skysight-inc/HackerNews huggingface dataset:
It is a fact that Linux driver crashes causes a kernel crash, and it’s not that rare (like usb drivers).
Even GPU drivers cause this [0].

But good job on not having a crash from a driver so far. Raspberry Pi users weren’t that lucky for example.

[0]: https://forums.developer.nvidia.com/t/bug-report-455-23-04-k...
They need to just make CPU's, GPU's, and memory modules with hardware level anti-cheat. Totally optional purchase, but grants you access to very-difficult-to-cheat-in servers.
No. Cheap skate corporations dont assume the responsibilty for security.
In fact the CEO in a quarterly report may use an "IT glitch" as a problem causing a loss as if thats not his responsibilty too.
Deplorable state of affairs.
They simply do not realky give a sh*t about customers - their very livelyhood.
And the sheep accept the abuse.
I agree that testing can reduce the probability of having huge problems, but there are still many ways in which a QA process can fail silently, or even pass properly, without giving a good indication of what will happen in production due to data inconsistencies or environmental differences.

Ultimately we don't know if they QA'd the changes at all, if this was data corruption in production, or anything really. What we know for sure is that they didn't have a good story for rollbacks and enforced staggered rollouts.
Debatable. macOS did away with third-party kernel extensions. On Windows, CS runs in the kernel, and the kernel can't load properly because of CS.
my god, the number of insane downvoters on hn. they even downvote you for an innocuous comment like mine above. I can only guess that they are losers or haters or retards or are hurting heavily for some reason, so they feel the need to strike out blindly, to get some kind of pathetic relief from whatever it is that they are hurting from. it could be job loss, or lack of money, no SO, etc. See Maslow.
"this process" in their comment is referring to the legislative process to effectively outlaw something which you do and see as harmless.

If you don't stand up for others' rights you might find yourself alone when you're trying to stand up for your rights.
Requiring crowdstrike or similar to be able to do business isn't a requirement from government, it is from exactly this industry consensus where business, insurance, etc, gets consulting advice on what best practices exist and should be required.

We have to do precisely what we've done because it isn't working?
In most of these movements that discipline isn’t maintained. What do you think happens when thousands of students, many of whom are discovering a city the first time in their lives, suddenly realize they can set grand things on fire?

There’s certainly the core movement that is disciplined, but its very hard to control the beasts in the fringes.
>There's something of a difference between 'alternative scenarios' and demonstrating that the 'settled' story doesn't fit with the limited evidence.

You've failed to demonstrate that, since your second link doesn't show the Ukrainian military disputing the DNC hack, just a separate hack of Ukrainian software, and the first link doesn't show ThreatConnect disagreeing with the assessment. ThreatConnect (and CrowdStrike, Fidelis, and FireEye) attributes the DNC hack to Russia.

>One popular example is that the exploit Crowdstrike claim was used wasn't in production until after they claimed it was used.

Can you provide more info there?
This is the same argument as saying the government is just the biggest gang — a mafia with uniforms.
To be fair, they acknowledge they are being creepy and that not all reactions were positive.

Also, of all the shady hustling that I’ve seen, targeting high level employees with a creative-and-privacy-invading pitch seems the least problematic.
You're confusing wallhacking with noclipping. Wallhacking is being able to see through walls, like drawing an outline around all characters that renders with highest z-order, or making wall textures transparent.

It does not result in any server-side-detectable difference in behavior other than the hacker seemingly being more aware of their surroundings than they should, which can be hard to determine for sure. Depending on how the hack is done, it may not be detectable by the client either, eg by intercepting the GPU driver calls to render the outlines or switch the wall textures.
The file was data used by the actual driver like some virus database. It is not code loaded by the kernel
The enshitification of search will drive queries directly to AI, either local or centralised. This will provide a before unknown nexus of opinion/ perception / idea control as the primary research tool will no longer return a spectrum of differing ideas and references, but rather a consolidated opinion formed by the AIs operators.

This has really dystopian vibes, since it centralizes opinion and “factuality” in an authoritative but potentially extremely biased or even manipulatively deceptive manner.

OTOH it will provide opportunities for competitive solutions to query answering.
I can't believe the thing that passkey defenders swore up and down wouldn't happen is happening!
Pretty much anything involved with money needs not just age but in most cases identity verification too. Online banking, online gambling, online trading etc.
Not for desiring it, no.

