welders, cutters, saws etc.

For me, the biggest bonus of the 'subscription' approach is the interaction with other makers. I just learned a ton chatting with other people in the facility.
Compressed buckets of number ranges. I love it because it's incredibly easy to understand which makes the code easy to maintain, and it works.
'Hang out with people that are similar to you' is a good value proposition. It's a need that many people have that's not met well on the web today. On it's own though, it lacks credibility.

My first reaction would be: 'Meh, whatever. A hundred products already tried to get me to hang out with people like, and I'm using none of them'.

Perhaps it would be useful to consider the problem.

The web is full of places where you can interact with people around topics of interest. Reddit, Facebook Groups, countless chat products, and a sea of specialised communities from Chess servers to HN.

The biggest problem left unsolved in this space is: how do you get people to form real relationships online. Relationships that spill over beyond the site in which it originated and give you a chance for genuine friendship.

If Evemi lets me have more superficial interactions with people around topics of interest, it's probably not going to go very far. If it does have the chance to get me to form genuine relationships, I'd need to know how it does that before giving any credence to 'Hang out with people that are similar to you'.

Just my 2 cents.
Nice article that visually shows anyone what is (or at least used to be) third-year or better engineering material!
I'm not sure if I can agree with this. While I do understand where you're coming from I'm hesitant to say its okay to willfully replace ads on web pages. That's a point I don't have very strong opinions on but I do strongly believe that plugins like the one in question are unquestionably unethical and not okay.

You do own your browser but you don't own the sites you visit or their content. To me when someone argues for being able to replace ads on a website that's almost the equivalent of saying "I am entitled to take ownership of and alter anything I lay my eyes on". Some people counter by arguing that if it's not alright to replace ads then it's not okay to use custom CSS rules or plugins or apps designed to enhance readability. The fundamental difference between those things is that site owners want you to read their content and almost universally happily accept people using custom CSS and readability type plugins but replacing ads is different in that you are making a choice to put someone else's content on their site to the site owmer's detriment. If I were running a site that relied on ad revenue I'd almost prefer plugins that stripped out the ads altogether to one's that replace ads with one's that someone else will profit from. In the case of the former you could reasonably assume the visitor wouldn't be clicking any ads anyway but in the case of the latter that user may still click and youd get nothing.

Imagine there was an eyeglass company that sold glasses that would replace certain things you saw with other things that they decided on. I know this is far out but just follow me here. Now imagine owners of these glasses walk into a mall and the glasses replaced window signage and ads with ones from the eyeglass maker's preferred partners. The shop owners in the mall would be upset but the maker of the eyeglasses would claim they're just giving their customers the deals they want. And then a certain portion of the people who wear these glasses say "I own my eyes. I may choose to replace anything I see with whatever I want".

In 1996 I was 10 years old and grew up from that point on with the web. Ads were annoying for a time but the people posting and creating them learned really fast that their strategy wasn't working and from then on ads have been pretty polite. They mostly just sit in their grid positions. Sometimes they're animated and sometimes they have sound but it's off by default. I don't get why people hate online ads so much. They're easy to ignore and rarely if ever become intrusive these days. But that's a whole 'neither topic. My main point is that suppressing ads is one thing but to replace ads with others that deprive a site from the CPC revenue is unequivocally wrong. It may be legal but it's wrong.
Bret Victors Apple quote is a bad example in this context. He was in R&D, where chances of nothing being released in the end are common and secrecy is high in almost every larger company.

His important quote on this topic is this one: http://worrydream.com/#!/Freedom
I agree --- definitely better to have an possibly flawed article to discuss, rather than no article at all. And as a whole, the series has lots of great information.
That non-Windows machines are a comparable ghetto for C# programmers really only reinforces my point.
I'm pretty much convinced that the GH movement is merely a recognition that us product management folks now have a deeper pool of data on which to base our decisions. This is, in the bigger scheme of things, a recent development and not available to product managers across all industries.

