Announcing your plans makes you less motivated to accomplish them (2009) - <AUTHOR> https://sivers.org/zipit <comment><USER2> I call them "Secret Plans". You gotta save up the emotional energy and reward. On so many projects, you get the same neuro-chemical reward by talking about your project plans and how cool the result will be, as you do by making progress. By holding out, and only allowing progress itself to be a reward, and not just the talking, I usually get much further. The project may still die, but then I have something in my hands usually, and that's more rewarding than a bunch of people who think I only talk about things and never start/do any of them. . .

<comment><USER3> This is why I refuse to do stand ups

<comment><USER4> Engineering manager here. I think a lot of people miss the point of standup, or abuse it to somehow micromanage engineers.

Standup is for the team, not the manager or PM. It serves multiple functions, but the most important is the last bit: "are you blocked by something?". Most of the time, someone else on the team knows how to unblock you. Other times, your manager is better positioned to get you what you need than you are. Most of us don't care when you work, or how much progress you made today, or whatever. Our job is to keep the ball rolling, not manage your time.

The status update portion exists so that your manager doesn't randomize you in the middle of the day asking about that thing you're working on. Not because s/he thinks you're slacking, but because your work ties into a bunch of other work that's going on, and it's the manager's job to coordinate. While _you_ may be more effective working as an information silo, your team and org are hindered by it.

<comment><USER5> IME standups are not even effective in unblocking most people.

Why would someone want to admit they're blocked by something in front of everyone? Someone else will inevitably proclaim that they have the solution, however simple it may be, and make the asker look stupid while elevating themselves.

Most people know who to ask to be unblocked or can ask their manager.

1:1s are the time to sync with regards to status on projects not in the middle of the day.

Weekly roundtable meetings are the time to sync up with the rest of the team and learn what everyone is working on.

The only purpose of standups is to slavedrive people into "productivity", which inevitably ends up with them thinking of how to hyperbolize whatever they're working on minutes before standup begins. Its useless.

<comment><USER6> I really hope you aren't using 1:1s as status meetings, that's the worst possible use of your time[1].

As a developer I've found stand-ups to be useful to know what's going on within the team and if feature A with collide with feature B.

[1] [https://randsinrepose.com/archives/the-update-the-vent- and-t...](https://randsinrepose.com/archives/the-update-the-vent-and-the- disaster/)

<comment><USER5> I disagree with your reading of the article. It does not say that providing status updates in 1:1s are the "worst possible use of time" anywhere.

Quoted from the article: "The point of this discussion is not to solve my Disaster, the point is that we're going to have a conversation where one of us is going to learn something more than just project status."

Status updates are a conducive part of 1:1s and its the perfect time to get unblocked as the quote above duly points out.

As for learning about whether "feature A will collide with feature B", weekly/biweekly roundtables are the perfect time to learn about such things. The weekly cadence allows people to find time to collaborate on the possible overlap.

Lastly, I don't think the article is even that good. It seems to make up for its lack of interesting-ness by feigning conviction and edginess. The central point of the article is highly unusual in that it lauds novelty over pragmatism.

A 1:1 should be an environment where all of what the article talks about CAN take place. But that doesn't mean it SHOULD during every meeting.

</comment></comment></comment></comment></comment></comment><comment><USER7> Reminds me of a quote from Sara Blakely:

"I was very careful right away, it was a gut instinct that I had, to keep it to myself because I believe ideas are most vulnerable in their infancy, and it's instinct to turn to your right or left in that moment and tell a friend, or tell your husband, and the moment you do that ego is invited into the mix, and then you end up spending all your time defending it, explaining it, and not pursuing it"

How I Built This podcast (9m20s)

<comment><USER8> I have definitely had my battles with people who want to poke holes in my plans, rather than support me. They _think_ they're helping me, but they aren't. They're just killing my enthusiasm.

If I'd been left to try, I'd have worked hard at it, had an experienced, learned some things, and maybe even accomplished it. Instead, they did their best to stop me.

I now snap at people who do this to me. I no longer let them throw problem after problem at me, and instead shut them down before they can destroy my dream.

I accomplish a great many of the things I try, and I get exercise and knowledge from the failures.

<comment><USER9> That's too bad. I invite criticism of my projects, because I want to make sure I'm not fooling myself. Other people's perspective can shine new light on a problem and force you to reconsider the idea, hopefully leading to improved design.

<comment><USER10> It's very delicate because from personal experience most projects are likely to fail, and most projects start way over ambitious (almost a natural bias). What takes lots of experience to learn is also that _that 's not necessarily a problem_. It's ok to fail sometimes, and it's ok to be overambitious at the beginning and scale back to achievability, most of the time.

Initial ambitions largely set an upper bound on whole project possibilities -- you generally want upper bounds set pretty high. All projects have unknown unknowns that will reveal themselves, and modeling this kind of meta-knowledge is difficult and perhaps not worth the effort.

So to offer a general counterpoint, it may be a valuable skill to listen to constructive advice including ones poking holes in your ideas. The key is to persevere in the face of problems, as long as they're not obviously intransposable (tip: don't go against laws of physics, e.g. thermodynamics or newton's laws). If those hurdles would come up sometime, it might be better to devote more time early on to overcome them.

</comment></comment></comment></comment><comment><USER11> This very much depends on how motivated you are by external validation. For some people, the fear of losing social capital by not following through on a public commitment is motivating enough to accomplish stretch goals.

Source: used this technique to overcome my own procrastination trying to launch my first app as a solo founder. It worked, and I went on to raised a million VC to see if I could scale up the vision of a social goals app.

The downside of relying on external validation, as I learned the hard way, is when your self improvement startup goes down in flames, you _really_ feel like a fuckup.

<comment><USER12> I announce my projects so people can tell me how stupid I am and it makes me more determined to succeed and show them how they are actually the ones who are stupid. I guess I'm petty like that.

<comment><USER11> I feel that. One could argue that _all_ ambitious entrepreneur types are motivated at least partly by a burning desire to prove that the other guy or "the system" is in fact the asshole.

<comment><USER13> I don't agree. True ambition is very self centered, almost egotistic. The detractors never have as much invested as you and are largely irrelevant. You don't do it because they say you can't, you do it because they don't even exist.

</comment></comment></comment></comment><comment><USER14> This article treats all types of announcements as being equal. Not so!

A hazy announcement like "I'll be doing more to fight climate change" may indeed be empty virtue signaling that leads to nothing.

But what about a more precise announcement like: "I'll be writing a book on Topic X, which I plan to publish 15 months from now, and I'll be completing one chapter on the 25th of every month until then"? Now we've got intermediate deadlines, and deliverables, and at least the first stirrings of a coherent plan.

Announcements can work quite well, as long as you're willing to commit with enough clarity that your friends and rivals will keep you honest.

<comment><USER15> _> "I'll be writing a book on Topic X, which I plan to publish 15 months from now, and I'll be completing one chapter on the 25th of every month until then"? _

I did something similar when I began my first book. It accomplished nothing. I ended up stalling for several years.

What helped was a _private_ commitment to myself to work on the book every day. It's definitely important to have a plan, but that's orthogonal to _sharing_ a plan.

 _> your friends and rivals will keep you honest._

This depends on your friends, but I think at least in the US, most friendships are based on uncritical support. They aren't likely to cause friction by calling you on things you previously committed to doing unless that commitment actually affects them personally.

Maybe _that 's_ the way to use your social network to keep you honest. Make a commitment like: "If I finish this project by date X, I will contribute $YYYY to your favorite charity." Now your friend has some skin in the game.

<comment><USER16> Not the least reason is that you've constrained yourself to Topic X due to your own announcement.

</comment></comment></comment><comment><USER17> I call this "letting all the steam go to the whistle instead of the wheels"

</comment><comment><USER18> I sometimes wonder if a similar mechanism might be at play when you imagine accomplishing your goal in a Walter Mitty sort of way.

There are many projects which I can envision completing, and which I know I have the technical skills for. But I gain a certain amount of satisfaction just from picturing the completed work, and in the end I don't actually put in the effort to make it reality.

<comment><USER19> I suffer from the same affliction. Daydreaming forward often reveals additional functionalities and synergies and implications, so it even "feels" like progress, but I've learned the hard way that skipping to the last page of the book is counter-productive.

</comment></comment><comment><USER20> I find this has cut both ways in my life. In piano, it was always my goal to play Chopin Ballade No 1. After ~5 years of playing, I heard it and KNEW I wanted to learn it. It was only around ~15 years in, when I got the gumption and a teacher who didn't put the idea down, I signed up for a concert to play it, and I was FORCED to learn it. At that point, announcing to friends/family enhanced my practice, because I knew it'd occur on X date and I knew the beastly passages would require dozens of hours of repetition each.

On the other hand, the number of pieces I have stated my intention to learn, and never done so, is far greater than the number of pieces I actually know. I think it's just so easy to say "I love this piece, I'm going to learn it." Well, that took 5 seconds to say, but it will take 100 hours to learn the piece.

So, for me, it comes down to how truly/deeply motivated I am to begin with. If it's something I truly want, announcing makes no difference. If it's something I'm lukewarm on, I'm probably likely to announce something impulsively and commit myself to something I didn't think through.

</comment><comment><USER21> This is (mostly) wrong. Sivers himself seems to have regretted how his talk was interpreted and posted this semi-retraction: [https://sivers.org/zipit2](https://sivers.org/zipit2)

But identity-based goal or not, the conclusion that you make yourself less likely to achieve a goal by telling people about it defies common sense. I mean, here's the peer-reviewed science saying my common sense is wrong -- [http://www.psych.nyu.edu/gollwitzer/09_Gollwitzer_Sheeran_Se...](http://www.psych.nyu.edu/gollwitzer/09_Gollwitzer_Sheeran_Seifert_Michalski_When_Intentions_.pdf) \-- but this is a psychology paper from 2009 so I'm willing to bet real money on common sense, despite seeing no obvious flaw with the paper.

