Matrix makes quite a fine IRC bridge though. Better mobile support, lets you see a list of when you were pinged, and image hosting. These days it has almost every feature I need to switch from telegram but the client is still too awkward to use.

and I’m still to see any real alternatives really take off

Slack. ;)

Sure - you’re welcome to refuse the EULA and take your processor back to the retailer, claiming it is faulty. When they refuse, file a claim in court.

Freedom!

I don’t really think that you should be allowed to ask the users the sign a new EULA for security patches.

A variation of this argument goes that security issues should be backported or patched without also including new features. It is not a new or resolved issue.

Patches only count if they come with the same EULA as the original hardware/software/product.

What is different here is that this microcode update also requires operating system patches and possibly firmware updates. Further not everyone considers the performance trade-off worth it: there are a class of users for whom this is not a security issue. Aggravating matters, there are OEMs that must be involved in order to patch or explicitly fail to patch this issue. Intel had to coordinate all of this, under embargo.

I think you have to be presented with the EULA before purchase for it to be valid anyway

Thanks for your questions. A: “the signal generation system is not linked to your order system.” R: I use a database table to register the signals

A: “How do you sort or filter your signals in to orders, particularly when the signals conflict?” R: I’m only using a signal generation table per asset to avoid conflicts between signals

A: “Where in this model are your actual positions stored an reconciled to the signals produced by your model?” R: The orders executed and opened come through the Websocket and are stored in tables on the database. The order execution service has the logic to reconcile it with the signals within a set of hardcoded boundaries

I accept any tips, =)

In a perfect world, yes.

But since these vulnerabilities allow memory reads from other threads (including kernel threads) running on the other hyperthread of a core, it means that this escalates a code execution vulnerability (even in a limited, sandboxed environment) to kernel (or just other userspace process) memory reads, which could be a springboard in a more serious exploit chain.

SMT can still be safely used in some scenarios, like multiple threads of the same process if no isolation exists between those threads anyway, or when executing multithreaded code in the same sandbox, perhaps.

It is demonstrably true that there are workloads that benefit from Hyperthreading. I agree that we also see a subset of these use cases where the performance trade-off from disabling this feature is being contrasted with a security issue that is not directly exploitable.

I think the OpenBSD team, and others, have made a compelling case for not only preventing directly exploitable security issues but also that proactively fixing security issues can prevent exploits that require a chain or series of exploits, information leaks, or crashes.

While you can construct scenarios where this single exploit doesn’t apply, being vulnerable to it means that it can be composed or combined with other vulnerabilities where it may turn out to be necessary even when it’s not sufficient to successfully attack.

Basically, in light of these vulnerabilities, SMT is a risk whenever the system might be running untrusted code. The reality of today’s computing environment is that you’re almost always running unprivileged but untrusted code to some degree or another. Web browsers and multi-tenant VMs are the most obvious examples. The systems in the world which run only “trusted” code are few and far between. Some examples that I can think of are:

• HPC/research clusters with specialized applications in which nearly all code is written in-house
• Certain Enterprise appliances like storage servers that don’t allow running non-vendor-provided code
• Small general-purpose systems with all of their hardware dedicated to one specific task, like my backup server at home

And even these aren’t necessarily 100% safe because there might be a remote exploit of some kind that then allows an attacker to run some unprivileged code which can then abuse SMT for privilege elevation and then you have a rooted appliance. In which case, the only truly secure box with SMT enabled is an air-gapped one.

The only good news here is that these kinds of exploits seems to be quite difficult to actually pull off but as The Bearded One says, attackers only get better over time and attacks only get easier.

primarily solo, but cross functional with dev teams, and mgmt.

I prefixed the path component of the submission URI with “blog/”.

Here is an archived email on the matter, from 1993. University of Minnesota Gopher software licensing policy:

First, in the case of gopher servers run by higher education or non-profit organizations offering information freely accessible to the Internet, there is no change. No fees. They just continue to use Gopher like they have always done. If you fall under this category, please stop and think about it. Nothing’s changed.

In the case where gopher servers are being used internally by commercial entities we think a license fee is right. We don’t know what amount of a fee is reasonable: so YOU have to tell us and we need to negotiate on a case by case basis. What is loose change for a large corporation may be prohibitive for a small business. We’d like some kind of sliding scale.

The paragraph just above these two did not age well:

Remember when UNIX was given away free? How many of you are using UNIX now? It is licensed.

Here the ‘new’ license text: https://01.org/mcu-path-license-2018

Here the license text prior to the 2018-08 microcode drop: https://tracker.debian.org/media/packages/i/intel-microcode/copyright-3.20180703.2

They’re identical.

Do you have any experience with Pelican? Will you tell us about it?

From your link:

Intel has been made aware of the issue and pestered by just about everyone, and should get it straightened up soon.

This issue circulated through a Slack channel I’m on last week and we had the presence of mind to at least collectively ask Red Hat to bring the issue up with Intel for us. Nevertheless I consider “pestered by just about everyone” to be an accurate description.

This license forbids systems integrators from publishing benchmarks related to this microcode. Presumably because Intel reserves that right to themselves. If you are not a systems integrator it doesn’t apply to you. If you are a systems integrator not only can you benchmark, clause 4 makes it clear you are under no obligation to share those results, even with Intel.

This license, whether on purpose or accident (see my other comment in this thread for elaboration), is granted to and focuses on OEMs :

1. PURPOSE. You seek to obtain, and Intel desires to provide You, under the terms of this Agreement, Software solely for Your efforts to develop and distribute products integrating Intel hardware and Intel software. […]

If you are a systems integrator, there is more than this license agreement binding you and Intel together. If you are not a systems integrator, this license isn’t about you, making the bolded assertion in the article false by being too broad:

Intel has now attempted to gag anyone who would collect information for reporting about those penalties, through a restriction in their license.

