I worked on a browser team when Spectre/Meltdown came out, and I can tell you that a big reason why Firefox and Chrome do such severe process isolation is exactly because these speculative attacks are almost impossible to entirely prevent. There were a number of other mitigations including hardening code emitted from C++ compilers and JS JITs, as well as attempts to limit high precision timers, but the browser vendors largely agreed that the only strong defense was complete process isolation.
I'm not surprised to see this come back to bite them if after like 7 years Apple still hasn't adopted the only strong defense.
Strongly disagree. 45 days to allow the authors to fix a bug that has been present for over a decade is not really much added risk for users. In this case, 45 days is about 1% additional time for the bug to be around. Maybe someone was exploiting it, but this extra time risk is a drop in the bucket, whereas releasing the bug immediately puts all users at high risk until a patch can be developed/released, and users update their software.
Maybe immediate disclosure would cause a few users to change their behavior, but no one is tracking security disclosures on all the software they use and changing their behavior based on them.
The caveat here is in case you have evidence of active exploitation, then immediate disclosure makes sense.
I'm sure this isn't something at the exec level, but it seems possible someone somewhere in middle management who oversaw used van sales wanted to increase their revenue numbers and thought cheating the odometer would be an easy way to boost their numbers.
Why should reddit have to freely support a third-party client that doesn't provide revenue for them?
The only reason is that the status quo is they have in the past freely supported these use cases, but it doesn't seem that unreasonable for commercial use API access to cost money.
I totally agree. The Chinese Room and, in general, philosophical arguments about the limits of AI always seem to come down to the belief of human exceptionalism.
>If enough of us do this with personal websites, more and more people will stop using Chrome and start using Firefox. You don't even have to cut Chrome users off from the content -- just annoy them a little, and suggest Firefox.
It's a nice idea, but your personal website doesn't matter. Most people go to a Google website at least a few times a day, and they already tell you to switch to Chrome for the best experience. And almost all of the top non-Google websites also have a vested interest in less adblockers, so none are going to riot over this.
The point is that it is much more land efficient for us to directly eat plants than to route the plants through animals first. Cattle use 99% of the calories we feed them for their own functioning. Only 1% actually make it into the meat that we eat.
I wasn't proposing any specific solution, just stating that eating animals does in fact contribute more CO2 than eating plants. And I have no problem with carbon taxes, in fact I'm in favor. A carbon tax could certainly cover this case if it taxes the CO2 that animals emit.
Beef is an extremely carbon inefficient source of calories. They require a large amount of land, either directly or indirectly (e.g. from corn fields). Pastures and farmland are not effective carbon sinks. Most land used by cattle was earlier forestland or other land that served as a carbon sink. For example, one of the major causes of rainforest destruction in Brazil is cattle ranching.
The compiler absolutely can implement tail calls, I don't know why this keeps getting thrown around. Adding a high-level directive in the spec doesn't enable the compiler to do anything, it just enforces it. The only thing preventing it is browser vendors wanting the .stack property to stay well behaved, but that isn't required by the spec and certainly isn't relevant for non-browser targets.
Even if we did somehow get the political will to fund a project of this magnitude, it could never work. The bubbles would get blamed for every single snowstorm, unseasonably cold day, and any other weather that happened after it was put in place.
I don't think it would last a year before it was taken down, regardless of whether or not it did what it was supposed to do or was responsible for any meteorological event.
Wasm has the same security risk as executing JavaScript in your browser, except with less risk of XSS type security issues because wasm modules are better encapsulated.
If the adversarial image is intended to cause car accidents or bodily harm in some way, then the people printing the t-shirts and the people wearing them are already breaking the law.
And if they actually do hurt someone, I imagine they would be criminally liable.
That's like saying it's not the painter generating any Art, the gallery curating the art through their lens of critical artistic appreciation is the Art.
IR is usually represented as a sort of linked list of instructions where you can easily move around instructions, add/remove them, and replace higher level instructions with lower level instructions as you go through compiler passes. At the end, the IR is a linked list of machine instructions, which gets written out to a code buffer as the last step.
Bytecode is usually a buffer of high level instructions that is compact and fast to read (for the machine). Good for interpreting and holding the semantics of a program in a format that is more efficient than the source code, but it is usually not a good format for running compiler passes.
As someone who used to maintain a large C++ codebase, people usually bug-dump static analysis results rather than actually submitting fixes, but blindly "fixing" code that a static analysis tool claims to have issue with is not surprising to see either.
If the patches were accepted, the person could have used those fixes to justify the benefits of the static analysis tool they wrote.
I'm not surprised to see this come back to bite them if after like 7 years Apple still hasn't adopted the only strong defense.