<comment><USER22> Not generalizing, but for me personally, I'll often tell people about my plans as a way to hold myself to them. If I keep it to myself, it's easy for me to talk myself out of it, but once it's out there to other people and I know they're going to ask me for followup, I can commit.

<comment><USER23> I always think this way, but once I make a commitment, now I basically have a deadline, which for me, causes the procrastination impulse to kick in, and it takes effort to fight it.

I think that telling someone I'm going to do something makes me want to do it a little bit less because now I'm doing it for them, not for myself.

<comment><USER22> Yeah, I think it's definitely something that will vary by personality. I'm somewhat of a people pleaser so the external motivation works well for me.

</comment></comment></comment></comment><comment><USER24> I watched a TED talk about this years ago and recognized myself and my habits. I've since stopped announcing plans until I have a certain amount of concrete progress. Sometimes I still misjudge, and lose motivation. For me this applies for both small and big things.

Eg say I make plans to go to the gym tomorrow. If I tell someone I'm going to go to the gym, I am less likely to actually do it. If I keep my mouth shut I'll probably follow through. I currently have an idea of something I'd like to do. It will take a lot of physical and emotional work. I've tried to make plans before and discussed them with some friends, and always after the discussions it never ends up happening. This time I'm not telling anyone until the plan is actually in motion.

<comment><USER25> I'm interested in seeing that talk, if you can remember who it was. Or have a link.

I had thought the opposite was true. Announcing was supposed to be like committing. Curious if it just became a form of virtue signaling.

<comment><USER26> I'm not the person you replied to, but...

Could it be Derek Sivers' TED Talk "Keep your goals to yourself"?

[https://www.youtube.com/watch?v=NHopJHSlVo4](https://www.youtube.com/watch?v=NHopJHSlVo4)

<comment><USER27> I haven't watched this (I'm on a bus, bandwidth concerns) but the title just made me think: "yes, keep your goals to myself. In a diary. That way I won't be demotivated by premature announcement, yet I'll be bursting to have something to show when I make progress"

Promissing to ones self, for me at least, is a motivator because I trust myself more, and the trust is reinforced as I complete goals. But announcing "I'm doing this thing" either causes anxiety, or demotivates nectar is already our there, as the article describes.

</comment></comment></comment></comment><comment><USER28> I'm exactly opposite of that. If I announce plans, that adds an additional cost (embarrassment) to failing to accomplish them, which makes it less likely that I'll procrastinate or abandon the effort.

<comment><USER29> This only works if people are excited for what you are making.

I once worked on an ambitious game for months, and then decided to make an announcement about what I was building. The reaction from most people was meh. I stopped working on it about a month later and all remaining copies of it have since been deleted by now. Never released.

<comment><USER28> > This only works if people are excited for what you are making.

I suppose I should have been more specific. I'm not talking about a public announcement, I'm talking about announcing it to my personal friends and colleagues. Whether or not they are excited by the project itself isn't really a factor -- they'll still want to know how the project is going.

I tend not to make any public announcements until at least beta.

</comment></comment></comment><comment><USER30> I really hate this article. Pretty much everything I've ever accomplished in my life is because I speak it into existence and hold myself accountable. But then again, if you're the type of person who makes things happen, you don't rely on crappy psychology studies to tell you how to live your life.

<comment><USER8> I've seen a lot of these "successful people do this thing!" stories, but after years of reading them and watching how people act, I've come to the conclusion that those people are successful by nature first, and all these things they do are helpers, not enablers. Doing that thing won't turn people into successes.

These things are crutches that successful people use to improve themselves, not something that they learned in order to be successful. They'd be successful either way, this is just easier.

</comment></comment><comment><USER31> Note the followup link he posts at the end: [https://www.bassam.com/single- post/CSI-TED-Talks-What-Derek-...](https://www.bassam.com/single-post/CSI-TED- Talks-What-Derek-Sivers-Was-Really-Saying)

Where it comes out in support of stating goals in some circumstances, and clarifies that what it's really against is saying things like "I want to be a lawyer", because then what that means is that you'll be apt to behave consistently with _wanting_ to be a lawyer, and not with taking the steps to actually become a lawyer. (Or how my yoga-instructor friend explained it, "So then the universe responds, 'ok, poof! You now want to be a lawyer!'")

<comment><USER32> Precisely.

You don't "want" to stick to a vegan diet. You have a vegan diet.

The distinction is roughly, between a goal, and a plan.

A plan is something that you can immediately begin executing upon. That doesn't mean you won't falter, or that it has to be an on/off switch style revolution, but there's a clear set of things to do.

A goal is embryonic. You don't know how, or if, you can achieve it yet.

<comment><USER33> I am skeptical. Human desires are a thing, and I am going to continue to assume that there is a good reason they are a thing until I have a very detailed and very well tested explanation for why there is no harm in replacing all of my desires with plans.

<comment><USER27> I think I understand you. At a lower level, there is a very good reason why, during our teenage years, we develop our prefrontal cortex to moderate between our desires and our actions (and why for all of us, going from childlike "I see, I want, I do" to adult "I see, I want, I plan, I evaluate, I might do") is so traumatic.

That, or you've made a subtle joke which I'm not quite seeing :-)

</comment></comment></comment></comment><comment><USER34> Caveat for team and organizations: often leadership announces grand initiatives with great fanfare and the lack of follow-up, perceived or real makes people cynical.

Unfortunately, you cannot avoid announcing your plans if you expect others to follow you - its possible people don't understand what you want to achieve and end up just as frustrated. This is part of a leaders job.

I like what TA said about "make sure not to say it as a satisfaction but as dissatisfaction"\- definitely keeping the focus on what you want to fix is better than the specific solution you've devised - you might end up finding a better solution anyway and people will help you do it.

Make announcements on small sub-plans often and follow-up even more often, so that people know feel that whatever you want to implement in your team/organization is happening. Definitely tell them a long-term goal, but keep the focus on the next task that needs to be done. And make the "small" announcements at the moment you feel you are ready to answer all questions the team might ask you, but not earlier.

So, to be effective in an organization you need to do "continuous announcing" of small plans.

<comment><USER16> The rule for big corporations is that you must announce your plans and make them as grand as possible to build your budget/empire. This is necessary to prevent a takeover from one of the other many groups doing the exact same thing within the company.

</comment></comment><comment><USER35> I don't share ideas with many people anymore. Even ideas, and especially not goals. Any negative people are out, which unfortunately is too many.

The few that are trusted and have an analytical mindset are helpful for sound boarding, even if you don't exactly get them to immediately quit their jobs and join you at _exciting-new-startup-here.tld_.

Finally, I try to spend more time in general with those directly contributing to achieve my goals, usually in the activity itself (e.g. work, training, study). Work can be harder to navigate because, well, I'm not responsible for firing ;-) but it is possible to at least move the needle.

</comment><comment><USER36> That has the exact opposite effect on me. I actually use that method to shame myself into accomplishing what I've announced...

<comment><USER37> That's gernerally true for polster-types who brag around with what they have done wjile others see their contribution rather miniscule.

I know this could be understood insulting, still my observation though.

<comment><USER36> That's only if you're talking about major accomplishments, like "I'm gonna make Director by 2021". Ya that's bullshit and bragging. I'm referring to things like saying "Guys i'm gonna not drink for a month" or "I'm gonna finish that damn car repair this summer".

</comment></comment></comment><comment><USER38> The article linked is not the one of the actual study. Here is the actual study: [https://s18798.pcdn.co/motivationlab/wp- content/uploads/site...](https://s18798.pcdn.co/motivationlab/wp- content/uploads/sites/6235/2019/02/gollwitzer-et-al-2009-when-intentions-go- public.pdf) A cursory look shows the study talks about identity projection and actions (law students given extra material and asked to watch it, are less likely to watch it if they have told their observer they are going to watch it). However the difference is 1 minute of less watching and could be attributed to other factors.

Additionally, the same author has published research 5 years later ([https://s18798.pcdn.co/motivationlab/wp- content/uploads/site...](https://s18798.pcdn.co/motivationlab/wp- content/uploads/sites/6235/2019/02/ahn-et-al-2015-goal-projection-in-public- places.pdf)) that explains goal projection in public places is helpful as " is part of our everyday life and is fostered by high-goal commitment, perceiving others as similar, and ongoing goal striving.". So it is one thing to say you are going to be better at something by own self-study, but another when you are actually pursuing something and need help to achieve it. Announcing something allows you to connect with others sharing the same goal to get help or community, and shows you continue to be committed.

Feel free to read the studies and see if you can draw other conclusions, but this is not as black and white as the article claims.

</comment><comment><USER39> So true it happens to me many times. When I tell about the new idea or half done projects I feel less motivated to complete it.

So right now my lips are sealed on the current project that I am working and it's coming in good shape as of now

<comment><USER40> Did you just jinkx the "coming in good shape as of now" part because you announced it?

<comment><USER39> Nope unless i tell what i am building its jinkx protected :D

</comment></comment></comment><comment><USER41> My experience confirms the decrease in motivation after anouncement of a new exercise routine, diet, or life plan. Keep it private unless you already have a 100% committment within yourself to follow through. I pre-announced that I was quitting smoking, but I was really ready, and haven't smoked in 12+ years.

</comment><comment><USER42> Wonder if the feeling of being overwhelmed by the work involved in carrying out said plans feeds into this somehow. I mean, it's very easy to get carried away when planning things, and end up creating an absolutely enormous list of requirements you 'need' to meet to finish the project, many of which may require knowing more about the field to proceed.

That's certainly been an issue with my own projects, where the 'plan' ends up being more in line with the current HTML 5 specification in terms of length.

Meanwhile whenever I don't announce my plans/write them down in any way, it works better because I just get on with stuff and stop get sidetracked by irrelevant details and extras.

Also, announcing plans publically gets everyone hyped up about something to the point its original creator may struggle to get said project to live up to its own hype.

</comment><comment><USER43> The best thing I did last year was going to a gym 2 weeks before xmas and getting a membership and a trainer. I didn't tell anyone, I didn't make it my "new year resolution", I just went and did it. I'm still happily chugging along about 10 months later.

