Slashdot Mirror


User: DrYak

DrYak's activity in the archive.

Stories
0
Comments
5,713
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 5,713

  1. "Perfect" bio-weapon virus on Urgent Needs To Prepare For Manmade Virus Attacks, Says US Government Report (theguardian.com) · · Score: 1

    If you infect people in an area, those people won't immediately fall dead. They will move about and die slowly. People won't know if they are infected too. It would cause chaos.

    So definitely *NOT* a fast-burning virus that infect{s} the people exposed to it immediately {killing them} in a gruesome way" as you proposed above.
    But something that spreads insidiously.

    What you don't want is a bioweapon than can spread indefinitely. Those are the kinds of things that can get out of your control quickly and end up turning on your own forces.

    Which brings us back to the main topic of discussion :

    - increasing the lethality of virus won't help doing that. If people start dying immediately, it won't move slowly, it will kill immediately a couple of people and then to move further due to absence of next victims in the immediate vicinity.
    Basically : you don't want to CRISPR-in some extra deadly stuff into you virus.

    - instead you could take a historically deadly virus that has spread wildly in the past, but was eradicated thank to vaccination, and mutate and/or tweak its surface antigens until it's not recognizable at all by the older antibodies. Then you make a vaccine against this new virus and keep it secret and vaccinate all your soldiers (and your civilians if possible, but at that scale it's going to be hard to keep the vaccine secret). You spread it on your target.
    Basically: you want to do what europeans managed to inflict to amerindian using smallpox (which the indian had never seen before and lacked anti-bodies).

    If you don't have the resources to mutate your own virus, it's even easiers: Do the "underdog influenza" - try to pick one of the minor emerging influenza strains that isn't predicted to go into the upcoming seasonal flue and isn't included in the latest vaccine mix that the WHO recommends and that vaccine maker cover.
    Simply grow that one and make your flu vaccine against that one using usual methods.
    (That regularly happens when WHO and the vaccine makers mis-predict which virus eventually does the seasonal flu. Except you do it on purpose and weaponize the mis-predicted virus strain).

    As a bonus :
    - the disease won't necessarily kill everyone immediately (smallpox might be fatal in adult but flu generally isn't as frequently) you seem more humane, while at the same time overloading the health care network of your adversary who'll have to divest resources from the war effort to handle the overcrowded hospitals.

    - eventually new (non-secret) vaccine can be created against the new virus and/or people will end-up developing an immunity, so by the time the war is over, the new virus won't pose any large-scale world-problem.
    You only need to have enough new viruses and secret vaccine to cover the period of war, while at the same time ramping up your own vaccine production against whatever your enemy throws at you. Basically playing bilateral cat-and-mouse with viruses.

  2. They won't die. No.

    The problem is that their market is shrinking:

    there are plenty of people who still need or want high performance processors.

    Yup, earning millions on specific contracts to build giant HPC center every few months seems lucrative.
    (What will eventually become of Intel according to this trend).

    Until you realize that there are billions of people on this planet, thus billions of pocket to fill with a smartphone.
    ("Pocket computer" metaphor in full force. In some region (older, second hand) smartphones are the only computers that people will ever come into contact with).
    Intel didn't manage to become "the x86 of smartphone/tablet/other pocket devices", despite an initial strong (pun intended) start back in the PDA era.

  3. /. vs the rest of the world on Google is Adding Anti-Tampering DRM To Android Apps in the Play Store (androidcentral.com) · · Score: 3, Informative

    Congratulation, you're the typical kind of people who hang on /. (ultra curious geeks, etc.)

    The thing is that, there's the rest of the world, we're a bit north of 7 billion of humans on this planet.
    Out of them not every one last of them thinks the same way as us.

    Some just want an appliance, a thing that just works when they push a button.

    There are people who can rebuild the old faulty electrical wiring of a dilapidated house.
    and there are the people who just want the light to turn on when they push a button and are happy to give money to someone else to make it happen and don't *want* to give a damn about what's going on under the hood.

    Apple, and the "walled garden" type of application platforms try to solve this regarding phone.
    There are people who (for a good reason) release that they have a full blown personal computer in their pocket.
    And there are people who just want to talk to their friends and send funny pictures of cat, and don't want to give a flying fuck about what an "operating system" is.

    The only thing which I'm not happy with and which several people have talked in this thread, is that some like Apple and lots of Android manufacturer want to give you NO ALTERNATIVE to the walled garten, they do not give you the key to the main gate of the metaphorical garden's wall.

    I would prefer phone that are locked-down BUT can be unlocked and put into developer mode if desired by the owner ( <- dear phone companies, please note the word and stop considering us as rental. We paid it, we own it, thanks).

    ---

    Also a thing to think about is that some point in the future, the big fat warning upon activating the dev mode won't be enough.
    - People get desensitized by clicking "Okay" on any pop-up warning. (Same problem that windows have since they introduced UAC due to problematic software that can't run on anything but admin mode).
    - The "dancing pigs" problem : people are ready to follow any weird complex instructions from shady corners of the web just to get access to the funny video of dancing pigs (like installing some horrible spyware/botnet node that pretends to be a video player and codecs for the video). You can predict that if one day when the walled garden gets a little too efficient at rejecting malware to the taste of attacker, youtube bot-channels are going to pop up with "howtos" tutorials explaining how to put the smartphone in dev mode to side load "the best app to send video of kittens around" prompting even grandma to shoot themselves in the foot security-wise.

