EgoIncarnate

(2014)

Title is extremely misleading. It was 100 people out of 250k in one particular group (.04%), not 100 people total as implied in the title. Using the same logic you could say "Only one person has reported bitcoin to the IRS." (out of 2500 somewhere in the fine print.)

Seems... dangerous? Project states it uses "3mw 780nm Infrared IR Diode Laser". 3mw is enough to damage your eye if you don't blink or turn away. Since it's infrared, you won't blink, or possible even notice anything (there are no pain receptors in the retina) until it's too late.

Wikipedia list "780–1400 nm (near-IR) - Pathological effect: cataract, retinal burn"

I wonder if the author actually tested this.

There is no cache flushing in asm.js or wasm, so a key component of the example spectre.c, "mm_clflush()" is a no-op.

Even if the example were to compile, I don't see how it would work as is. It might be possible to attempt an alternative attack where you attempt stuff the cache and determined what got evicted, but that is a different attack and certainly not in the vein of "just recompile your c/c++ based exploits for the web".

"Part of their product is open-source"

As I understand it, this is no longer the case (as compared to say an open core company). They had some open source software. They abandoned it. They hope to open source their tech in the future, but currently they are closed source proprietary tech on top of the usual Linux, node, etc infrastructure.

They may be used by, or useful for open source projects, but currently they are not what most people would consider an open source company. I think that requires at least an open core, which to my understanding is not currently available.

I may be misreading this, so please correct me.

It seems as if this project has gone from open source to a closed source service ? [ https://github.com/replit/jsrepl ]

Are Facebook, Google, and all the other name brands you are using to promote your product using your proprietary service, or the older open source stuff? If you have gone closed source, you should only be using names that are using the proprietary product.

It seems like putting "Open Source" on your front page in a big headline is a bit misleading if you are now a proprietary service. Labeling "Open Source" as a key feature seems disingenuous if you used to be open source but are no longer. If the case now is just that you use open source software, I don't think "Open Source" as headline is appropriate, as that is true of almost any company. The implication with listing "Open Source" as a headline is that your product is open source.

Don't get too excited. This is a micro-benchmark and not representative of what most real world apps will see.

A benchmark of something the scope of a typical rails app is likely to be much much less. Earlier descriptions of MJIT mention benchmark tests that were only ~11% improvement until the benchmark was "tuned" for the JIT. [1]

If you're modifying the the benchmark specifically for the JIT, it's not really a valid benchmark IMHO.

[1] https://medium.com/@k0kubun/the-method-jit-compiler-for-ruby...

(2011)

(2012)

TLDR: It's a basic chat app. It's using a streaming http connection and css "::before" to reverse the order of new output, so it doesn't need javascript. Interesting hack, but...

Yep, Etherium is down 50% from peak as well :-)

I want reasonably priced GPUs for machine learning, so I'm hoping GPU miners will flood the market to liquidate their assets (most can probably get back their much of their sunken costs if they sell now) rather than risk mining it when the price looks like it could go even lower.

I'm referring to https://github.com/excamera/excamera-static-bins . It's not clear where the build scripts, etc are for these projects.

The paper states "ExCamera is free software. The source code and evaluation data are available at https://ex.camera .", but there doesn't seem to be any source code at the linked site. The github has some source code, but it appears to be incomplete with regards to the binaries also present there. Am I missing something? Did the intentions on this change?

I wouldn't take my example too literally. The example was just to illustrate the basic logic for fail open and intentionally wasn't complete or detailed.

For purposes of discussing fail open, how that logic gets translated during implementation doesn't matter. Authorized(User) might be expiring tokens passed in via cookie. IsDown(AuthSystem) could just check some global flag that gets set by some watchdog service on a AuthSystem heartbeat. It could be something else. It doesn't matter because it's not relevant.

Having a direct connection to the AuthSystem or not is an implementation detail, not something that changes the idea "Netflix should fail open".

I think you're overly focusing on details. Authorized(User) might check expiration or other things, but that isn't really relevant to the fail open vs fail close idea being discussed.