</comment><comment><USER44> Depends on how you do it. Announce a launch date for your project and tell me you're not 100% busting your ass to try and meet it.

</comment><comment><USER45> While in general, I agree with not announcing plans until they're finished, I do have two counterpoints

1) A year ago, I announced to in-person friends and on FB eliminating certain foods from my diet. Afterwards, it was easy because I could always remember I publicly announced it. Last year, it was chicken. This year, I added pork, soda, and processed meats. Haven't touched them since.

2) If it's very tangible and concrete then I find it works well. I announced writing daily for 30 days on my blog and successfully did it.

But yeah, general plans like I'm going to start a business or workout more usually fizzle out after the initial excitement.

</comment><comment><USER46> I find this incredibly transformative, more than I expected when clicking on the link.

Intuitively, I always believed that announcing my plans would sort of put me on the hook for completing them. That if I announced something and later didn't deliver, I'd feel ashamed. Obviously avoiding shame wouldn't be the only thing motivated me, but I figured I could add shame-avoidance to the list of motivations and make things overall stronger.

But this is definitely something to think about, and try to apply to myself.

</comment><comment><USER47> I think the keyword in this article is intentions. Those should remain private, but anything else about your work can be discussed and managed and is frequently better to do so.

The modern concept of a self is a difficult thing. I don't fully understand it. It seems to include a willingness to isolate and exile part of yourself. The boundary between what's internal and external is the basis of a whole category of research, but the modern pop-psychology idea is just to run with it as if we could know.

</comment><comment><USER48> I always had some uncanny notion of this, and would keep my plans to myself. For some things, it's the way to go (like quitting your job and traveling). Probably b/c you don't need the external input; it only adds noise.

Yet I wouldn't be so quick to discourage sharing and doing what it takes to stay motivated. External motivation is great, I wish I had more of it!

I reckon there is greater glory in stating what you will do and following through ftw... and yummy humble pie for you if you give up or fail.

<comment><USER26> I think you have a good point on external input noise.

When you announce your plans to people close to you, such as family and friends and coworkers, you start getting input which is not necessarily useful even if their intentions are good.

Moreover, your announcement might make some people uncomfortable to the point where they try to sabotage you, either intentionally or subconsciously.

</comment></comment><comment><USER49> I was torn on this. I don't want to feel like I'm shouting into the void if I'm working on something creative, because I do want other people to see what I make eventually. It seems to be reasonable to say that criticism is helpful if you're trying to get better at something (and take it in good faith). At some point that means releasing something to the public.

But I had been conflating finished work with the work needed to finish things. I'm also very tempted to reach out to people about what I want to get better at since I tend to seek validation externally. But only I can actually put in any effort towards my own goals.

Now my policy is to just shut up about it and put all that effort I could be spending speaking empty promises that haven't been fulfilled into putting my head down and doing things myself. Reaching out to people comes after you have something to show.

At the same time I want to meet people who are creative and that means outing yourself as creative also if you want that connection. It's hard putting in all that effort and being unable to talk to people about it.

</comment><comment><USER50> Or as Al Swearengen put it on the best TV show ever, HBO's _Deadwood_ : "Announcing your plans is a good way to hear God laugh."

</comment><comment><USER51> It definitely sets back the initial excitement or motivation behind a new idea, especially if it's half-backed. Can confirm from experience.

</comment><comment><USER52> There's another counter to this. If you announce your plans but put a penalty on it for non-accomplishment it acts as a commitment device.

You should read about commitment devices in general but the idea is they FORCE you to do something you know you're probably not going to do.

A good example is to tell your friend you're going to run a marathon and if you don't you'll give her $1000.

<comment><USER53> The way you phrased that kind of makes it sound like just another commitment to be avoided. Wouldn't you need to do something more like "give your friend $1000 in escrow and tell her she should only give it back to you if you run the marathon"?

<comment><USER54> This depends how trustworthy you are in general, and is definitely an interesting question.

Would Gandhi take a pill which made him 1% less likely to not commit any murders, if it meant receiving a million dollars with no other strings attached?

The answer seems to be, "he would use a Schelling Fence" if that was an option.

[https://blog.beeminder.com/schelling/](https://blog.beeminder.com/schelling/)

[https://www.lesswrong.com/posts/SdkAesHBt4tsivEKe/gandhi- mur...](https://www.lesswrong.com/posts/SdkAesHBt4tsivEKe/gandhi-murder-pills- and-mental-illness)

</comment></comment></comment><comment><USER55> Does reserving a domain name fall under the category of "Announcing your plans"? If so, my experience absolutely correlates with this. I might as well save my ideas to pocket. At least that's a free way to keep really interesting things I'll never see again.

<comment><USER56> Ah, yes... domain name addiction. Been there, done that =)

</comment></comment><comment><USER57> The number of things that I have an impulse to accomplish vastly exceeds my physical ability to accomplish them. This used to cause me great frustration but I've learned that I get a lot of value out of thought exploration, even if I can't tell the difference between something I'll want to stick with and something I'll want to dump at any specific stage in the process.

If I announce my plans and am left without a need to follow through, that's great. Apparently I didn't really have a need for the thing, I just had a need for exploration, and I didn't know that's all I needed from the idea yet. I have plenty of things I want to do and can move on to the next thing.

</comment><comment><USER58> [https://interruptions.net/literature/Wicklund- BASP81.pdf](https://interruptions.net/literature/Wicklund-BASP81.pdf) Is my go-to reference article. The idea of 'symbolic self completion' resonates so strongly with my personal experiences that 'talking depletes'. The less said about what you're working on, what your goals are, how you want to be, the better.

The book "Ego is the Enemy" also explains this effect. (It may have been the origin idea that led me to chase down the research paper in the first place)

</comment><comment><USER59> [Premature sense of completeness] Sums it all. I'd also add that such negative behavior is encouraged in our society to the point where praise is given for anything said, which is not even done yet. Premature achievers as well indeed take the idea of making the first step further down the perdition road and assume it's indeed even better to announce it publicly. I've always felt that speaking of what I plan to achieve is worthless because I knew I was seeking some gratification behind it, which sucked because why would you seek praise for what you haven't done yet?

</comment><comment><USER60> I do not find this to be the case at all.

My friends and coworkers are aware of my work on a particular ML task and are cheering me on. Every major hurdle and obstacle I've encountered is met with support and an unending eagerness to try my product.

I am so ready to get this out the door and I'm spending all of my free time on it. It's going to be huge.

This has been a year long project that is the offshoot of another project that led me down this more exciting path. My investment is only getting more and more intense now that I've found the correct problem domain gradient to explore.

</comment><comment><USER61> I had never seen these ideas put down on paper but it is true for me. My mind can be pretty satisfied with just thinking it knows how it would be if I accomplished something instead of actually doing it.

<comment><USER37> While I share your sentiment I think the article means sthg. Different. What I think it says is: If you have a plan and tell others about it's realization, you are less motivated to actually implement your plan.

Thinking about me it is bexause others start to monitor my doings, causing pressure and somewhat forcing me to work according to others schedules instead of my own. That's what workflife is about, no?

</comment></comment><comment><USER62> Hm. I've heard the exact opposite e.g. if you want to keep yourself accountable about doing something then you should tell everyone you know that you're doing it.

<comment><USER63> I think that only works if you tell people that will hold you accountable, like if you tell your spouse that you'll mow the lawn, they'll hold you to it. If you're posting "I'm going to lose weight this year!" on social media, people probably won't hold you accountable and you'll still be glad that you collected a bunch of likes and thumbsups without having to accomplish anything.

</comment></comment><comment><USER64> I remember reading about this years ago (maybe this very article). Announcing your plans seems to give you some of the satisfaction of having accomplished them, without actually doing anything. So ... I don't tell anyone if I'm planning a workout change, diet change, side project, etc, unless I figure I'll need the peer pressure more than my internal motivation.

</comment><comment><USER65> I'd word it differently:

"Share your 'go up' goals selectively... share your 'go up' goals with everyone you possibly can"

So, if you want to give up smoking, share that with everyone including your mailman. They will help you on your path. However, beware of sharing your 'go up' goals - like starting a business - with others... they might drag you down.

</comment><comment><USER66> I don't know about plans, but it does help to identify as 'the person who...' as long as those are the attributes you want. The person who executes or the person who is in shape or eats well are all positive traits that can be cultivated and self-reinforce. For me, there is more general bang for the popsci buck in the above than announcing plans.

</comment><comment><USER67> I think it's just safe to say that it depends on what motivates you. It's been known for a very long time that announcing plans creates a form of external accountability, which might be motivation for a number of people, but not for some.

So saying that announcing your plans makes you less motivated to accomplish them I think is too much of a blanket statement.

</comment><comment><USER68> A thread from 2014: [https://news.ycombinator.com/item?id=7496923](https://news.ycombinator.com/item?id=7496923)

Discussed at the time (and submitted by the author): [https://news.ycombinator.com/item?id=660720](https://news.ycombinator.com/item?id=660720)

</comment><comment><USER69> How about keeping a plan secret makes you more motivated to accomplish it.

In the opposite case, you were already rewarded before the successful action, in this case, you will only get the reward once it succeeds. It forces you to focus on accomplishing instead of on giving off the appearance that you will be successful.

Although often the former may depend on the latter.

</comment><comment><USER70> But then again: dreaming about startups will help you avoid pursuing a crazy career with no guarantee that it will work out. I often dream about startups that I could do and vividly imagine how successful they'd be. It feels really good. Then I stop and tell myself that I'll never do it

</comment><comment><USER71> I've heard the exact opposite from a lot of people I respect. That announcing plans and communicating with your peers and getting support and accountability for your plans actually increases the likelihood of success.

But I mean, that doesn't let you shit on the "posers" so whatever.

