MikeHolman

I worked on a browser team when Spectre/Meltdown came out, and I can tell you that a big reason why Firefox and Chrome do such severe process isolation is exactly because these speculative attacks are almost impossible to entirely prevent. There were a number of other mitigations including hardening code emitted from C++ compilers and JS JITs, as well as attempts to limit high precision timers, but the browser vendors largely agreed that the only strong defense was complete process isolation.

I'm not surprised to see this come back to bite them if after like 7 years Apple still hasn't adopted the only strong defense.

I think Meta would make the most sense. Funnel people to facebook, instagram, etc. Get all that juicy tracking data and boost additional ad revenue.

Doesn't really seem like much of a win for consumers though... it's just trading one personal data hungry megacorp for another.

Strongly disagree. 45 days to allow the authors to fix a bug that has been present for over a decade is not really much added risk for users. In this case, 45 days is about 1% additional time for the bug to be around. Maybe someone was exploiting it, but this extra time risk is a drop in the bucket, whereas releasing the bug immediately puts all users at high risk until a patch can be developed/released, and users update their software.

Maybe immediate disclosure would cause a few users to change their behavior, but no one is tracking security disclosures on all the software they use and changing their behavior based on them.

The caveat here is in case you have evidence of active exploitation, then immediate disclosure makes sense.

I'm sure this isn't something at the exec level, but it seems possible someone somewhere in middle management who oversaw used van sales wanted to increase their revenue numbers and thought cheating the odometer would be an easy way to boost their numbers.

Why should reddit have to freely support a third-party client that doesn't provide revenue for them?

The only reason is that the status quo is they have in the past freely supported these use cases, but it doesn't seem that unreasonable for commercial use API access to cost money.

I totally agree. The Chinese Room and, in general, philosophical arguments about the limits of AI always seem to come down to the belief of human exceptionalism.

>If enough of us do this with personal websites, more and more people will stop using Chrome and start using Firefox. You don't even have to cut Chrome users off from the content -- just annoy them a little, and suggest Firefox.

It's a nice idea, but your personal website doesn't matter. Most people go to a Google website at least a few times a day, and they already tell you to switch to Chrome for the best experience. And almost all of the top non-Google websites also have a vested interest in less adblockers, so none are going to riot over this.

The point is that it is much more land efficient for us to directly eat plants than to route the plants through animals first. Cattle use 99% of the calories we feed them for their own functioning. Only 1% actually make it into the meat that we eat.

I wasn't proposing any specific solution, just stating that eating animals does in fact contribute more CO2 than eating plants. And I have no problem with carbon taxes, in fact I'm in favor. A carbon tax could certainly cover this case if it taxes the CO2 that animals emit.

Beef is an extremely carbon inefficient source of calories. They require a large amount of land, either directly or indirectly (e.g. from corn fields). Pastures and farmland are not effective carbon sinks. Most land used by cattle was earlier forestland or other land that served as a carbon sink. For example, one of the major causes of rainforest destruction in Brazil is cattle ranching.

The compiler absolutely can implement tail calls, I don't know why this keeps getting thrown around. Adding a high-level directive in the spec doesn't enable the compiler to do anything, it just enforces it. The only thing preventing it is browser vendors wanting the .stack property to stay well behaved, but that isn't required by the spec and certainly isn't relevant for non-browser targets.

Even if we did somehow get the political will to fund a project of this magnitude, it could never work. The bubbles would get blamed for every single snowstorm, unseasonably cold day, and any other weather that happened after it was put in place.

I don't think it would last a year before it was taken down, regardless of whether or not it did what it was supposed to do or was responsible for any meteorological event.

Scheduling plays a part, but it is definitely more about vectorization.

Wasm has the same security risk as executing JavaScript in your browser, except with less risk of XSS type security issues because wasm modules are better encapsulated.

The civilian casualties are obviously tragic, but they are not beyond the scale that we've seen in recent wars the US has fought.