But if you take steps to conspire with people to cause violence to be caused to others, such as by voting for the perpetuation of a violent, brutal prison system, then I would see you as morally no better than someone actually engaged in a violent attack. You're in that case seeking to cause an untold amount of harm to others.

To me, seeking to cause that to happen to others is at least as wildly immoral as a rape and murder.
This approach is also what popped in my head. I've seen people use white boards for this already so it must be ok from a hipaa standpoint.
I’m sure some team had it in their backlog for years.
Badminton Shuttlecock Spin and Aerodynamics (2016)
Just that they're horrible at it
The battery lasts up to a single day, which is short but enough for me. I recognize that it's not a phone for everyone and it has its quirks, but "unusable" is not how I'd describe it after daily driving it for years. Overall I see more advantages than disadvantages when compared to mainstream devices, which is why I continue to use it.

> where the modem randomly disconnecting in the middle of a phone call can happen

Fixed 1.5 years ago. It's a fun story BTW: https://fosdem.org/2024/schedule/event/fosdem-2024-3200-univ...
> Southwest Airlines was unaffected inasmuch as it still uses Windows 3.1 and Windows 95.

I think this article needs work.
crowdstrike is caused by over-regulation, not under-regulation. no competent management team would voluntarily install a kernel module for remote surveillance and exfiltration of all their sensitive data, which is what crowdstrike does when it's working properly; it's only a thing at all because the pci guidelines mandate it

the places where the crowdstrike disaster results in additional regulation will not only be dystopically oppressive as howard predicts; they will also cause themselves additional infosec disasters

george kurtz, ceo and founder of crowdstrike, was the cto of mcafee when they did the exact same thing 14 years ago: https://old.reddit.com/r/sysadmin/comments/1e78l0g/can_crowd... https://en.wikipedia.org/wiki/George_Kurtz
I wonder if companies are incentivized to buy Crowdstrike because of Crowdstrike's warranty that will allegedly reimburse you if you suffer monetary damage from a security incident while paying for Crowdstrike.
+1

With so much of tooling and products, it should come down to

- What am I running and their current security state

- Supply chain of any change that's happening

- Test/Stage/Rollout any change - do not trust the vendor, as they do not know your infrastructure

By allowing OTA update, they assumed that the vendor has tested all permutations.
It's not a problem, nominally, but it is a problem if this leads others to believe that the submission does meet dupelicate criteria.

If I note prior submissions (often because I'd seen the earlier submission in the "New" queue, I'll specifically note whether or not it's a dupe.
Reminded me of the Sigma 200-500 f2.8. https://www.sigmaphoto.com/200-500mm-f2-8-apo-ex-dg

And this kind of beastie, https://www.bhphotovideo.com/c/product/840667-REG/fujinon_xa...
I would say no, it's definitely not a tiny risk. I'm confused what would lead you to call getting exploited by vulnerabilities a tiny risk -- if that were actually true, then Crowdstrike wouldn't have a business!

Companies get hit by zero days all the time. I have worked for one that got ransomwared as a result of a zero day. If it had been patched earlier, maybe they wouldn't have gotten ransomwared. If they start intentionally waiting two extra days to patch, the risk obviously goes up.

Companies get hit by zero day exploits daily, more often than Crowdstrike deploys a bug like this.

It's easy to say you should have done the other thing when something bad happens. If your security vendor was not releasing definitions until 48 hours later than they could have, when some huge hack happened becuase of that obviously the internet commentary would say they were stupid to be waiting 48 hours.

But if you think the risk of getting exploited by a vulnerability is less than the risk of being harmed by Crowdstrike software, and you are a decision maker at your organization, then obviously your organization would not be a Crowdstrike customer! That's fine.
It's not even fine as tl;dr. It misrepresents the study.

Yes, it quotes some words from the study. That's not what a tl;dr is.
If that's 40%, the public sector's a lot smaller than I thought.
We can argue all we want about CI infrastructure, manual testing, test nets/deployment, staged deployment.

All of that is secondary: they wrote and shipped code that blindly loaded and tried to parse content from the network, and crashed when that failed. In kernel mode.

Honestly it’s probably good that this happened, because presumably someone malicious could use this level of broken logic to compromise kernel space.

Certainly the trust they put in the safety of parsing content downloaded from the internet makes me wonder about the correctness of their code for reading data from userspace.
Later down thread, this bit honestly reads like a threat.