<comment><USER72> I believe that communicating a plan already in motion is not the same as expressing an idea one might have. If I understood correctly this article points out to the latter. While having already a plan in motion, you will want to share it with the people and colleagues that you want in order to continue an idea. But if you have an idea that you want to set in motion, and just share it around with everyone there's a high chance that it wont kick off.

</comment></comment><comment><USER73> What about announcing deadlines and completion times that others will depend on? Won't you feel more shameful if you can't meet that and will work harder to meet that rather than secretly working to accomplish something with no repercussions?

</comment><comment><USER74> The concept of "vaporware" seems relevant to this discussion. It's easy to talk big and hype a product that doesn't actually exist yet, but following through and getting the product shipped is a hell of a lot harder.

</comment><comment><USER75> I don't disagree with the study results. I guess talking about a thing can be a substitute for doing it.

But as others have mentioned, publicly committing to a specific measurable goal can help others hold you accountable.

</comment><comment><USER76> I definitely buy this. I've blogged about personal projects, and writing out plans for a project tends to take some wind out of its sails. It's motivating to share progress, though.

</comment><comment><USER77> I'd be interested in seeing what happens when someone else announces your plans. You don't get the same payoff, but still feel the obligation.

</comment><comment><USER78> This is my personal way of doing things, if its my own plan where I wont need any outside parties, nobody hears about it

</comment><comment><USER79> I generally find this is true. I work better on side projects and such if no one knows I'm doing it.

</comment><comment><USER80> How would this work in the context of work in a team? Say you have an idea for fixing a bug. Without telling the manager about your intent how could you actually work on it? The manager comes quickly to find where all your hours went doing what pursuit.

<comment><USER81> Managers aren't hour bean counters or people you need permission from to do work. Of course, I'm not speaking of toxic environments.

</comment></comment><comment><USER82> Announcing plans is good because then you can actually get some satisfaction from it. You're never going to accomplish anything anyway so you might as well take the happiness where you can get it.

<comment><USER69> I don't think that they understood your next level satire.

</comment></comment><comment><USER83> yeah I have this feeling as well. At the same time if someone asking "what's up?" and you say nothing, I feel like lying.

</comment><comment><USER84> 53 days sober. Announced it at the start.

<comment><USER85> I think the difference here is it is announcing an accomplishment, not an intention. Since its already happened, you can build pride around it.

I believe the article is saying is that announcing "I'm going to quit drinking." Is not a good way to get and stay sober.

<comment><AUTHOR> Right but growlist is providing a counterexample since _Announced it at the start_.

<comment><USER25> It is a probabilistic claim, not a causal one. Whether you announce it can clearly have no bearing on doing it, at the physical level. However, the studies showed that you're more likely to succeed it you kept it private.

Not guaranteed to succeed. Not doomed to fail if you announce. Just like getting dealt an ace as the first card doesn't determine if you win. Has better chances than getting a two, though.

</comment></comment></comment></comment><comment><USER86> Oh, thank God, I'm not crazy.

</comment><comment><USER87> So, do OKRs then make any sense?

</comment><comment><USER88> How else can you get validation?

</comment><comment><USER89> #BuildTheWall #LockHerUp</comment>


Will the 3-D Wonders of 'Avatar' Change the Industry? - <AUTHOR> http://www.nytimes.com/2010/01/13/movies/13avatar.html <comment><USER2> Sorry, I still don't understand why their is so much hype over the "3-D Wonders", it's nothing revolutionary. "Final Fantasy: The Spirits Within" came out 9 years ago with comparable details for example. Plus it wasn't a knockoff of the Pocahontas storyline.</comment>


Ask HN: Servers Naming Convention hierarchical or not? - <AUTHOR>

We currently use an Naming convention which I personally to not find it so easy to use, and confusing. I would like your opinion on the current one, and my thoughts.
An server example is: jdtdv-app001.domain.int
Meaning: jd = Jon Doe (department) t  = test (environment) d  = datacenter v  = virtual
After the -
app = application (server type examples: sql, mta) 001 = numbering
domain.int (domain internal).
I find it difficult to understand and explain, and you always need to check the documentation.
on our hadoop we use these: jdtdv-hnn001.domain.int jdtdv-hdn001.domain.int
Can you find the difference? there is a small d and n in the middle of the server type. this means Datanode (worker) and Namenode.
This is making it ever more complex The production name node from Test has this difference: jdtdv-hnn001.domain.int jdpdv-hnn001.domain.int (production)
I was thinking of changing this to an hierarchical (at least for me) fqdn.
Example of a worker on hadoop: worker001.dc01.test.company.net
explained: <server type><number>.<datacenter>.<environment>.company.net so from a specific point to a more generic. Of course this is not my final setup of a host name, but just an example.
What are your thoughts? <comment><USER2> I've done both an encoded data name scheme (what this is) and the cattle method (srv0001, srv0002, etc etc). SRV can even encode a bit of information like datacenter location. Avoid rack/row because stuff gets moved around. Airport codes are popular to distinguish datacenters.

As far as encoded name schemes go, and even with the cattle method, I like the physical/virtual distinction. It lets me know whether I can iLO/IPMI/drac or need to open vSphere/equivalent for when SSH doesn't fix everything.

Where I don't like encoded schemes is because your departments and users inevitably want to change the environment or service. Experimental/test servers tend to feature creep into production because "it works, let's just promote and build a new test box". Also you end up with weird combo servers with multiple services because "it's only this one thing and we can't wait for a new box just for it". So now the web server isn't just a web server or an app server.

My opinion is to keep naming however you're naming. I'd consider dropping the environment and most likely department. Encode that into the CNAME, or keep another database of ownership.

This article is pretty good on naming schemes: [https://mnx.io/blog/a-proper- server-naming-scheme/](https://mnx.io/blog/a-proper-server-naming-scheme/)

<comment><USER3> I also bookmarked that article at mnx.io and think it is very straight forward naming schema.

<comment><AUTHOR> I used till now the mnx.io style of naming, which is from more specific to more generic approach... and found it also easy to remember.

Last but not least, on multiple environments you have the same local naming, and your applications can work without even touching them.</comment></comment></comment>


Ask HN: Black Friday/Cyber Monday Recommendations for Developers - <AUTHOR> Looking for recommendations for developer related things from HN crowd here. <comment><USER2> Maybe not necessary with so many free tutorials on yt these days, but for those who want a full course in something specific like react, you can check out Wesbos courses - they are currently half price: [https://reactforbeginners.com/](https://reactforbeginners.com/)

</comment><comment><USER3> I like Laracasts so much I created an account just to recommend it. They are half price right now.

[https://laracasts.com/sales/2019](https://laracasts.com/sales/2019)</comment>


The Numbers Are In, Live Video Online Is Blowing Up - <AUTHOR> http://www.readwriteweb.com/archives/live_video_big.php <comment><USER2> We don't use quantcast, but here's how we stack up on alexa, fwiw:

[http://www.alexa.com/data/details/traffic_details/justin.tv?...](http://www.alexa.com/data/details/traffic_details/justin.tv?site0=justin.tv&site1=stickam.com&site2=ustream.tv&site3=mogulus.com&site4=kyte.tv&y=r&z=3&h=400&w=700&c=1&u%5B%5D=justin.tv&u%5B%5D=stickam.com&u%5B%5D=ustream.tv&u%5B%5D=mogulus.com&u%5B%5D=kyte.tv&x=2008-06-05T23%3A43%3A57.000Z&check=www.alexa.com&signature=WWotDDMTG7ODyKkffQMvjjPvlf4%3D&range=max&size=Large)

</comment><comment><USER3> Finally the computer reaching their full potential: a TV

<comment><USER4> A TV with better analytics..</comment></comment>


Elon Musk Today - <AUTHOR> https://elonmusk.today/ <comment><USER2> So this basically a place where EM haters can get their daily fill of "he's a fraud!"?

<comment><USER3> Reminds me of this site: [https://joebiden.info/](https://joebiden.info/)

Except...you know...the Biden site is inclined to a more grave accusation</comment></comment>


Ask HN: How do you find less popular GitHub Repos to support? - <AUTHOR> Most search-site provide only popular Repos in there search results. But what if I want to support smaller projects. <comment><USER2> I like this collection - [https://summerofcode.withgoogle.com/projects/](https://summerofcode.withgoogle.com/projects/)

Found and supported Kiwix there.</comment>


China's population shrank last year for the first time in 70 years - <AUTHOR> https://www.straitstimes.com/asia/east-asia/chinas-population-shrinks-despite-two-child-policy-experts <comment><USER2> Curious as to other countries that have recently hit peak population.

<comment><USER3> "As of 2010, about 48% (3.3 billion people) of the world population lives in nations with sub-replacement fertility.[2] Nonetheless most of these countries still have growing populations due to immigration, population momentum and increase of the life expectancy. This includes most nations of Europe, Canada, Australia, Brazil, Russia, Iran, Tunisia, China, the United States and many others. In 2015, all European Union countries had a sub-replacement fertility rate, ranging from a low of 1.31 in Portugal to a high of 1.96 in France.[3] The countries or areas that have the lowest fertility are in developed parts of East and Southeast Asia: Singapore, Macau, Taiwan, Hong Kong and South Korea.[4] Only a few countries have had, for the time being, sufficiently sustained sub-replacement fertility (sometimes combined with other population factors like higher emigration than immigration) to have population decline, such as Japan, Germany, Lithuania, and Ukraine. As of 2016, the total fertility rate varied from 0.82 in Singapore to 6.62 in Niger."

[https://en.wikipedia.org/wiki/Sub- replacement_fertility](https://en.wikipedia.org/wiki/Sub- replacement_fertility)

Data viz: [https://ourworldindata.org/grapher/children-born-per- woman](https://ourworldindata.org/grapher/children-born-per-woman)

Deep dive: [https://ourworldindata.org/fertility- rates/](https://ourworldindata.org/fertility-rates/)</comment></comment>


Ask HN: Best example application to build to master a web framework? - <AUTHOR>

Hello HN,
I am in the middle of planning to write a book around a rails-like web framework/technology, and I was wondering what would be the best example, for you, for mastering this kind of tech.
- A twitter clone ? - A tumblr clone ? - An amazon clone ? - etc.
This is kind of a poll, but I am new to HN and couldn't see how I could do that.
Thanks in advance <comment><USER2> Typically to get my bearings on Web Frameworks, I build an Amazon clone. Why?