    We'll have to think and prepare how to deal with this in the future (if we don't the manufacturing companies will choose the "more DRM" solution instead for us).

  4. chimera viruses on Urgent Needs To Prepare For Manmade Virus Attacks, Says US Government Report (theguardian.com) · · Score: 3, Informative

    various new diseases that our immune systems don't know how to handle.

    By definition our immune systems doesn't know how to handle disease (be it new or not) with a few exceptions,
    because our immune systems relies on adaptive immunity (with a few exceptions where the innate immunity can wipe a couple of pathogens).

    Our body have evolved not to handle only *known* pathogen (which would have been a pretty stupid strategy : such animal would be only 1 mutation away by a known pathogen to evade the innate immunity and wipe out the innate-only animal. Such animal would have been unfit and would have gone extinct if they ever hapenned to exist).

    Our body have evolved to be able to handle any unknown pathogen as long as they can survive long enough for the adaptive immunity to kick in, actually adapt and come up with a solution to wipe out the attacker.
    Works pretty well most of the time (most of the time, you don't even get sick, a few of the time you get sick but manage to fight off the infection. Only a few pathogen that have evolved ways to fuck up the adaptive immunity - e.g.: HIV fucks up the lymphocyte - or hide away -e.g.: rabbies achieves evasion by burrowing into the hard-to-access nervous system)

    And vaccination is basically just giving a "practice target" to the adaptive system to practice its adaptivity against and come up with an efficien wiping-out solution, before an actual occurrence of a disease.
    Its leveraging the same natural adaptive process that your body does every day against any upcoming as of yet unknown disease it encounters (and on some bad days, while already having caught and being sick from said just-yer-encountered disease).
    Your white blood cells are literally encountering crazy amount of new compounds every days and inventing new anti-bodies against them. Vaccination is just adding yet another compound on the list, because one day, you might encounter a pathogen with said compound on its surface that could make you sick.

    the semi mad ones have been doing it since the 1930s by using mouse brains and other animal tissues to grow or weaken the viruses used in vaccines. And in the process, transferring animal viruses into the human population causing various new diseases

    There is very little scientific research showing actual problems caused by vaccination. (e.g.: the "autism caused by vaccine" paper was retracted due to being actually bullshit).
    There is huge amount of litterature showing the actual benefits of vaccination (you can spend days hunting for meta-analysis about vaccinations on search engines like PubMed).

    I'm not aware of serious peer-reviewed scientific article showing that vaccine are a vector of animal viruses jumping to human hosts (again, please concentrate on serious scientific journal, that will anounce retraction if an article turns out to be bonker. Not click-baity random websites).

    The documented jump-over-species barrier are usually caused by combination of environmental exposure (e.g.: people working knee-deep in animal excrement) and by chimerisation due to co-infection (e.g.: a pig on a farm with dubious hygiene managing to get infected both by some bird-exclusive influenza and a human-compatile influenza. There's quite some research into this. Again rely on scientific publication from reputable sources.)

    So at that point you have to admit that the "cancers are caused by all the weird mouse-brain-vaccine-hybrids" doesn't sound a very compelling theory.
    Or that absolutely the whole planet is in a conspiration to hide the fact from you personally.

    Vaccines are safe, they are among the most well studied modern medicine.

  5. Then why bother with bioweapon on Urgent Needs To Prepare For Manmade Virus Attacks, Says US Government Report (theguardian.com) · · Score: 1

    If your point is to directly strike and not count on the weapon's own built-in capability to spread.
    (I.e.: you count on spreading viruses that will kill the host immediately without much chance of spreading further)
    why waste resource making *bio* weapon in the first place?

    Chemical warfare has been a reliable way to kill in scary gruesome ways already known and put to large scale use at least one century ago (yperite in WW1).

  6. Limitations of deadly viruses / deadly bacteria on Urgent Needs To Prepare For Manmade Virus Attacks, Says US Government Report (theguardian.com) · · Score: 5, Informative

    and modify common microbes so that they churn out lethal toxins once they enter the body

    In the specific case of viruses, it's counter productive. As some hyper dangerous viruses have shown like Ebola, it you kill your host, you won't have a host into which to reproduce anymore.
    Viruses aren't full autonomous life forms, their just simple genetic code (recipes that need an actual host's cell with cellular machinery to interpret the code and produce more viruses).
    The "evolutionary target" that most viruses aspire to become (i.e.: the fittest mutant that are selected by natural selection) isn't ebola, it's the common cold : a virus that is relatively benign and doesn't harm the host too much, so it can safely keep replicating in a still-alive host, and can have the time to find other alive hosts to which to transmit (while leaving as much alive hosts as possible for a potential future new round of infection by a new variant)

    If some mad scientist create some lab monster that produces lots of lethal toxins, that synthetic virus is at a high risk of killing the host without having had any chance to spread.

    With bacteria, the problem is similar but in reverse : bacteria are autonomous life forms - cells that multiply on their own. They basically don't need us (beyond a few disease-inducing bacteria that rely on bodies for environment (relative warmth) and food).
    Whatever weird dangerous gene the mad scientist sticks into them, that poison isn't necessary to achieve what it basically wants (to multiply).
    So, unless these poison-producing genes are somewhat linked to some critical biochemistry needed by the bacteria, there will be no evolutionary pressure to keep producing the poison (quite the opposite : due to the way they replicate their genome (=single origin) bacteria tend to lose useless gene. Less bullshit genes = less times spent in replicating that bullshit)

    (also, if the bacteria needs some environment for potential victim (say, again warmth) the same logic as with virus applies (a dead host won't be producing any warmth anymore).
    The first infected victim with a synthetic bug will die, but over lots of generation, the bacteria will eventually lose the poison-producing gene because it will be able to replicate faster (and thus over take the slower replicating bacteria that have more bullshit gene) (*).