I welcome the controversy. Eventually GH as a buzzword is going to fade away; those left standing will have simply added GH to their personal toolbox. 'nuff said.
I think not only MIT students hacked (automated or scripted would be actual word, since there is no hack involved) spacerace. Though, that was expected.
If people start paying serious attention to this sort of analysis, motivated parties will begin to manipulate the data.
This.

This is the cure for cancer we need: affordable routine scans.

Though more scans means more results for doctors to analyze. Hopefully algorithms can make that part cheaper too.
"It’s left one of us without access to MIT’s network." - I'd be interested to hear what happened.
It really should have direct links to the papers. Even some of the author links gave me 404 errors
Universal care is not running in the opposite direction.

I live in a country with universal healthcare.

I have several relatives who were diagnosed with terminal cancer. In this case, the hospital simply told them, the cancer is terminal and they've been given doses of morphine until they passed away. In USA, hospitals are facing conflict of interest. On one hand, they shouldn't be providing unnecessary expensive care but then they wouldn't be making as much money. No hospital should be ever put in this position.

Honestly, I'm shocked at how many people in US are against universal health care.
In addition to what others said, there's even fewer differences between them internally.

Salsa20 <stream cipher> is not a "traditional" stream cipher -- basically it's Salsa20 <hash function> (not collision resistant) in counter mode. The hash function itself is implemented as permutation with final addition of input words to make it irreversible. With this permutation you can build a block cipher, and by the way that's what SHA-3 finalist BLAKE does by introducing addition of key words during rounds (except it's built on a variant of Salsa20 called ChaCha20).

(I'm not saying that you should build your own block cipher from Salsa20, of course :)

The original sentence, though, is:

try Salsa20 rather than AES and Poly1305 rather than GCM.

AES-GCM is also not a "block cipher".
The New York Times could probably commission a Sambreel detector for less money than it's losing to these scumbags. You have a right to the screen real estate in your own browser, of course, but the NYT has the right not to serve you content if you're not going to abide by its terms.

Whatever you think about the ethics of ad blocking (not a quagmire I want to wade into), NYT ads fund one of the best regarded operations in all of journalism, while Sambreel ads fund... what, exactly? Let's not lose sight of what a scam this is.
1) bo1024 explicitly agrees neither he nor anybody else will use his internet account for illegal activities

2) an ip address is seen uploading or maybe even downloading the latest Bieber album

3) the ISP's logs show that ip address was assigned to bo1024's account

Pretty much the only thing that can go wrong is that the company complaining does not have the authority to complain about that file and that's happened with automated DMCA notifications because they use some sort of dumb keyword monitors.

They don't need to automate choosing which torrents to spy on, a single person lurking on TPB's top 100 movies and musics would cover the majority of people by far.

Which route they go can make this all very accurate.
Some honest feedback, FWIW...

What's your plan to get users? A large part of the success from other asset-sharing services is due to the fact that they initially chose a vertical (Airbnb: apartments, Getaround/RelayRides: cars) and made a small number of people in that vertical incredibly happy. Generalizing to "all things" has the advantage of making your target audience/market bigger, but also seriously risks making the average experience worse for a couple of reasons: (1) you're constrained to keeping the interface generic enough for "all things", and (2) by not targeting a vertical, demand/supply becomes much less targeted, meaning you need a large user base for the marketplace to be useful.
You mean: They have a keyboard.

Both iOS and Android have SSH.
The nurse's action in this situation is more a case of not violating his/her scope of practice. "Ice chips" is actually a specific diet order in the hospital. If a patient gets admitted with a diet order of "NPO", the the patient is not allowed to get anything by mouth ("nil per os") which includes ice chips and oral medications.

For the father to expect that the nurse should get his daughter ice chips when she probably had an NPO order is more a sign of his emotional distress during the situation. "I tell her I am the doctor, and I want the patient to have ice chips. I am told I am not the admitting physician and cannot give orders. She ignores my request to show me the location of the ice machine."

Though we all can identify with him in this situation, why would we have any expectation that the nurse would violated his/her scope of practice in this situation? The practice of nursing doesn't allow for writing a patient's orders.