* I can use the frameworks "partial views", header, footer, sidebar.

* I can use the frameworks stylesheets/javascript/images helpers.

* I can see how file uploads work (let users upload avatars).

* I can see what forms helper the frameworks have "create product" form.

* I can see how the framework facilitates forms validation.

* Search - I can see what ficilities the framework gives me in filtering rows from the database.

Once I'm done with this simple app, it takes me around a day, I can confidently say I can work on actual products.

</comment><comment><USER3> Why only one? I would suggest you to compile a book with 4-5 small but real world examples that focuses on different parts of framework. Ideally, I would like to see :

1) A blog/to-do/HN clone as introduction.

2) Any social application that involves signup/login/user management/profiles/roles/authorizations/connection/communication etc.

3) An e-commerce application - May be a shopping cart.

4) REST API with OAuth2 support(as oAuth provider not just consumer)

<comment><AUTHOR> This is quite an idea. I'll have to sleep on it ;)

Thanks

</comment></comment><comment><USER4> For a really simple example, you could try a Todo app.

For example, this site does the same thing for a number of JS frameworks: <https://github.com/addyosmani/todomvc>

For something more complex, you could try to simulate a mail client (mail user agent). You probably don't need to make it fully functional, just simulate the email layer. If you do this, you are just obeying Zawinski's Law! ([http://en.wikipedia.org/wiki/Jamie_Zawinski#Zawinski.27s_law...](http://en.wikipedia.org/wiki/Jamie_Zawinski#Zawinski.27s_law_of_software_envelopment))

See what UkiJS does here for a browser example: <http://ukijs.org/mail/index.html>

In general, check out RosettaCode to see how to do the same thing in different languages.

<comment><AUTHOR> The Todo app would be good for an introduction tutorial, but for my book, I want the user to understand the whole cycle of a production ready web site, which means I need more advanced features to explore, to take them step by step, from 0 to deploy.

Simulating a mail client would be good too, except that it is more suited for people wanting to build web apps. My book is for people who want to build web sites.

Thanks for the ideas.</comment></comment>


Ask HN: What has more tools for simpler scraping, Python or JavaScript? - <AUTHOR> A colleague asked me to recommend a language to pick up for scraping. I use Python and I am fine with it. But I know a lot of people use JavaScript as well. I never bothered. Just curious to know from those who have tried both what they eventually settled on and why. I would want to give the better choice to my colleague. <comment><USER2> Since he ask for a language why do you limit the choice to python or js? I personally would recommend Java's Jsoup.

</comment><comment><USER3> Perl. Not my favourite language, but it was pretty much designed for this use case.</comment>


ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs - <AUTHOR> https://www.cyberus-technology.de/posts/2019-05-14-zombieload.html <comment><USER2> Apparently Intel attempted to play down the issue by trying to award the researchers with the 40,000 dollar tier reward and a separate 80,000 dollar reward as a "gift" (which the researchers kindly denied) instead of the maximum 100,000 reward for finding a critical vulnerability.

Intel was also planning to wait for at least another 6 months before bringing this to light if it wasn't for the researchers threatening to release the details in May.

Source in the dutch interview: [https://www.nrc.nl/nieuws/2019/05/14/hackers- mikken-op-het-i...](https://www.nrc.nl/nieuws/2019/05/14/hackers-mikken-op- het-intel-hart-a3960208)

<comment><USER3> > Intel was also planning to wait for at least another 6 months before > bringing this to light

Of course, until the legally agreed date when they can dump shares so there's no obvious proof that it's insider trading. Isn't that what (then) Intel CEO Brian Krzanich did after Meltdown/Spectre?

<comment><USER4> No. CPU vulns don't affect Intel's stock price.

<comment><USER5> History would appear to prove you wrong[1]. Yes, Intel's stock price rebounded that doesn't change that their stock price changed when the vulnerability became public.

[1]: [https://qz.com/1171391/the-intel-intc-meltdown-bug-is- hittin...](https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hitting-the- companys-stock-big-time-while-rival-amd-is-soaring/)

</comment></comment></comment></comment><comment><USER6> What is the recommended course of action? Stop buying Intel products, and devices which contain them?

What about devices with older processors? I'm still running a Sandy Bridge rig and it works fine, except for the side channel vulnerablities. It's probably not going to be patched. I also have a cheaper computer with a Skylake processor, which is newer yet still vulnerable!

It's only a matter of time until something really nasty comes along, making all these PCs dangerous to use. What then? Lawsuits?

My questions are only partially rhetorical.

<comment><USER7> The stream of critical CPU vulnerabilities starting with Spectre/Meltdown last year are related to _speculative execution_ , not just Intel. (AMD and ARM CPUs are also vulnerable to Spectre, for example.) Intel CPUs are sometimes vulnerable to additional attacks because they speculate in more scenarios than other designs. But fundamentally, as long as multiple different trust domains are sharing one CPU that speculates at all, or has any microarchitectural state (e.g., caches), there are likely to be some side-channel attacks that are possible.

The important thing to realize is that speculation and caching and such were invented for performance reasons, and without them, modern computers would be 10x-100x slower. There's a fundamental tradeoff where the CPU _could_ wait for all TLB/permissions checks (increased load latency!), deterministically return data with the same latency for all loads (no caching!), never execute past a branch (no branch prediction!), etc., but it historically has done all these things because the realistic possibility of side-channel attacks never occurred to most microarchitects. Everyone considered designs correct because the _architectural_ result obeyed the restrictions (the final architectural state contained no trace of the bad speculation). Spectre/Meltdown, which leak the speculative information via the cache side-channel, completely blindsided the architecture community; it wasn't just one incompetent company.

The safest bet now for the best security is probably to stick to in-order CPUs (e.g., older ARM SoCs) -- then there's still a side-channel via cache interference, but this is less bad than all the intra-core side channels.

<comment><USER6> Yes, the vulnerabilities are not _just_ Intel, but they're _mostly_ limited to Intel CPUs. Why is AMD less prone to these mistakes? Perhaps there are simply fewer researchers looking into AMD processors?

<comment><USER8> They have different cache architectures; Intel uses inclusive (i.e. all levels contain keys from previous levels), AMD uses exclusive cache (each level contains unrelated entries to any other level). This might have different effects on classes of vulnerabilities they are prone to.

<comment><USER9> I know that some AMD CPUs a long time ago had exclusive caches, but for Ryzen, I'm pretty sure that both L1 and L2 are inclusive, and L3 a victim cache.

</comment></comment></comment></comment></comment><comment><USER10> In short:

* Core and Xeon CPUs affected, others apparently not.

* HT on or off, any kind of virtualization, and even _SGX_ are penetrable.

* Not OS-specific, apparently.

* Sample code provided.

[https://www.cyberus- technology.de/posts/2019-05-14-zombieloa...](https://www.cyberus- technology.de/posts/2019-05-14-zombieload.html)

<comment><USER11> And here's the mitigation in NetBSD: [https://github.com/NetBSD/src/commit/afab82aeafd0c51afc036a8...](https://github.com/NetBSD/src/commit/afab82aeafd0c51afc036a8b35dd0ed428b2885b)

Essentially: Intel released a microcode update which makes the `verw` instruction now magically flush MDS-affected buffers. On vulerable CPUs, this instruction now needs to be run on kernel exit; the microcode update won't do it automatically on `sysexit`, unfortunately.

<comment><USER10> Hopefully with this patches for other OSes should appear soon.

</comment></comment></comment><comment><USER12> Pandora's box was opened with the public disclosure of Spectre and Meltdown. Security researchers will continue to find new and better ways of attacking the security boundaries in processors, and there's unlikely to be an end to this any time soon. Exciting time to be in security, not such an exciting time to be a potential victim.

<comment><USER13> Security by obscurity is no security

<comment><USER14> This saying rubs me the wrong way, because confidentiality is 1/3 of security. Obscurity is critical or this wouldn't be a vulnerability.

<comment><USER15> Confidentiality is a valid layer of security, however security _solely by_ obscurity is wrong.

You can have unintentional exploits/vulnerabilities in free/open source software or hardware too.

</comment></comment></comment></comment><comment><USER16> > macOS performance: Testing conducted by Apple in May 2019 showed as much as > a 40% reduction in performance with tests that include multithreaded > workloads and public benchmarks. Performance tests are conducted using > specific Mac computers. Actual results will vary based on model, > configuration, usage, and other factors.

from here: [https://support.apple.com/en- us/HT210107](https://support.apple.com/en-us/HT210107)

<comment><USER17> Yeah, if you choose to turn off hyperthreading. Pretty expected tbh - hyperthreading helps quite a bit for some things.

<comment><USER16> but I don't see Intel mentioning this 40% anywhere... by Intel words, the worst degradation is 9%, and it creates an impression that it's with HT off.

If you choose not to disable HT, you stay vulnerable even with updated microcode, right?

In any case, Apple's stats are much more gruesome...

<comment><USER18> It really is going to depend on what test you are running. HT has the greatest effect when the running process has a lot of "downtime" for things like memory retrieval or any I/O as it allows for other processes to make use of this downtime. So if your tests are just doing calculations with very little file/network I/O it could very well be in the 9% range.

<comment><USER19> The best of the worst case. Gotta love that Intel spin machine working in overdrive

</comment></comment></comment></comment></comment><comment><USER20> So at what point do we start producing CPUs specifically aimed at running a kernel/userland? Why don't we have a CPU architecture where a master core is dedicated to running the kernel and a bunch of other cores run userland programs? I am genuinely curious. I understand that x86 is now the dominant platform in cloud computing. But it's not like virtualization needs to be infinitely nested, right? Why not have the host platform run a single CPU to manage virtual machines, which each get their own core or 20? Would the virtual machines care that they don't have access to all the hardware, just most of it?