    So yeah, a few mad scientist could try to CRIPR their way in clandestine lab to build super-bugs with ultra-killing genes, but if these monsters kill too fast, they won't stand a long term chance.
    It will suck for the first few patients who get sick, but the bugs will have a hard time taking over the world.

    ---

    (*) - conversely, that's why antibiotic resistance started to become "a thing" only recently when antibiotics started to get used on large scale (by the agricultural industry, by over prescription, etc.). Before that large scale antibiotics use, there's any pressure to justifiy the bacteria keeping the extra genetic material coding for the resistance (e.g.: the plasmid carrying beta-lactamases).

  7. Ferro-magnetic parts on Man Reports PillCam Stuck In His Gut For Over 12 Weeks · · Score: 1

    Note that either the camera would be not be attracted to a magnet and this suggestion therefore pointless,

    The pill cam has very likely ferro-magnetic parts and should be (slightly) attracted to magnets.
    But..

    or it would be attracted to a magnet and pose the similar sort of risk as having plural magnets and stick together through intestinal wall.

    That was my opinion too, hence my comment :

    But pulling it with magnets could also pull the pill against damaged wall, burrowing it further into the walls, or risking to rupture a peculiarly damaged wall.

    Though as noted by other answers, the point here isn't to have 2 strong magnet with only a few milimeters of walls of gut loops in between (that is guaranteed to pinch and damage even healthy gut), but to have a not so strongly attracted pill cam pulled from a distance by magnet outside the abdominal cavity (might or might not pull to strongly on the inflamed gut walls, but certainly not pinch them)

  8. Magnetic pulling on Man Reports PillCam Stuck In His Gut For Over 12 Weeks · · Score: 4, Informative

    Of course, it could also be dangerous, but it might be worth talking to the doctor about. {...} Rare earth magnets that are SWALLOWED can do damage,

    The danger of swallowing rare earth magnets comes from the plural -s at the end of the word.

    If you swallow just one, nothing of significance happens, you'll eventually just shit it out.

    The risks rise dramatically if there's more than one magnet, specially if swallowed on separate instance (not stuck together as 1 block, but separately).
    They'll travel with a distance apart from each other along the 20feet of gut tract.
    If they come (from the outside perspective) close to each other, while they are in 2 distinct part of the gut (from the perspective of the length of the gut).
    (Say, each magnet is in a turn, and both turn happens to be close to each other. Basically think a long labyrinth and the magnets only having a couple of walls inbetween), then there's a high risk that the magnets will attract each other and get stuck.
    They'll be stick magnetically to each other, which might prevent from moving further along the gut.
    They'll also be very strongly pinching whatever (mostly gut wall of the different loops) is in between them, which could damage the tissue, and/or block the blood flow due to the pinching.
    These can lead to the the gut wall dying.

    Regarding the camera, as you say it might be an idea worth talking but could be dangerous.
    The poor guy isn't healthy, he has a gut disease (chronic inflammation).
    His gut doesn't behave like a simple 20feet long hose. But instead due to the inflammation, the gut's wall is partly damaged, and in some points is stuck together (that's the "strictures" he's talking about). The hypothesis is that the pill is stuck in one such stricture.
    Pulling it with magnets could potential help it go further along the gut.
    But pulling it with magnets could also pull the pill against damaged wall, burrowing it further into the walls, or risking to rupture a peculiarly damaged wall.

    For the double-balloon procedure, which end did they enter? If via the colon, I'll have to reference this in the future when BeuHD makes very silly posts a about solar-electric and such.

    Given that he mentions that the eosophagus would be the next entry to try, I think we can guess that the colon was the entry used in the first 2 attempts.

  9. Confusing authors of the quotes on Kaspersky Halts Europol Partnership After Controversial EU Parliament Vote (bleepingcomputer.com) · · Score: 1

    As Hitler famously said, if you repeat a lie loudly and frequently, then people will eventually believe it.

    That's funny, because Hitler never said those words.

    "[A]ll effective propaganda must be confined to a few bare essentials and those must be expressed as far as possible in stereotyped formulas. These slogans should be persistently repeated until the very last individual has come to grasp the idea that has been put forward." Mein Kampf

    Most people simply confuse who among the Nazis top heads uttered this idea.
    (Basically confusing the guy who wrote it in his book, and the guy who applied it systematically in all propaganda).

  10. Do you just use your overwhelming sense of superiority to shame the text into appearing?

    Cue in comment about IBM type M keyboard and prying it from someones' cold, dead hands.

  11. USB ; Bluetooth ; etc. on Windows 10 is Adding SwiftKey, Laying the Groundwork For Dual-Screen Tablets (cnet.com) · · Score: 1

    so - when you're faced with a tablet and no physical keyboard, how do you type ?

    By plugging in a physical keyboard.
    Either actually physically plugging on the USB-OTG port, or connecting over bluetooth.