Intel made either a mistake or policy change related to their systems integrators. We will all get our benchmarks.

If you’re going to name a company asking people to avoid them you have to make a case as to why. Otherwise you’re naming and shaming. Unless you can show your complaint has merit it’s equally likely that the fate we’re trying to avoid is working with you, not your customer.

Asking for names without additional, event substantial detail about this conflict is incitement to mudslinging. If you want to avoid this “same fate” we need to better understand what it is.

Would you share your experience of “litigating the hell out of them” with the rest of us? I don’t understand how you have enough information to make that decision here, and would be helped if I understood any prior experience you had that informs your statement.

what does the lobste.rs community have to lose by opening itself to some political discussion?

see

this is an intelligent, considerate and engaged community

Tag usage

First, a note on tags: every tag we add is an explicit endorsement that that sort of content is acceptable and encouraged on the site–the omission of a tag is a hint that maybe that content would be better served elsewhere.

If we were to include a politics tag, we’d in effect be saying “Okay, the distribution of topics appropriate for Lobsters now includes politics. This is valid to bring up in all conversations, because at worst it’s merely mislabeled and mistagged.” So, we’re then stuck with more politics in everyday use in the site.

Availability elsewhere

Simply put, politics are better covered elsewhere:

• Daily Kos
• Breitbart
• Jacobin
• Reason
• Hacker News
• 4chan /news/ and 4chan /pol/
• NPR news
• Infowars
• Christian Science Monitor

It’s not like our fellow crustaceans can’t find something to slate their thirst for politics elsewhere–not only that, but they have dozens if not hundreds of sites to choose from to match their political requirements.

By contrast, Lobsters itself is a rare gem (if I may say so myself) in that it is relatively pure technical discussion, a refuge from a world of blathering bullshit and ponderous pandering.

Politics is the boardkiller

I’ve explored elsewhere how political submissions can be used to farm karma at the expense of discussion. The key things to note about political articles:

• They rarely have any technical content, as the point of politics is not education but subjugation
• They tend to cover topics that everybody has opinions about but few have expertise in
• They usually talk about things over which none of the discussion participants actually have any control, so you get a lot of yelling back and forth without any action
• There is a gigantic industry devoted to crafting the most divisive articles possible

We probably share this board with a few tankies. We probably share this board with a few Nazis. We have folks here that don’t recognize a standard arrangement of genders or possibly even human identities. We have folks that are from the US, from the UK, from the rest of the world. We even have a few Windows users.

And we all get along (mostly) because we aren’t constantly pitted against each other in pointless tribal ideological posturing and signaling. We all get to respect each other as practitioners of technology instead of representatives of some other out-group.

Why would we want to risk sacrificing that?

EDIT:

I’ll point out that 4chan has created at least 2 containment boards for politics (the equivalent of your proposed tag), and not only has that failed it’s only fostered some of the most corrosive drivel on the internet.

Perhaps this is a reasonable place to open a discussion about why lobste.rs doesn’t have a politics tag.

It’s not. We have the meta tag and chat for meta discussions.

Perhaps this is a reasonable place to open a discussion about why lobste.rs doesn’t have a politics tag.

We don’t have a politics tag, in part and sufficiently, because the topic is too broad for a contributor to have a meaningful understanding of the topics and discussion that would fall under it. For folk that can make meaningful, informed, truthful, and constructive contributions in an on-topic matter, there is the law tag.

We’re a community of practitioners. The practice of politics is law. Practitioners of law, whether legislators, lawyers, judges, or any of the various roles in courts and the extant legal system are welcome here. Along with the technical discussions these practitioners engage in.

However the reason I think it’s important to bring political discourse into this space is because you…

This is called entryism: “…an organisation or state encourages its members or supporters to join another, usually larger, organisation in an attempt to expand influence and expand their ideas and program.”

Here you providing a totalizing reason (“All Your Relationships”) as to why a new tag should be added. Tags are deflationary, not inflationary. They identify areas where a subset of our readers and contributors can expect detailed, operational, consistent, and where possible even scientific discourse. And that further they can measure their own understanding of the topic because it has clear and defined boundaries.

Politics is off-topic here because it lacks parsimony. In order to create space for technical topics we do not discriminate on the basis of people, groups, or fields of endeavor. Folk are here to talk about and work on their own and their field’s issues in sufficient technical detail to coordinate with their peers. Ideology, politics, propaganda, framing, and other fictionalisms are an impediment to dealing with the technical and material nature of our work and world.

The chattering class has plenty of places on the Internet to proselytize. This isn’t one of them.

“Perhaps this is a reasonable place to open a discussion about why lobste.rs doesn’t have a politics tag.”

We did. The were a large number of people in support of or against politics or tags. No clear winner. Further, most that support it want to be able to talk about it on any article to push their political views. Of them, some want many views to be discussed as part of the political process and others want all opponents censored and/or ejected. For different reasons, both need political comments available on every thread. There’s some others but that’s the major groups based on what they said or did.

Im in the group that’s for banning most politics or limiting it to politically-focused threads tagged as such. Like I said, the prior discussions got nowhere for my side. So, I discourage even talking about it to avoid polluting more threads. We can just do a yearly meta or something to assess if the community’s preferences have changed. That’s assuming @pushcx would go with the popular vote to begin with. His own convictions might lead him to do something different.

Who knows except to say we’re better off not talking about banning politics or a new tag more than once a year since it’s wasted bandwidth that also often causes headaches for our moderators when fights break out.

[Comment removed by author]