<comment><USER21> > Why don't we have a CPU architecture where a master core is dedicated to > running the kernel and a bunch of other cores run userland programs?

How will your "userland core" switch to other userland programs safely? A pointer-dereference can be a MMap'd file, so its actually I/O. This will cause the userland program to enter kernel-mode to interact with the hardware (yes, on code as simple as blah = (this->next)... the -> is a pointer dereference potentially in a mmap'd space to a file).

So right there, you need to switch to kernel mode to complete the file-read (across pointer-dereference). So what, you have a semaphore and linearize it to the kernel?

So now you only have one-core doing all system level functions? That's grossly inefficient. Etc. etc. I don't think your design could work.

<comment><USER20> Sounds like we would need a new paradigm for how to handle that. But it seems to me that x86 is in now way the panacea of COU design. Wouldn't you gain some good trade offs by changing up how things are done?

<comment><USER21> MMap'd files, and... in-demand paging... are pretty much on every CPU architecture worth making an application for. ARM, POWER9, X86, SPARC, MIPS, and more.

In-demand paging is another situation where a simple pointer-dereference can suddenly turn into a filesystem (and therefore: kernel-level / hardware-level) call.

</comment></comment></comment></comment><comment><USER22> 9% hit potentially on performance in data center. Add in all the Spectre and meltdown mitigations and we have potentially lost nearly two generations of Intel performance increases.

Just shows the hoops and tricks needed to keep making, on paper, faster processors year on year but without node shrinks to give headroom.

14nm++++ is played out.

<comment><USER23> I wonder at what point the hardware fix for these issues stop becoming worthwhile and if we'll see a resurgence of processors without speculative execution or any of these other speed ups.

<comment><USER24> Ironically, a high performance, general purpose architecture without speculative execution might require a deep reinvestment in SMT. Instead of trying to speculatively make one thread fast to mask IO stalls, run a large pool of threads that can stall frequently but still keep the execution units and memory channels busy.

To avoid reintroducing these spectre like bugs, you'd have to conservatively design the per-thread execution to avoid those covert channels. Not only synchronously enforcing all logical ISA guarantees for paging and other exception states, but also using more heavy-handed tagging methods to partition TLB, cache, etc. for separate protection domains.

<comment><USER25> AKA a barrel processor:

[https://en.wikipedia.org/wiki/Barrel_processor](https://en.wikipedia.org/wiki/Barrel_processor)

</comment></comment></comment></comment><comment><USER26> Some information for Linux, from LWN.net ([https://lwn.net/Articles/788381/](https://lwn.net/Articles/788381/)): "See this page from the kernel documentation ([https://www.kernel.org/doc/html/latest/x86/mds.html#mds](https://www.kernel.org/doc/html/latest/x86/mds.html#mds)) for a fairly detailed description of the problem, and this page ([https://www.kernel.org/doc/html/latest/admin-guide/hw- vuln/m...](https://www.kernel.org/doc/html/latest/admin-guide/hw- vuln/mds.html)) for mitigation information."

</comment><comment><USER27> It takes one rouge/unpatched VM to run and scan threads randomly, undetected over a longer period of time, if not patched. With HT disabled potential hits become less likely, but still possible given time. Is virtualization on Intel dead now? Perhaps not. But, it's increasingly dangerous to use Intel for cloud services.

<comment><USER28> Interestingly AWS released a bulletin about MDS vulnerability but nothing about ZombieLoad yet. [https://aws.amazon.com/security/security- bulletins/AWS-2019-...](https://aws.amazon.com/security/security- bulletins/AWS-2019-004/)

<comment><USER29> CVE-2018-12130 is in the list of CVE's in your link. That is the ZombieLoad CVE. I hate these stupid names, they only confuse as shown by your comment.

</comment></comment></comment><comment><USER30> What impact does this have in a multi-tenant cloud environment? I'm legitimately considering moving my security critical EC2 instances over to AMD-backed instance types right now.

<comment><USER29> I doubt that you both manage critical infrastructure on AWS and haven't read the AWS security bulletin.

[https://aws.amazon.com/security/security- bulletins/AWS-2019-...](https://aws.amazon.com/security/security- bulletins/AWS-2019-004/)

</comment></comment><comment><USER31> So I'd love to post an Ask HN: Which AMD Laptops would you recommend for work, alternatives to Thinkpads?

I've noticed some Thinkpads with AMD CPUs but I feel like I'm on virgin ground when it comes to AMD and their integrated GPU offerings.

<comment><USER32> I've been eyeing more release details on the ThinkPad X395 which was recently announced. "Coming Soon" is probably means early June for some select configurations. I think these will fit in the premium/professional laptop space better than some of the bargain laptops that carried AMD chips in the past.

I believe others OEMs are developing similar offerings as well but I can't find any quick links for newer SKUs like the Ryzen 7 3700U which offers the improved Zen+ revisions which will specifically improve battery life and heat issues.

<comment><USER33> Yes the T495 and the X395 ought to be the best ones.

</comment></comment></comment><comment><USER34> Looks like AMD Cpus are safe again.

<comment><USER35> Note that Spectre definitely affected AMD chips and in general these sorts of side channel attacks based on speculative execution are extremely likely to be effective against any chip (including AMD manufactured ones) that employ speculative execution though the precise implementation might have to be jiggered a bit.

<comment><USER36> Not necessarily. This is more like Meltdown in that it involves one context just outright accessing data in a completely different context, and AMD chips seem to be totally immune from that attack. Any chip with a microarchitecture that actually enforces the architecturally-guaranteed checks, rather than ignoring them and fixing the results up later, can avoid such attacks.

Spectre, on the other hand, is harder both to fix in hardware and to attack because the victim context is itself tricked into speculatively executing code using attacker-supplied data that leaks information - it uses inherent properties of speculative execution rather than any kind of hardware bug, but it's only exploitable if there's some victim code that does exactly the right kind of processing on attacker-supplied data.

<comment><USER37> > This is more like Meltdown in that it involves one context just outright > accessing data in a completely different context, and AMD chips seem to be > totally immune from that attack.

No, AMD has been largely immune to bugs involving speculating past a _page fault_. Both Meltdown and L1TF involved speculating past page faults, and the ZombieLoad paper also mentions exploiting bad behavior during page faults (but, disclaimer, I haven't read in enough detail yet).

AMD was not immune to, for example, spectre variant 2, which very much did allow reading from other address spaces (even other VMs): [https://www.amd.com/en/corporate/security- updates](https://www.amd.com/en/corporate/security-updates)

In general it doesn't make sense to expect that any brand of processors might be vulnerable or invulnerable to all illegal memory access. There are many different components involved in handling memory access and many different ways they could go wrong.

<comment><USER36> Spectre variant 2 was a little more interesting in that it can trick the processor into speculative execution of something that's not a valid execution path for the victim context (by confusing it about the target of an indirect branch), but it still relies on the speculative execution happening in a context that is meant to have access to the targetted data. It's sort of halfway between this and the other Spectre variants; it can be fixed in hardware or software.

All three of these latest vulnerabilities are like Meltdown and L1TF in that they just allow speculative execution to completely ignore hardware-level access protections and read data from a completely different process, and there's nothing that can be done about it at the software level. (Originally, the comment you're replying to was posted on a discussion about all three, if I remember rightly.) All of these affect Intel but not AMD. It's not like modern AMD chips are exactly poor performers either.

<comment><USER37> > All three of these latest vulnerabilities are like Meltdown and L1TF in that > they just allow speculative execution to completely ignore hardware-level > access protections and read data from a completely different process

Not really. These attacks are completely different from Meltdown and L1TF in that they don't involve reading from memory at all. They involve hidden processor state that contains values that were recently used in another context. The attacker never explicitly specifies an address they are interested in -- they just get whatever's floating around.

A comparable (but much more obvious) bug would be if the OS failed to clear registers when switching contexts. Although the values in those registers may have at one point been read from memory, the attacker recovering those values isn't directly accessing the victim's memory.

Your comments seem to be arguing that AMD isn't affected by these bugs for the same reason they weren't affected by Meltdown. But these bugs operate in a totally different way and exploit totally different components. There doesn't appear to be any reason to believe they are related.

I think the reason AMD isn't affected likely has to do with the fact that these attacks are targeting specific implementation details of Intel processors, which AMD processors probably just happen to implement differently. (Indeed, Fallout appears to be attacking outright unintentional behavior -- it would be surprising if multiple CPUs had the same bug.) It seems likely to me that AMD has different bugs which haven't been found yet, perhaps mostly because researchers haven't focused on them.

(Disclosure: I own some AMD stock. I don't own Intel stock. I have no other affiliation with either company.)

<comment><USER36> The "hidden processor state" is the memory contents belonging to other processes, stored as part of the CPU's memory access machinery. Every single one of these vulnerabilities involves Intel speculatively filling memory read requests from one process with data from another process without doing access checks first, and it turns out they do this all over the place: they do it from L1 cache, they do it if there's an L1 cache miss, they do it when the actual desired memory is uncacheable, they do it with store-to-load forwarding... almost every conceivable method of fulfilling a memory read on modern Intel CPUs is happy to speculatively leak secret data from other processes that shouldn't be accessable. More interestingly, AMD don't seem to do this anywhere that anyone's been able to find. (Well, technically that's not quite true... there's a speculative bypass of x86 segment limits on AMD which no-one cares about because no-one uses those anyway.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> OpenBSD was right and disabled HT for Intel CPUs in June 2018 ago due to concerns of more such CPU bugs coming up. There we go ... [https://news.ycombinator.com/item?id=17350278](https://news.ycombinator.com/item?id=17350278)

<comment><USER39> This. I remember people laughing at this decision back then, and flaming on OpenBSD policies to handling security vulnerabilities, to the point where they aren't informed anymore. Yet OpenBSD is the only major OS taking these issues seriously instead of believing whatever Intel marketing department yells every other day.