    As a side note, the 4-part foldable (W-shaped) keyboard by Stowaway / ThinkOutside are great. Fit easily in a big pocket, once folded out has the size of a standard 88-key desktop. (As opposed to the current popular "cram everything in a tiny space, size the same as the screen tablet")
    I still have my bluetooth one from back in the PalmOS-era, works great with my current smartphone (Sailfish powered, so full blown GNU/Linux, but the keyboard also works nicely with Android)

    There's a company called Geyes that tried to resurrect the form factor (I've got their USB "GK108"), reportedly using the same molds (they even have empty compartement where the fold-out stand or where the PDA serial port giant edge connector used to be), but I find the build quality lacking a bit compared to the original.

  12. Cache side-channels on Another Day, Another Intel CPU Security Hole: Lazy State (zdnet.com) · · Score: 1

    Roughly yes.

    Except that: instead of comparing on X versus Y, you can make a giant array of Y with lots of pages, and for each possible value of b that you want to snoop on, you make sure to load a different page. (So if you want to distinguish between 16 values of b, and Y is stored in a region that is cached into 16k pages, you allocate 256k for the Y array).
    And then process 1 measures timing access to each chunk of array Y to see which one was already loaded into cache. (not necessarily on the same pass).
    See Google Project Zero's demo code for spectre 1 and metldown to see examples.

    Also, on branches, the scheduler doesn't take "both branches" it makes a bet based on how the jump looks like (loop tend to point backward and tend to be taken, if condition tend to jump forward and often aren't jumped) and based on prior knowledge (the spectre v2 tries to leverage the exact way this "prior knowledge" works to confuse the scheduler and have it jump speculatively were you want. That's the reason why Intel god exploited, but AMD doesn't have any concrete exploit in the wild : despite also doing indirect branch prediction too, it's much more complexe, and it's not clear whether there's a practical way to abuse this prediction).

    Lastly there's the whole "keeping the units busy" part of speculative / superscalar execution.
    The CPU might be busy executing some other stuff right now, and meanwhile you could have the math unit sitting idle.
    Intel CPU have extremely deep pipelines and looking an insane distance in the future.
    There might a few FP maths instruction waiting on the pipeline. So why not keep the FP math unit busy?
    the scheduler could speculatively have the FP maths start running, while keeping note that these instruction depend on the register XMM0 - which currently isn't expected to change, i.e.: the CPU doesn't think that it needs to wait another instruction that return a value inside XMM0 (eventually these speculative FP instructions triggers the loading into data cache of some parts of the Y array. Which depend on the content of XMM0).
    Much later, the scheduler : "Oh, shoot ! It turns out that we did actually overwrite the content of register XMM0 ! Let's quickly trough out of the windows any speculative execution that was tagged [this speculation depends on the content of XMM0]!"
    (Except not exactly everything is thrown out, the page of array Y is now sitting on the cached)

    Intel CPU are much more affected than the competition by having much deeper pipeline and more aggressive tendency to speculate. (But that makes nice numbers on benchmarks)
    That's why with Intel CPUs Google Project Zero code did work even without turning the JIT on : even if it take much more steps to interpret bytecode (compared to execute any actual instruction that was compiled by the JIT), the Intel CPUs speculate so much ahead that the spectre exploit will manage to run successfully.

    The above is also the reason behind Spectre v4 (accessing a bit of memory that should have been overwritten, but the CPU doesn't know yet: e.g.: because the instruction is "overwrite content of location [very long and complicated formula]" eventually the formula turns out to be "b", but by the time the CPU realises it, there's already some Y array page preloaded based on the older value of b).

    regarding kernel memory mapping : you don't need to map all the memory. As long as there are a few interesting bits of information in the kernel space to retrieve, meltdown is interesting enough. (On linux only the currently "active" memory is mapper, the rest of the address space is mapped to a magical pages that always return "0". The address space is usually split : e.g.: "negative" addresse (with the most significant bit = 1) are kernel. MSB=0 is userland of the current process)

    regarding the precise timing :
    You can somewhat compensate by repeating over and over again the attack and doing statistics.

    Regarding the crypto libraries :
    the worse part is that AES-NI hardware extension is very precise in which XMMn register holds what.
    So you know exactly which regtister to hammer in order to exfiltrate the key. Do it enough and you could statistically rebuild a good idea of the key.

  13. Rasbperry Pi! on Another Day, Another Intel CPU Security Hole: Lazy State (zdnet.com) · · Score: 2

    I wonder how well typical PC operating systems would work {...}

    Well lots of smartphones and nearly all single-board computers (including the Pi) use ARM core that don't do any speculative execution.
    (Only very few high-performance smartphones use ARM with speculative exec and thus potentially spectre-vulnerable)

    They are still not that bad at common browsing tasks.

  14. Shared register, indeed ! on Another Day, Another Intel CPU Security Hole: Lazy State (zdnet.com) · · Score: 4, Informative

    Floating point registers are used for encryption?

    This doesn't make any sense to me, unless they're actually shared registers.

    Exactly :
    the FP registers are shared with integer SIMD registers
    (FP87 and MMX are exactly the same register file under a different name, modern CPU tend to use AVX/SSE for their floating point computation and use the same registers also for interger SIMD, etc.)

    Basically (As cpercieval explained in his Twitter thread), the CPU will only always switch the content of its basic CPU registers (rax, rbx, etc.)
    Everything else (e.g.: SSE's xmm0, xmm1, etc) will only be switch when needed (though a non maskable interrupt). But just like with Meltdown Intel CPUs didn't give a fuck about memory protection, in this spectre vulnerability Intel CPU don't give a fuck about context switching and will happily speculatively execute and process old left-over data in these registers.