If auth is up, everything works as normal. If it's down let everyone in.

I'm envisioning something on the backend equivalent to:

OnGetVideoChunkRequest: if Authorized(User) or IsDown(AuthSystem) then SendVideoChunk

I think this is a backend thing, so renegade client isn't an issue. The choice is: if the auth system was down, should the video system prevent everyone from seeing video, or let everyone in. If auth is down, some people will be able to watch when the shouldn't be able to, but only for the period of time while the auth system is down.

There was a similar experiment where a research ground up flatworms and fed them to other flatworms and they learned the behavior faster. [1]

I suspect the worms aren't "learning" anything, but are simply adapting an inbuilt behavior based upon local conditions. If local conditions cause a hormone or epigentic shift, that would appear the behavior was learned and could be preserved when the brain was regrown. It would also explain how feeding the remains of other worms could "teach" it something. In reality it could just be an adjustment of hormone levels.

[1] https://en.wikipedia.org/wiki/Planarian#Regeneration

@krakensupport seems still active, so while their platform may have gone down, they haven't really gone "dark" - https://mobile.twitter.com/krakensupport/with_replies

Potentially minimal is probably more accurate. It's workload dependent. In some cases, such as frequent interrupts or system calls on older CPUs without the PCID and INVPCIB features to mitigate the cost, it can be be very expensive.

If you had said CPU designers were being sneaky it would be more obvious that you weren't being literal. By saying "Intel silently, sneakily...", it's more personal and seems as if you are being literal. It wasn't really silent either, it was well enough documented that they did speculative execution. Many many very technical and educated people from across the industry knew about this and didn't think it was an issue. They were wrong.

Let's not throw the baby out with the bathwater here. I don't think the problem is that speculative execution is not as invisible as it was once believed. The problem is more of awareness and documentation. If there was an option to disable speculative execution and awareness of the associated security issues from the beginning, I don't think anyone would have a problem with using it for a performance boost where it was safe to do so. The problem is there was an industry wide assumption that it wasn't a problem that turned out to be wrong.

"Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown. To help defend against Spectre, Apple has released mitigations in iOS 11.2.2, the macOS High Sierra 10.13.2 Supplemental Update, and Safari 11.0.2 for macOS Sierra and OS X El Capitan. Apple Watch is not affected by either Meltdown or Spectre." https://support.apple.com/en-us/HT208394

I'm not sure what kind of answer you are expecting. All I am saying is that Intel is not uniquely in the wrong here. There is a whole industry of bad decisions. Whether the decisions were conscious, or only obvious in hindsight I can't say.

Fine, be angry. Even if the reason for anger was justified, the abuse isn't. Write a scathing blog post, rant on youtube, don't buy future products, organize a boycott. Fine. Death threats, calling people at all hours, swatting them, harassing their employer, egging people on to do these things. That's abuse, and nothing that should ever happen because in your opinion someone "fucked up [their own] ip".

> You just need to not give a fuck

Given this is an emotional issue, I suspect this is easier said than done for many people. Whether it be physical pain or emotional pain, some people are more sensitive than others.

I think that's mainly out of luck. If the exploit had been discovered two years later, the story would likely be different. Apple has been much more ambitious with their ARM processor designs and has shipping iOS and AppleTV products affected by Meltdown.

Shipping or not, it illustrates, that Intel was not unique.

Meltdown is not only Intel. Some ARM and Apple designed ARM processors are affected by Meltdown as well. https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...

Removing items afterwords probably wouldn't work as you might be able stuff (instead of flush) the cache and figure out which line was emptied.

Intel isn't being sneaky, speculative reading was a standard and accepted feature for out of order processors for over 20 years (remember it affects ARM,AMD,Apple,IBM etc as well). Speculative reading privileged memory while unprivileged was a big mistake though.

I know, which is why I said they have a common history and core. react and react-dom are both part of the same github project at https://github.com/facebook/react. Frequently when people are talking about React, they only mean the HTML version, not including React Native. For example, the Nerv project mentioned in this post.

While React Native makes use of the react core package, it is a separate github project http://facebook.github.io/react-native/