</comment></comment><comment><USER40> Why doesn't this type of news cause INTC to tank - they're up today. I know the market is up today, but (and it's probably my innate overreaction) I would think this sort of news would cause its stock to suffer.

<comment><USER34> I think there is an expectation that Intel's new generation CPUs wont have these vulnerabilities and they will sell these a lot more to replace the piece of crap they have sold for ridiculous prices. Intel is actually probably happy about these, because no one cares.

<comment><USER41> Intel have not been able to produce 10nm chips for 2 years now and they don't expect them until 2020. If the Ryzen 3000 leaks of a 15% IPC gain are proven to be true in a couple weeks then Intel is in real trouble. Add on additional performance losses with this mitigation and Intel is very likely to lose the top end of the CPU market for at least 2 years. INTC might look very different come the end of the month.

</comment></comment></comment><comment><USER42> Do cloud providers commonly float cores between VMs? I could see instances like the AWS T family (burstable) sharing, but I had always assumed that most instance types don't over-provision CPU.

If that's the case, my CPUs are likely pinned to my VM. I could still have evil userland apps spying on my own VM, but I would not expect this to allow other VMs to spy on mine.

<comment><USER43> Sharing CPUs is not the point, as long as you are sharing physical memory with other tenants, you are vulnerable (although exploits are much harder when attackers have to cross privilege boundaries).

<comment><USER44> > Sharing CPUs is not the point, as long as you are sharing physical memory > with other tenants, you are vulnerable

Not to these vulnerabilities. These are attacking memory that is "in flight" within a processor.

</comment></comment></comment><comment><USER45> I really hate these descriptions of SMT as some kind of violation of the natural relationship between CPU frontend and backend. The idea that there is a "physical core" and a "logical core" does not map to reality.

<comment><USER46> _The idea that there is a "physical core" and a "logical core" does not map to reality._

This is the terminology that Intel itself uses in its documentation to describe its products, though. To be fair, they say "physical processor" and "logical processor", not "core".

</comment></comment><comment><USER47> I'm sure I remember a post on here (or possibly /r/programming) a couple of years ago from an Intel employee mentioning that Intel was cutting a lot of QA staff, and that we should expect more bugs in the future. I could be imagining things though.

<comment><USER48> I remember a leak about a call to become "more agile" like some ARM designers, implying less time spent on verification.

<comment><USER49> verification wouldn't catch any of this, the processors operate correctly on an architectural level

most of this seems to be behaving as intended, they just didn't foresee the side channels this opens up

</comment></comment></comment><comment><USER50> This sentence killed me: "Daniel Gruss, one of the researchers who discovered the latest round of chip flaws, said it works "just like" it PCs and can read data off the processor. That's potentially a major problem in cloud environments where different customers' virtual machines run on the same server hardware."

What are they saying here?

<comment><USER51> It should read:

> ...said it works "just like" in PCs

The number of mistakes in the Techcrunch article is atrocious.

<comment><USER52> I found two and emailed the author. It's my sad little hobby. He replied promptly and they all should be fixed now. In fact, he found a third that I missed.

Keep in mind, this article was posted at 3am pacific, 6am eastern. Assuming the author is in North America, he was probably under a deadline and rather tired.

I have found similar typos from prominent writers. Sometimes they email me back, which I appreciate.

I found one in an article by Cory Doctorow on boingboing. I checked on builtwith.com, and they use WordPress/Jetpack. Jetpack has a feature that will warn you if you try and publish something with spelling mistakes, it is just not enabled by default.

I let Mr Doctorow know all this, in a very polite manner, and he responded with "many thanks". I'm not big on celebrity worship, but it still made my day.

<comment><USER53> Thank you for your service!

<comment><USER13> I know this comment adds nothing of value but I have to quote it anyway

"Service guarantees citizenship, want to know more?"

</comment></comment></comment></comment></comment><comment><USER54> Can this attack allow the attacker to escape public cloud isolation methods and break into the control plane or other VMs?

<comment><USER55> It would have, but it's likely the cloud vendors have already deployed defenses.

<comment><USER56> Today's AWS[1] and Google Cloud[2] security bulletin notes that all their host infrastucture (read: cpu firmware/microcode) has been updated to mitigate the issues disclosed today by Intel[3]. I could not find anything for Azure yet.

I also note that the provided OSes are being updated with mitigations as well, so for complete mitigation of the issue you'll probably need to update your OS.

[1] [https://aws.amazon.com/security/security- bulletins/AWS-2019-...](https://aws.amazon.com/security/security- bulletins/AWS-2019-004/)

[2] [https://cloud.google.com/compute/docs/security- bulletins#201...](https://cloud.google.com/compute/docs/security- bulletins#20190514)

[3] [https://www.intel.com/content/www/us/en/security- center/advi...](https://www.intel.com/content/www/us/en/security- center/advisory/intel-sa-00233.html)

</comment></comment></comment><comment><USER57> These style of exploits remind me of "The Free Lunch Is Over: A Fundamental Turn Toward Concurrency in Software" (2005) - [http://www.gotw.ca/publications/concurrency- ddj.htm](http://www.gotw.ca/publications/concurrency-ddj.htm)

> Chip designers are under so much pressure to deliver ever-faster CPUs that > they'll risk changing the meaning of your program, and possibly break it, in > order to make it run faster.

> ...

> applications will increasingly need to be concurrent if they want to fully > exploit CPU throughput gains that have now started becoming available and > will continue to materialize over the next several years. For example, Intel > is talking about someday producing 100-core chips; a single-threaded > application can exploit at most 1/100 of such a chip's potential throughput.

It seems the trend in programming languages is towards better concurrency support. But why don't we yet see 100-core chips? If chip makers had to forego all speculative execution and similar tricks, would that push us toward the many-core future?

</comment><comment><USER58> crucial (for me anyway) summary of relevant events of the day

[https://twitter.com/IanColdwater/status/1128395135702585347?...](https://twitter.com/IanColdwater/status/1128395135702585347?s=20)

</comment><comment><USER59> I just want to plug their course hardware security (at the VU University Amsterdam). It's an amazing course and it costs 1200 euro's for students who need to pay full price. I've learned a lot about Spectre, Meltdown and novel forms of cache attacks and Rowhammer when I took it.

<comment><USER60> Offtopic: Are you familiar with the AI departments/ courses (master) at VU? I have the opportunity to go but haven't decided yet. (Interested in human- centred and modern ML with neural networks)

<comment><USER59> Hey, yea I do have some familiarity. Send me an email to have a conversation, it's in my profile.

</comment></comment></comment><comment><USER61> Is there any clear source of info for sysadmins responding to the many CPU- level vulns in the past year? It's very difficult to keep track of whether fixes are needed at ucode, OS, and/or application level, and what version numbers fix each bug.

</comment><comment><USER62> According to their blog post[1], there is little you can do against this. Running different applications on different cpus help against them reading each other's data but an rogue process can still read data from the "super ordinated kernel" or hypervisor.

<comment><USER63> Of course you can fix it. I fixed it in Dec 2018 for most such attacks in my safelibc memset_s implementation, but nobody wanted to use it, because securely purging the buffers with secrets via mfence was deemed to slow. So everybody can read your secrets via sidechannel attacks. These tiny MDS buffers need to be purged with verw or l1d_flush followed by an lfence. This needs to be added to memset and memset_s variants. This is much faster. But it will not happen, libc maintainers notoriously don't care, even crypto maintainers not. Only Linux does.

[https://software.intel.com/security-software- guidance/softwa...](https://software.intel.com/security-software- guidance/software-guidance/microarchitectural-data-sampling)

<comment><USER64> > This is much faster.

Hi. Am trying to understand what you meant here. That both "verw" or "l1d_flush followed by an lfence" are faster than "mfence" which you implemented in safelibc?

If so, why didn't you use these faster options yourself? My understanding was that these faster options needed to be handled at the hypervisor/kernel level, rather than in libc. If so, how is the attitude of glibc maintainers relevant?

<comment><USER63> verw and l1d_fence have no costs. lfence is a bit costly, mfence is basically an lfence + sfence. it flushes both caches, load and store.

safe libs need to do the right thing, not the fast thing. esp. crypto.

The attitude of libc and crypto maintainers is that you cannot trust them with security. all the memzero's are insecure. besides being overly complicated and slow. Linux is a bit better, but there are still estimated 20.000 security relevant bugs.

</comment></comment></comment></comment><comment><USER65> Another non-issue on non-Intel CPUs, like SPARC. Lovely.

</comment><comment><USER66> So far there seem to be far more of these vulnerabilities in Intel CPUs.

Is that a reflection of engineering differences or a statistical byproduct of the market share of Intel CPUs?

I run AMD not because of the security implications but because I feel every dollar that goes to Intel competition will push Intel and thus the entire industry forward.

<comment><USER67> Market share is a good answer, in x86 space alone per [https://www.extremetech.com/computing/291032-amd-gains- marke...](https://www.extremetech.com/computing/291032-amd-gains-market-share- in-desktop-and-laptop-slips-in-servers) which I found without putting much effort into it, AMD's share in servers is negligible and even dropped in the last quarter. On the other hand mobile and especially desktop are rising smartly, but still somewhat modest. IoT is excluded, and AMD could be doing well there to the extent anyone's using x86 for that, and there's also (quasi) embedded like network gear.

So the cloud vendors are 97% minimum Intel, they're _exquisitely_ vulnerable both technically and reputationally to these bugs, the stakes are existential for them and they have a lot of money they can throw at the problem, whereas the users of notebooks and desktops are a much more diffuse interest.

As I've mentioned many times in these discussions today, _everyone_ had Spectre issues, and everyone but AMD has Meltdown ones. The more recent vulnerabilities are Intel only because they're using what was learned from those first two to attack Intel specific features like the SGX enclave.

</comment></comment><comment><USER68> If using a cloud provider with Intel processors:

> The safest workaround to prevent this extremely powerful attack is running > trusted and untrusted applications on different physical machines.

Nope!

> If this is not feasible in given contexts, disabling Hyperthreading > completely represents the safest mitigation.