    The problems is that most efficient crypto implementation are likely to be implemented using MMX, SSE or AVX (including the AESNI hardware), thus critical data is likely to be hanging in these registers when a process that handle encryption is interrupted and multi-task-switched to the attacker's process.
    On any other CPU, if the attacker's process attempts to access of there registers, the process will immediately be interrupted, and the kernel will also switch the FP/MMX/SSE/AVX context (the process will only see it's own content of XMMn).
    On Intel hardware, the CPU will happily try to speculatively continue executing based on the old stale content of the XMMn register (which could be containing the data that the encrypting process was manipulating), enabling possibility to leak through the usual spectre's cache side-channel, until the NMI is served the correct context is loaded and the speculative attempt thrown away.

    Sounds stupid, but it enables Intel CPU to show a couple of % faster on benchmarks.
    e,g,; benchmarks that do encryption are less likely to be hit performance-wise by multi-tasking :
    in the case of switching an encryption process -> normal CPU process -> back to the encryption process, a normal CPU (like AMD) will lose time forcing a reload of the SSE/AVX context when returning to the encryption.
    An Intel CPU will happily continue immediately the encryption with the content of the XMMn registers, and speculative execution will eventually turn being right as the left-over data in the XMMn registers is the encryption's own content from right before getting interrupted by the CPU-only thread (which left it untouched).

  15. Different standard of disclosure on Another Day, Another Intel CPU Security Hole: Lazy State (zdnet.com) · · Score: 3, Insightful

    Where's the tablet-optimised website? This one's just a few tweets, it doesn't even have a logo! Where's the superbowl ad?

    In an era where every single vulnerabilities needs to get a catchy name and a well designed reactive website (almost a superbowl ad ?), even before confirming if there's a viable exploit, it's nice to see the big hats of security reacting (cpercival - the daddy of Scrypt) and taking time to write an actual exploit to test, even if communication is done over an unglamorous channel as twitter.

  16. Intel vs. the rest of the world on Another Day, Another Intel CPU Security Hole: Lazy State (zdnet.com) · · Score: 5, Informative

    I thought AMD and ARM cpus were also susceptible to exploits. Is that wrong?

    Indeed lots of different CPU manufacturer could be producing CPUs susceptible to spectre vulnerabilities.

    But not all CPU are created equal.

    There are some key differences :
      - not all CPUs actually do speculative execution. only a couple of ARM core actually do. The huge remaining amount doesn't and thus can't in any way be subjected to Spectre class vulnerabilities.

    (Even some of Intel's own core, like some older Atom, or like Xeon Phi GPGPUs don't do speculative execution)

    Intel has a different safety vs optimization threshold than most of others:

      - with most other CPU manufacturer, Spectre vulnerabilities boil down to "access memory region to which the process should already have had read access anyway" (see v1 and v4), thus it could be already addressed by safe practice (v1: don't put 3rd-provided JIT code and crucial information in the same process. e.g.: a browser's JIT engine running webpage's scripts and the password manager should not be in the same process) (v4: always clean up your stack before bailing out if it could contain cricital data, or better keep all the critical data in some specific mapped pages), etc.

      - Intel tends to push performance first to the detriment of anything else : some security test coming in too late.

    AMD and most ARM won't speculate past memory protection. If a memory region is blocked from access for the process (generally : kernel memory), AMD will check the memory protection and never attempt to access the restricted region to begin with. Whereas Intel CPUs will speculatively access the restricted region and only do the check much latter, by which point the usual Spectre's cache loading side-channel leakage could have happened.
    (There are few select ARM which are susceptible to Spectre v3a. Basically the same concept, but regarding system-reserved register - this being RISC architecture, with tons of registers)

    AMD and ARM will honor non-maskable interrupt. In today's vulnerability Intel tries to speculatively execute the point past which the system should contect switch the FPU registers (which includes stuff like SSE and AVX registers. i.e.: an attacker could be speculatively peeking into what another process did with these - SIMD operations with SSE/AVX are used in encryption/decryption, so an attacker could occasionnally spot what other process are decrypting/encrypting and whith which keys)

    So you end up with vulnerabilities v3 and today's which are Intel exclusive.

    Also Intel tends to be a tiny bit more aggressive and/or jumping through some shortcut and/or having way deeper pipeline and longer speculations, in order to shave a few cycles off :
    end results :
    v2 (Indirect Branch prediction) is currently successfully exploitable on Intel. Though in theory some AMD CPU could do speculative indirect branching, there are no current usable exploits in the wild.
    v1 actually works on Intel CPU without even activating the JIT - the speculation is so deep that an bytecode interpreter could speculatively access stuff
    v4 works much easier on Intel (deeper pipeline higher chance to manage to read something that wasn't erased from memory yet)
    etc.

    TL;DR: due to technical choices prioritizing performance, Intel CPU tend to be even more vulnerable.

  17. What part of "Distributed" are you missing on Bitcoin's Price Was Artificially Inflated Last Year, Researchers Say (nytimes.com) · · Score: 1

    A serious of transactions that needed to be kept off the books.

    Off the books ? Using a system with a distributed public ledger ? (which can by design be checked and controlled by all nodes of the network ?)
    Somebody hasn't been paying attention to *what* bitcoin protocole was designed for.
    The main point isn't off the books. It's pretty much the opposite : it ends up in everyone's book by design.
    The main point is that there isn't (in theory, though in practice some mining pools are becoming worrying) a single central authority.
    There's no "Bitcoin Inc." that you can sue to make transaction stop.