If the adversarial image is intended to cause car accidents or bodily harm in some way, then the people printing the t-shirts and the people wearing them are already breaking the law.

And if they actually do hurt someone, I imagine they would be criminally liable.

They definitely aren't all at the same level right now, but I'm happy for the competition. Hopefully it will drive innovation.

That's like saying it's not the painter generating any Art, the gallery curating the art through their lens of critical artistic appreciation is the Art.

IR is usually represented as a sort of linked list of instructions where you can easily move around instructions, add/remove them, and replace higher level instructions with lower level instructions as you go through compiler passes. At the end, the IR is a linked list of machine instructions, which gets written out to a code buffer as the last step.

Bytecode is usually a buffer of high level instructions that is compact and fast to read (for the machine). Good for interpreting and holding the semantics of a program in a format that is more efficient than the source code, but it is usually not a good format for running compiler passes.

That completely misses the point. The problem is that companies won't do the research to find cures -- because cures don't make money.

You can't go to India for a cure that doesn't exist.

As someone who used to maintain a large C++ codebase, people usually bug-dump static analysis results rather than actually submitting fixes, but blindly "fixing" code that a static analysis tool claims to have issue with is not surprising to see either.

If the patches were accepted, the person could have used those fixes to justify the benefits of the static analysis tool they wrote.

Proper Tail Calls (PTC) were a problematic JS feature, and calling it "Optimization" is a huge misnomer. Only JavascriptCore (Safari) ever enabled it.

In many cases PTC causes tail calls to be slower, and it messes up stack traces. This would happen even if a developer doesn't want/need tail calls. So it was a feature that would degrade performance and debuggability of existing websites to allow new code to use a more recursive style of programming.

The main performance problem comes when you have tail calls that need to grow the stack. The engine will need to do work to adjust the stack frame.

In languages like C++, the compiler chooses to do tail calls when it improves performance, but with tail calls as a language feature, engines have no choice in the matter and had to do it even when they would significantly increase call overhead.

On top of this, there there were a number of implementation issues and corner cases. For example, most engines have some extra code layer for marshalling cross-site function calls that couldn't be removed. I also remember there being issues with Windows x64 ABI/stack frames. Tail calls from interpreter into JIT code were another implementation headache.

All this added up to have JS engines basically boycott the feature.

I think this is a very dangerous line of study. I can easily see these results getting used to forward racism and other appearance based discrimination.

I think even more, since there was a stock split since then (share price is dated at 2005).

This is somewhat true, but Windows is a perfect example of this not working. There was no Windows 9, because of fear of people using the Windows string name to detect Windows 95/98 (or at least that is the prominent theory).

Defnitely not the official stance, but Lijian Zhao (China Spokesperson & Deputy Director General, Information Department, Foreign Ministry) tweeted "It might be US army who brought the epidemic to Wuhan."

https://twitter.com/zlj517/status/1238111898828066823

Probably too late for that. Italy outbreak was only like 19 days ago, so I imagine US will be there in about 2 weeks.

I would guess it takes at least a couple weeks from exposure to get into critical condition and treated.

It didn't look a lot like flu. China doesn't shut down their entire country for months over the flu.

Also, I don't know all the market pressures of 1918, but it seems reasonable that the market was helped by the US winning the biggest war in the history of the world.

Don't they test close contacts of cases? So even if not all of the cases are severe, the severe cases will discover a lot of the more mild cases by proxy.

But I guess the incubation period is so long that those more mild cases may resolve before they can be tested.

It may not be much easier than your setup, but my fiancée and I have a shared Simple account that we both deposit $x to each month and then withdraw shared transactions. They make moving between shared and individual Simple accounts pretty easy and allow bucketing money into categories, which we use for various budgets (travel, restaurants, groceries).

For us, we like that the budget is tangible. There is only so much money we can withdraw from it, which helps us avoid blowing through our budgets. It also works well with the way we split costs. I make more money, so I put more into the pool every month, but other than that we don't need to think about it.