Nope!

Shrugs?

</comment><comment><USER69> The best defense against all these CPU vulns is to stop running malicious code. And that means getting off of shared VMs (and similar) where someone could run malicious code in your stead. Stop running any script your browser gets handed. Isolation was always a great idea, poor man's isolation (VMs, processes, ...) is only useful for isolation against non-malicios accidental interference. You want physical isolation between applications and services.

</comment><comment><USER70> _An unprivileged attacker with the ability to execute code_

That sounds like a contradiction --- if you can already execute code, I'd say you're quite privileged. It's unfortunate that their demo doesn't itself run in the browser using JS (I don't know if it's possible), because that's closer to what people might think of as "unprivileged".

 _The attacker has no control over the address from which data is leaked, therefore it is necessary to know when the victim application handles the interesting data._

This is a very important point that all the Spectre/Meltdown-originated side- channels have in common, so I think it deserves more attention: there's a huge difference between being able to read some random data (theoretically, a leak) and it being actionable (practically, to exploit it); of course as mentioned in the article there are certain data which has patterns, but things like encryption keys tend to be pretty much random --- and then there's the question of what exactly that key is protecting. Let's say you did manage to correctly read a whole TLS session key --- what are you going to do with it? How are you going to get access to the network traffic it's protecting? You have just as much chance that this same exploit will leak the bytes of that before it's encrypted, so the ability to do something "attackful" is still rather limited.

Even the data which has patterns, like the mentioned credit card numbers, still needs some other associated data (cardholder name, PIN, etc.) in order to actually be usable.

The unpredictability of what you get, and the speed at which you can read (the demo shows 31 seconds to read 12 bytes), IMHO leads to a situation where getting all the pieces to line up just right for _one_ specific victim is a huge effort, and because it's timing-based, any small change in the environment could easily "shift the sand" and result in reading something entirely different from what you had planned with all the careful setup you did.

 _Using ZombieLoad as a covert channel, two VMs could communicate with each other even in scenarios where they are configured in a way that forbids direct interaction between them._

IMHO that example is stretching things a bit, because it's already possible to "signal" between VMs by using indicators as crude as CPU or disk usage --- all one VM has to do to "write" is "pulse" the CPU or disk usage in whatever pattern it wants, modulating it with the data it wants to send, and the other one can "read" just by timing how long operations take. Anyone who has ever experienced things like "this machine is more responsive now, I guess the build I was doing in the background is finished" has seen this simple side- channel in action.

<comment><USER71> > if you can already execute code, I'd say you're quite privileged.

I always interpreted "privileged" to mean "superuser". I.e. unrestricted. Or possibly the case of one user and another user. Having a program that can determine the URL you are visiting in the browser from memory when running as the same user is a different class than something that can do the same when run as any non-root user on the system. There's a reason it's common to "drop privileges" in a daemon after any initial setup that requires those privileges (such as binding to a low port).

</comment></comment><comment><USER72> These CPU flaws make it seem as if virtualization in the data center is becoming really, really dangerous. If these exploits continue to appear, the only way forward would be dedicated machines for each application of each customer. Essentially, this might be killing the cloud by 1000 papercuts because it loses efficiency and cost effectiveness and locally hosted hardware does not necessarily have to have all mitigations applied (no potential of a unknown 3rd party code deployed to the same server).

<comment><USER73> Many years ago, OpenBSD's Theo De Raadt made a sneer at virtualization, saying something the lines of "they can't even build a secure system, let alone a secure virtualized system". I can't remember who he was referring to specifically, but we've certainly been seeing a lot of similar vulnerabilities.

<comment><USER72> Would be cool to see a source for that one. Theo de Raadt is a hardliner whom I don't always agree with, but I'd like to know how visionary he actually was in this case (quite a bit by the looks of it).

<comment><USER74> I'm not a security person but I wanna practice trying to sum up his points:

1\. There's no way in hell that a bunch of VMs running on one physical server is more secure than a bunch of different physical servers each running an OS. If there were architectural hooks for those VMs to provide additional security beyond what the host OS provides, then an OS like OpenBSD would already be making use of it.

2\. Running a bunch of VMs on a single physical machine is certainly _cheaper_.

3\. People who are in favor of the cost-cutting are claiming that there's a security benefit to sell more stuff.

Am I right?

If so, how does that stance jibe with the research that Qubes is based on?

<comment><USER75> I think the argument VM-sellers make is that it's more secure than running a bunch of colocated code on the same machine without VMs, not that it's more secure than distinct physical systems.

<comment><USER76> That is their claim. Theo is pointing out that the security is an illusion. Either the OS is secure and so you may as well just run everything in the OS without the VM in the way (ignoring issues of different operating system), or the OS is not secure and now you have to hope the VM is secure because otherwise you just exploit your VM to get out of it and then exploit the OS. The second level attack is more difficult, but that is all.

</comment></comment></comment></comment></comment></comment><comment><USER77> Sorry for being naive. Are these kind of CPU Securities vulnerabilities new? Why it is in the past 20 years we have had close to zero in the news ( At least I wasn't aware of any ) and ever since Spectre and Meltdown we have something new like every few months.

And as far as I am aware they are mostly Intel CPU only. Why? And Why not AMD? Something in the Intel design process went wrong? And yet all the Cloud Vendor are still buying Intel and giving very little business to AMD.

<comment><USER78> I think it is definitely worth introspecting about the history. It has been known for over 20 years that sharing pretty much anything creates side channels but nobody knew how to reliably exploit them and it was assumed that side channels might never be exploitable. In recent years there has been massive progress in practical data extraction using side channels.

<comment><USER79> Theo (of OpenBSD) famously ranted about Intel's implementation of SMT/hyperthreading ~12 years ago [https://marc.info/?l=openbsd- misc&m=118296441702631&w=2](https://marc.info/?l=openbsd- misc&m=118296441702631&w=2)

<comment><USER80> you sure about that link? he's talking about a core that didn't have SMT and is ranting, in general, about errata existing and wildly misrepresenting their impact

never mind that most errata are conditional until the ucode patch load, but that particular rant has nothing to do with HT

</comment></comment></comment></comment><comment><USER81> This looks like it is from the same TU Graz people who also worked on Meltdown & Spectre

[https://meltdownattack.com/](https://meltdownattack.com/)

</comment><comment><USER82> Url changed from [https://zombieloadattack.com](https://zombieloadattack.com), which points to this.

There is a home page about today's vulnerability disclosures at [https://news.ycombinator.com/item?id=19911715](https://news.ycombinator.com/item?id=19911715). We're disentangling these threads so discussion can focus on what's specific about the two major discoveries. At least I think there are two.

<comment><USER36> I think there's two seperate branded annoucemenst of three or four different vulnerabilities depending on how you count. (There are four CVEs and Intel lists four, but the researchers announced three.) Haven't seen much discussion of the specific differences between them, probably because they're subtle and not terribly relevant to most folks - they all involve one process speculatively reading memory it shouldn't be able to access via the memory access buffers within Intel CPUs, they just vary in which parts of the memory access machinery they use and how exactly they're exploited.

</comment></comment><comment><USER83> At what point do we simply revert to using typewriters for authoring sensitive documents, and pneumatic tubes (couriers for WAN) for networking?

[https://www.theguardian.com/world/2014/jul/15/germany- typewr...](https://www.theguardian.com/world/2014/jul/15/germany-typewriters- espionage-nsa-spying-surveillance)

<comment><USER84> We don't need to revert to typewriters. We just need computers designed with a real security model in mind, instead of piles of ah-hoc mitigations. However, I bet no one will invest in it until one of these exploits bring down AWS, take over Google's crawlers or something else of that sort.

<comment><USER85> There's smaller companies that keeps designing them. Nobody buys them for the most part. One example that can handle lots of security policies is CoreGuard. It's based on work at crash-safe.org.

[https://www.dovermicrosystems.com/](https://www.dovermicrosystems.com/)

Academics keep coming up with stuff for timing channels like partitioning, masking, and randomizing components. Personally, if not physical separation, I'd just do SMP with secret parts on different CPU that untrusted parts. Both memory safe on a separation kernel to isolate them. One design used different DIMM's, too.

</comment></comment></comment><comment><USER86> People should realize that ancient Chinese were оnto something when they told that all phenomena shall evolve only so much before they tip over the peak of maximum development and inevitably rumble downhill into overdevelopment.

P.S. the Holy Church of Progress keeps flagging the herecy of I-Ching out of existence, may it prevail in its glorious ways. Curious fact: expressing your disagreement in written form takes more neurons than flagging reflex does. Try and ye shall succeed!

<comment><USER82> I like the I Ching too but could you please stop posting these and then deleting them? It's an abuse of the site.

<comment><USER86> I'll stop as soon as dysgraphic flaggers stop. The true abuse is muting a comment that doesn't offend anyone, just calling to contemplate a philosophy so different from the current mainline it hurts. Or does it? Are they triggered by ' _people should_ '? Yeah, they _should_ , but don't _have to_. Is the very notion of impossibility to improve things forever without changing their essence offensive? Any other reason, could you explain it, please?</comment></comment></comment>


Unpaid internships hurt all workers and worsen income inequality - <AUTHOR> https://www.fastcompany.com/90388911/how-the-unpaid-intern-economy-feeds-income-inequality <comment><USER2> This is a really contentious subject. I really do feel like my unpaid internships got my foot in the door when I was otherwise unqualified on paper. Once they were able to see what I was capable of on a day to day basis, I was given a lot more responsibility and security.

Certainly we should strive to pay people for the hours they put in. But anything that results in access to better employment opportunities is a plus in my book.

Lastly, the transaction should be voluntary. The employer is free to hire someone at no cost if the worker is willing to accept it. The worker can leave at any time, such as if they get a better (paid) opportunity, or if they decide that they actually don't like the line of work.</comment>


Regular expression that matches only itself - <AUTHOR> http://codegolf.stackexchange.com/a/31863/4035

<comment><USER2> This is not a regular expression since it contains references.</comment>