    In the drugs' case : even if you've been buying drugs, there's no bank that can be sued because they helped an illegal transaction and there's no way to freeze the transaction.
    (As a counter example, one of the first big push for crypto-currencies was when Visa and Mastercard companies decided to freeze donations to Wikileaks. This is the exact kind of thing which bitcoin protocol makes impossible because there's no single entity that could enforce such freeze. You would have to persuade the majority of the nodes on the network to refuse the transaction successfully)

  18. Implementation on The End of Video Coding? (medium.com) · · Score: 1

    Arithmetic coders are mathematically equivalent to range coders. Is it an encoding speed increase they were looking for? Or perhaps the ease with which you can modify range coder mid-stream compared to arithmetic?

    The key point is that MPEG's coders are binary coders. The code bit after bit.
    On hardware, that means a part of that needs to run at a very high frequency.
    Mean that you also need binarize (to convert the symbols into a bit stream) and manage contexts for all these individual bits.
    (CABAC = *Context adaptive* binary arithmetic coder).
    Implementations can rely on non-integers.

    Daala's entropy coder can work on any discrete list of symbols (not necessary 1 bit).
    In practice it works on value encoded in a few bits (e.g.: 4 bits number coding any symbol from a list of up to 16).
    This gives lower frequency of operations in hardware (you run it once to get you symbol out instead of 4x bit-by-bit), and makes managing the entropy probability prediction easier (just a singles list of probabilities of any of the 16 symbols coming up, instead of several bit context). It is also much easier to implement 100% using only integer math.

    So yeah, in theory arithmetic is just a subtype of range encoding.
    In practice, MPEG's CABAC is implement in a way that is more costly in hardware and performance than Daala's entropy encoder.

    (And if you squint at it, a tANS is a weird type of range encoder, excepted that you've flipped the bit over and work in reverse. And end up not with "slices" of varying size, but a series numbers that more or less likely to show up in the list. And except that you use a table instead of maths ops. So it's also a distant relative to range encoding)
    (And if you squint the other way, tANS looks like some weird cousin of Huffman, except that you use multiple table and "carry over" the non-integer part of the entropy. i.e.: a symbol that has 2.5 bits according to Shanon, will get always codec with 3 bits in Huffman (giving you an overhead of extra .5 bits), but will get coded in 2bits in tANS, with the extra .5 bits "carried over" into the next operation, which could then output 3bits, giving you the exact 2.5bit average predicted).
    (and tANS are implemented 100% with integer maths and RAM for the tables, but this relying on RAM is why AV-1 decided to use the range encoder for hardware implementation : cheaper on silicon).

  19. New vs old on The End of Video Coding? (medium.com) · · Score: 5, Insightful

    but it would be stupid to start adopting any of that into actual products or live usage until and unless it tops the more traditional methods in performance.

    The logic behind the article is that the new techniques will never top more traditional (or at least could not have a way to achieved in the current state of affair), because most of the resources (dev time, budget, etc.) are spent optimizing the "status-quo" codecs, and not enough is spent on the new comer.
    By the time something interesting comes up, the latest descendant of the "status-quo" would have been much more optimized.
    It doesn't matter that the PhD thesis "Using Fractal Wavelets in non-Euclidian spaces to compress video" shows some promising advantages over MPEG-5 : it will not get funded, because by then "MPEG-6 is out" and is even better just by minor tweaking every where.
    Thus new idea like a PhD thesis never get funded and explored further, and only further tweaking of what already exist gets funded.

    I personally don't agree.

    The most blatant argument is the list it self.
    With the exception of AV-1, the list is exclusively only the actual list of block based algorithm : MPEG-1 and it's evolutions (up to HEVC) and things that attempts to do something similar while avoiding the patents (the VPx serie by On2, Google).

    It completely ignores stuff like Dirac and Schroedinger :
    completely different approach to video compression (based on wavelets) that got funded, developed and are actually in production (by no less than the BBC).

    It completely ignores the background behind AV-1 and how it relates to Daala.

    AV-1 was designed from the ground up not as an incremental evolution (or patent circumvention) over HEVC, it was designed to go along a different direction (if nothing else, at least for the reason to avoid the patented techniques of MPEG, as avoiding patent madness was the main target behind AV-1 to begin with).
    It was done by AOMedia, where lots of group poured resources (including Netflix themselves).

    Yes, on one side of the AV-1 saga, you have entities like Google that donates their work on VP10 to serve as a basis - so were's again at the "I can't believe it's not MPEG(tm)!" clones.

    But among other code and techniques contributions (beside Cisco's Thor which I'm not considering for the purpose of my post), there's also Xiph who provided their work on Daala.
    There's some crazy stuff that Xiph has been doing there : stuff like replacing the usual "block"-based compression with slightly different "lapped blocks", more radical stuff like throwing away the whole idea of "coding residuals after prediction" and replacing it with what "Perceptual Vector Quantization", etc.
    Some of these weren't kept for the AV-1, but other crazies actually made it into the final product (the classic binary arithmetic coding used by the MPEG family was thrown away for integer range-encoding, though they didn't go as far as use the proposed alternative ANS - Asymmetrical Number System)

    Overall, incrementally improving on MPEG (MPEG 1 -> MPEG 2 -> MPEG 4 ASP -> MPEG 4 AVC/H264 -> MPEG 4 HEVC/H265) get hit hard by the law of diminishing returns. There's only so far that you can reach be incremental improvement.

