pandalicious

>The presence of EMTE leaves Spectre V1 as one of the last avenues available to attackers to help guide their attacks, so we designed a completely novel mitigation that limits the effective reach of Spectre V1 leaks — at virtually zero CPU cost — and forces attackers to contend with type segregation. This mitigation makes it impractical for attackers to use Spectre V1, as they would typically need 25 or more V1 sequences to reach more than 95 percent exploitability rate — unless one of these sequences is related to the bug being exploited, following similar reasoning as our kalloc_type analysis.

Did they ever explain what that mitigation does?

Am I misreading this or is that "How close is Spanish from Different Countries" graphic kind of jank? There's intersecting lines that are missing, like Puerto Rico and Dominican Republic.

that's amazing, do you know why it works?

For anyone else that’s confused, TLS = thread local storage

"apps my mom could build" kind of describes Excel workbooks. People effectively use excel to build (highly constrained) GUIs for processing data using custom logic that they specify themselves. And excel's popularity speaks for itself, it's completely pervasive. So that's the answer; the audience isn't programmers, it's the officeworkers all over the world currently using Excel to automate office tasks and want a better delivery mechanism than a shared Excel file on the office LAN. That's such a big pie that even capturing a small slice of it might be a reasonably profitable endeavor.

The .NET standard library docs are a thing of beauty because they intermingle autogenerated javadoc-style documentation with generally well-written freeform "remarks" sections that include more general explanations, context, and code samples.

>Don't all great projects start young and gain interested folks to make it widely used?

The counterpoint to this is that making a robust cross-platform GUI library is a massive endeavor and there is a veritable mountain of cross-platform gui projects out there and overwhelmingly they end up as never-finished abandoned projects. The exceptions like Qt and electron that actually succeeded tend to have large organizations behind them.

sort/index the db table by string length, start your search with the closest length strings (bigger and smaller) and then stop if you find a levenshtein distance that's smaller than that the length difference between the key and the next closest length string? In many(most?) cases you'd still end up searching the whole table but at least in some cases you could end the search early.

Spotify vs Google Play Music is the perfect showcase for this. They both get the job done but Spotify is better in so many small ways. Meanwhile, instead of being improved, GPM is in the process of being abandoned for the new shiny thing, Youtube Music.

what about local filesystem access, os integration, and all the other things that you expect a desktop app to be able to do (like in this case executing a separate binary) which violate the security models of browsers?

I think you're overestimating how much development at tech companies is done using newer languages. Java is the dominant language at both Amazon and Google.

Looks like the Iran connection came from a guy with a history of opportunistically jumping in on big security news stories: https://mobile.twitter.com/imdeaconblues/status/110504680622...

I always wonder why Google didn't just keep improving/extending Hangouts. Was the codebase just unsalvageable? Was it something to do with Google's internal politics?

I think that’s one of the reasons that WPF never saw much use in terms of widely distributed desktop apps. You couldn’t assume the presence of a particular version of the framework on any given Windows install and (until now) you couldn’t bundle the framework with the app like you could with the JDK.

Most people who buy EC2 instances at scale won't want most of them to have persistent storage attached. Storage is handled by a DB or S3.

It's funny how all these replies are almost an answer in an of themselves. You laid down a basic truth: the only thing technically distinctive about a blockchain is the trustless consensus algorithm. The rest of it is perfectly run of the mill tech. And yet the deluge of replies is completely focused on the run of the mill tech like merkle trees and distributed datastores. Some good ideas maybe but nothing to do with blockchains.

>Utility tokens exist to provide access to a good or service on a decentralized, blockchain-based network. [...] Siacoin is specifically designed as a utility token and has never been used for fundraising.

And yet it looks and behaves exactly like a speculative vehicle, just like all the other crypto coins.

I'd really like to see his proposal as something you can toggle when you navigate to someone's twitter profile, since when I do that I'm usually only interested in things they wrote themselves, not things they retweeted.

Does their patch also disable root accounts that were enabled using the exploit?

It seems like the concepts are orthogonal though. The reason powershell works is that it replaced the entire shell toolchain with object-oriented equivalents. Without that you're fundamentally limited because your inputs are still plain text, so you're still doing the equivalent of awk/sed scripts to transform text into structured data.

There was a reddit comment I came across years ago and saved because it sums up the limitations of shell scripting so well:

I think I've just come to realize a sad fact though: processing raw text streams through mostly-regular languages is really weak. There aren't that many problems that can be solved through regular or mostly-regular languages, and not many that can be solved well by the former glued together with some Turing-complete bits in-between.

https://www.reddit.com/r/programming/comments/2svijo/command...

It's pretty telling that Linux distros are pretty much the only end-user platforms where binary distribution and packaging is built around shared libraries. Pretty much everyone else (Windows/OS X/iOS/Android/etc) generally expect binaries to include their own bundled versions of 3rd party libraries. Lots of people have looked at this problem and most have opted against the shared library approach.

Yep, WPF is probably the best platform at present for creating rich GUI apps. It's failure to really take off is overwhelmingly caused by its complete lack of cross-platform capability. If you're creating a new Windows app from scratch it's really hard to justify using a GUI framework that eliminates the option of going cross-platform in the future without needing to do a near-total rewrite.

Did you even read that email? It's from an academic in the Arts and Humanities world and the whole email is basically just a guy waxing philosophic to Podesta about the current election. In context, there is NOTHING revelatory about that email. It's just private correspondence.

That email is the perfect example of wikileaks publishing material irresponsibly. There is nothing in there that is in the public interest, nothing to justify the violation of the privacy of Podesta or the sender.

This is exactly what I do as well and it drives me nuts that it's not the default normal way that adblockers work.

Do you also use a "@@*$document,domain=~foo.com|~bar.com" filter in order to accomplish it?