His story is an example of the problem with the process of dying. All of us are dying. The question is when do you stop trying to extend life? Even a senior gastroenterologist could not help make that decision earlier for his daughter. No one - physician, father, family member - wants to bear that responsibility/guilt. We put that decision upon the person who is close to death, but they never really know how close they are. So what is the medical system supposed to do if a decision is never made? Continue will medical care, which is the most expensive at the end of life.
How Google Cools Its Armada of Servers
See 35 U.S.C. 102.
This hits close to home. I came within a hair's breadth of losing my infant daughter to cancer just over a year ago, and a few things come up in my thoughts:

- Not all medical systems are the disaster described here. We elected to move back from the US to our native Canada to undergo treatment, and our experience in ward (pre and post-op as well as on the oncology floor) was a dream (at least given the circumstances). We experienced nothing but exemplary inter-disciplinary cooperation, compassion for the patient (and family) experience, and a professionalism driven by clinical need rather than liti-mitigation. These qualities were exhibited even more strongly during the initial phases of treatment post-discovery, which unfolded along a timeline similar to the one discussed here.

- Academic hospitals are exhausting. My spouse ended up being the real hero in this story (she was still breastfeeding at the time, and only one parent was allowed to overnight in the room). My job was to make sure she and our daughter had recovered enough each day to make it through a night of vitals, endless beeping, and the occasional overnight chemo administration (don't even get me started about that).

- The need for patients and their families to drive the narrative of their hospital experience and be their own champion is critical. I had worked in healthcare for many years before this nightmare began (my old office was at the hospital across the street from her room) and knew the system very, very well. We divided up responsibilities so 'I looked outward, and [my spouse] looked inward', meaning that I spent my time making sure that the relevant referrals happened, that medications were administered on time and on dose, and so on. My wife looked inwards towards our daughter, making sure she was fed, entertained, and comfortable. This setup worked very well for us, and was a likely contributor to our level of care.

- The power of parents to be strong in the face of terrible (often inevitable) odds is truly inspiring. We were lucky enough to know with reasonable certainty fairly early on that we would one day be leaving the hospital and resuming a normal life. Many, many families we met were not so lucky. To see a parent express joy and love in the face of such long and terrible odds is a truly unique experience. I myself am a measurably better parent for having witnessed it.
A part of it is probably the litigation-happy culture in the US itself, the other one is laws that don't seem to include palliative care as an essential and non-negotiable responsibility of any medical profession. Would this be the case, the ambulance driver would be liable for driving a moribund patient to an ER instead of a hospice against a doctor's order.
>> not very indicative of real world performance when people are more likely to use the collection classes <<

That doesn't seem much more than a big fat assumption - aren't there also going to be many situations when the right thing to do is use an array?
ah, ok, thanks. "random access" makes everything much clearer.
Yeah, I just thought it worth calling out explicitly.
Getting people to care about something is hard, what else is new. If you build a genuinely great product, distribution will be a lot less of a problem. Many users will tell their friends, journalists will be receptive.

If you build a 'meh' product, yep, you're going to have a hard time.
MIT has more Space Racers than students and staff
What is the difference between startup incubators and accelerators?
Statistics was around then.

I consider science to be the art of making correct predictions. So you need a hypothesis (in the form of equations or computer programs) that can be tested on observations leading to correct predictions.

Extroversion/introversion might be scientifically rigorours by that definition (they might have done quantitative studies) but I'm not sure Jung did those, and even that it makes sense to create such a classificaton - people are a lot more complex and I don't really see the need for use of such classifications.

That's a problem I see with psychology, sociology, economics, and other "soft" fields. The quantification of things which are far more complex than the simplistic models created to the point that they are essentially meaningless. It's meaningless to quantify people into races or skin colors and that's about the level that those sciences are at.
I'm not sure what the point of this is, it's more skeuomorphism that is becoming more and more misplaced in a digital age.
this is how i would like to get reviewed!