    Time to get some new approaches.

    Even if AOMedia's AV-1 isn't that much revolutionnary, that's more out of practical considerations (we need a patent-free codec available as fast as possible, including available quickly in hardware, better end up selecting thing that are known to work well) than for not having tried new stuff.
    And even if some of the more out of the box experiment didn't end up in AV-1, they might end up in some future AV-2 (Xiph is keeping experimenting with Daala).

  20. They actually did. on The End of Video Coding? (medium.com) · · Score: 5, Informative

    The "hired very large codec dev team" they were contributing to is called "AOMedia - Alliance for Open Medi", and one of the potential rabbit hole that got considered and worked on was Daala by Xiph (tons of new crazy idea, including stuff like extending block as lapped blocks, a perceptual vector quantisation that doesn't rely on residual coding, etc.)

    At the end of the day, the first thing that currently came out of AOMedia, by combining work such as Xph's Daala, Google's VP10 and Cisco's Thor, is AV-1.
    It's much tamer that what it could have been, but still incorporate some interesting idea.
    (they didn't go all the way to using the ANS entropy coders suggested more recently by experiment such as Daala, but at least replaced the usual arithmetic encoder with Daala's range encoder).

    By the time AV-2 gets out, we should see some more interesting stuff.

    Probably this speech was meant as a rousing speech to encourage developers to go crazy and try new stuff.

  21. Just pointing stuff on American Tech Giants Are Making Life Tough For Startups (economist.com) · · Score: 1

    I'm Dutch and don't see a significant difference between the US and Europe. The US became more and more socialist from 1924 until Reagan. But Republicans love big government too.

    Most of Europe here around is paying education through taxes, making it accessible for free for anyone.
    On the other side of the Atlantic pond, US still pays universities mostly through horrendously high tuition, making it hard to get education, unless the parents are very rich (slowly evolving to an almost caste-system of 1%ers) or you get yourself in huge debt (hello almost indentured workers).

    Most of Europe here around has universally accessible health care (the CH being the oddball out), so that getting sick is just a matter to going to the hospital or the doctor.
    On the other side of the Atlantic, US only very recently started to have something approaching a health care system. Usually getting any serious sick is guaranteed to make one financially bankrupt.

    We have social welfare programs, to the point that it's not trivial to become homeless : in the US all it takes is financial problems to get you kicked out. In most European country, one need to have psychiatric problem preventing to be able to organize help, making mentally unable to go get social service involved, etc.

    Here around we actually have public transportation. In several country you can get around quite easily in every day life and as a tourist even if you don't have a driving permit. In the US, not having a driver license makes life nearly impossible except in couple of densely populated cities.
    We actually have laws regarding privacy (though there's strong pressure in several countries to erode them on the grounds of "security").
    In several countries we have very strong consumer rights association that make sure that we don't get horribly toxic shit packaged as "food" in the market.

    US is the only developed country that is falling back and losing point on several international metric of happiness/well-being/etc.

    Safety: Only people in the US seem to think that one needs to always be able to constantly carry around lethal force capable obliterate any random person, just to "feel safe" on the street. Most of European feel safe anyway, thank you very much, no need to have tons of dangerous weapons disseminated around.

    Nope. To me there's still quite significant differences.

    That's why I said "You seem to", so you don't want government to meddle with this stuff?

    No, I'm not interested in the government meddling.
    I only wanted to point differences.

    Parent posters says acquisition are good for the devs, because they get money.
    I'm just saying that acquisition aren't that good for users, as they get useful services shut down.

    No more, no less.
    Just contrasting stuff. That's it.

    With the negative side : users are usually on the losing side

    And I explained why you're wrong.

    You don't understand. I'm not advocating for anything.
    I'm just saying that acquisition leads to competing services getting shut down,
    and users are losing because services useful to them disapear.
    That's all.

    I'm not trying to get government involved, I'm not need you to point out while if government gets involved all hell breaks lose and the end of the world is coming.

    I understand why people want government.

    If you want my opinion of government : there are things that a free market won't magically solve by itself.
    Most people will tend to be driven by very short-term benefits (mostly profit), they won't be paying attention to longer-term problems, large scale problems require coordination of multiple parties, and problem requiring to take action that won't bring some immediate problem.
    A government is a form of organization that, despite all its short comings (potential for corruption, administrative bureaucracy, etc.) could still be

  22. (First thing first : Please try to get some professional help for your compulsive coprolalia or something. It really doesn't help to get your point accross when every other word in your sentences is calling everybody "idiots", "morons", etc. Structured argumentation is way much more efficient at that).

    Also, maybe you should take note that we both agree that trying to *force locking gamers* into a subscription-based system is a bad idea.
    (Basically, I'm on your side, just maybe not as extreme as you).

    To me it seems that your opinion is that the word "MMO" should be banned altogether, and every company making any online game should be forced to provide the server executable(1) together on the same media in the game box.

    My opinion is that providing the server has complicated logistics(1). But end-users should not be prevented from playing on 3rd party servers.
    They should have NO legal obstacles at all to do what they do on Minecraft. A lawsuite like Blizzard's against re-implementing old versions of WoW *should have no merit and be dismissed*.
    It's okay to pay for a box containing the game code and the assets (and a free initial "test" subscription to their paying server if marketing decides so).
    But now that you've paid the game and it's yours you should be able to do whatever the fuck you want to, and that *should include setting up your own server with friends* (even if the company doesn't give up the original server code, and you have to run some 3rd party simulation).

    Some people on some game should be able to decide that they actually want the paid servers because they thing the experience is stellar. (EVE Online is a prime example where most of the gamer *actively want* to be on these server. Because all the fun comes mostly from the political scheming between all the players present there. Networking effect at its top - see all social networks).

    But other games should be able to go to the their friends' 3rd party server (be it Quake(2), Minecraft, Ragnarok Online(3), or WoW).

    TL;DR: We both agree player should be able to play outside of the official companies paying subscription.
    We only disagree how these alternative server should be setup.
    You seem to want to make it mandatory for a company to ship their own official server code.
    I just want that a company shouldn't be able to prevent users to setup 3rd party server. Not necessarily with the official company's server code, they should be able to re-create their own server if so they wish(3).

    Also, Quake Live isn't "locked" in any way for the sheer reason of being open-source(2).

    --

    (1) - By the way, chances are that it isn't a Win32 .EXE file.
    Given the tendencies of the server world (where nowadays nearly everything runs Linux), at best it's an ELF executable (Valve has been reported to produce Linux executable a long time before starting their current trend of gaming on linux, mostly to run servers), but more likely it's a collection of servlets running all on some modern stuff like python (e.g.: EVE Online devs often explain their architecture).
    That makes it nearly impossible to run on your Windows gaming machine (though the introduction of WSL on Windows 10 has slightly reduced the level of impossibleness).
    And actually doing QA and support on the Linux servers and make sure it runs on any 3rd party server end-users want to throw at it instead of the highly customized server in the company's data center is extremely hard and costly. (though some recent development such as containerization should have reduced the level of hardness a bit).
    Some companies (like id, including Quake 3(2)) actually pulled the necessary effort to provide both local game AND server code, on both Windows AND Linux (and multiple other platforms). But that's rare.
    But its hard to justify the costs (id has always done it out of ideology, id's distributors and parent companies has always pushed against it not seeing any financial interest).

  23. *Sweeden* : not like most civilised countries on Sweden Tries To Halt Its March To Total Cashlessness (bloomberg.com) · · Score: 3, Informative

    Sweeden is one of the country where the nordic model of prostitution was developed (hence the "nordic" moniker).
    It's not completely legal as in some other European countries (DE, CH, NL, etc.)

    Although the prostitutes themselves aren't considered criminals, every one around them is (e.g.: Amnesty mentions land lord being harassed for "pimping" if one of their rentee happens to work in prostitution). As such in nordic countries, according to findings of Amnesty, prostitute tend to try to keep hidden, and they probably prefer anonymous transaction (so mainly cash). (I might suspect that any financial intermediate accepting to collaborate with prostitutes could be similarly harassed)

    But in other European countries (again, like Germany, Switzerland, Netherland, etc.) it's just a legitimate job like any other with everything that entails with it (taxation, social security and welfare, ...)
    Most sex workers should be easily able charge your debit/credit cards (there was a salon around making street advertisement that they've introduced even bitcoins. - Yes here around making ads for a sex salon is just as normal as advertisements for any other business, as long as the practical visuals aren't indecent).
    as long as they give you the necessary VAT-receipt slip.

  24. That's marketing bullshit son, if that wasn't the case private wow servers wouldn't exist. see below:

    https://news.ycombinator.com/i...

    Well that was the whole point my long pos (past the 2 lines of introduction you cited)t:
    - To make this "bullshit" (as you call it) explanation valid, efforts are needed to make 3rd party servers acceptable.
    But currenlty that not the case everywhere.
      - That *is* the case with Minecraft. (Pay a recurring subscription only if you want access to their servers. Pay the blob once and then play with your friends on your own personal server if you want isntead).
      - That is *definitely not* the case with Blizzard given their trigger-happy lawyer ready to shut down any attempt to third party servers.

    ^- We even used the same example (WoW, Blizzard) actually in our respective posts.

    So no the fact that you believe that corporate propaganda means you're stupid.

    Personally, I don't even pay attention to "corporate propaganda" : I don't even play MMOs. (Or any subscription-based game)
    I like to play point'n'click games which (since the fall of Sierra On-line and LucasArt) has completely exited the radar of corporation and is currently more an indie thing. (So mostly financed through crowd funding).

    you can have an mmo you own as a complete single player game with multiplayer server integrated.

    Please elaborated how you could "have an mmo " (given that these letter stand for respectively Massive, Multriplayer and Online) as a "complete single player game". It kind of contradicts the whole purpose of the genre.

    I fully understand and support the "own {... a ...} multiplayer server integrated" part, that's why I was saying that not preventing the gamers to play on a 3rd party server is just as important as allowing mods was in the last 90s.
    I should be able to have fun with my friends on just any MMO as I could on Minecraft, without fear of judicial action.

    I just don't understand the MMO being single player part.

    There's no difference other than people like you being stupid.

    Yup, I'm sure that calling random people on the internet "stupid" is the best solution ever to make your point understood.
    So much eloquence !
    Such persuasion !

  25. As expected after five years of work.

    They also took these five years to doctor the images to make the Earth look spherical !
    The liars, they want to hide the truth that Earth's flat!

    #WeNEverWentToTheMoon !

    #NASAisaHoax !!!

    ~~~~

    Okay, I admit, that one was a really low-hanging joke about "conspiracy theory" nuts.