> The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
Apple also 100% controls their hardware, so they can afford to do away with third-party kernel extensions.
Or.... "The amount of abuse within the [phone manufacturing, shoe manufacturing, textile manufacturing, palm oil harvesting, lithium mining, etc.] industry is immense. Anyone with any decent of ethics would refrain from consuming these products."
I use KOReader to read epubs on Android, but not PDFs. Being geared towards eink devices, KOReader lacks the smooth panning+zooming one would typically expect in an Android PDF reader. I've settled on using Bubble2 when I need to read a PDF, though I'd prefer to use my laptop when possible.
Keep in mind that this was probably a data file, not necessarily a code file.

It's possible that they run tests on new commits, but not when some other, external, non-git system pushes out new data.

Team A thinks that "obviously the driver developers are going to write it defensively and protect it against malformed data", team B thinks "obviously all this data comes from us, so we never have to worry about it being malformed"

I don't have any non-public info about what actually happened, but something along these lines seems to be the most likely hypothesis to me.

Edit: Now what would have helped here is a "staged rollout" process with some telemetry. Push the update to 0.01% of your users and solicit acknowledgments after 15 minutes. If the vast majority of systems are still alive and haven't been restarted, keep increasing the threshold. If, at any point, too many of the updated systems stop responding or indicate a failure, immediately stop the rollout, page your on-call engineers and give them a one-click process to completely roll the update back, even for already-updated clients.

This is exactly the kind of issue that non-invasive, completely anonymous, opt-out telemetry would have solved.
There is no nuance needed - this is a giant corporation that sells kernel layer intermediation at global scale. You better be spending billions on bulletproof deployment automation because *waves hands around in the air pointing at whats happening just like with solarwinds*

Bottom line this was avoidable and negligent

For the record I owned global infrastructure as CTO for the USAF Air Operations weapons system - one of the largest multi-classification networked IT systems ever created for the DoD - even moreso during a multi-region refactor as a HQE hire into the AF

So I don’t have any patience for millionaires not putting the work in when it’s critical infrastructure

People need to do better and we need accountability for people making bad decisions for money saving
Thank you, I'm quickly becoming tired of HN posters assuming they know how hospitals operate and asking why we didn't just use Linux.
I agree that it's not an unqualified win. If sites block passkey apps that allow exporting unencrypted passkeys, that probably will prevent some accidental passkey leaks.

It's just that it's not an unqualified win to allow sites to block passkey apps either. If we allow that, we can get to a place where sites block apps for the wrong reason, or it becomes more expensive to develop passkey apps so there is less competition for secure passkey apps.

It's not just whether it's a good idea to allow unencrypted exports. It's whether it's a good idea to give websites a say in how we manage credentials.
For sure, no question! There's a reason people choose Microsoft. My question was narrower, just the question on reliability (hence "all else being equal"). I don't think you can say that, leaving aside issues like this, that Windows is as or more reliable than Linux.

For instance, if you had to make deploy a mission critical server, assuming cost and other software was the same, would you choose Linux or Windows for reliability? Of course you would choose Linux.
Security software needs kernel level access.. *on Windows. macOS has an Endpoint Security userland extension api
Faking Figma's missing on scroll event using mouse in and a cursor tracking hack
such stupidity. our $$$ corporate geniuses mandate multiple so-called security software which is:

- unaccountable black boxes

- of questionable, and un-auditable, quality

- requires kernel modules, drivers, LocalSystem, root access, etc.

- updates at random times with no testing

- download these updates from where? and immediately trust and run that code at high privilege. using unaccountable-black-box crypto to secure it.

- all have known patterns of bad performance, bugs, and generally poor quality

all in the name of security. let's buy multiple "solutions" and widely deploy them to protect us from one boogeyman, or at least the shiny advertisements say. while punching all sorts of serious other holes in security. why even look for a Windows ZeroDay when we can look for a McAfee or Crowdstrike zero day?
Scientists develop new technique for bespoke optical tweezers
Just remember that the liberty was of the government to tax people for military spending.

Or that Security Monitoring is well established field that has actually given a lot of results in preventing various attacks.
Tell that to the person who said that it doesn't apply to those who were not wrongfully convicted, using those exact words, not the person who is providing authoritative references stating that it does.
> how much are GenAI companies willing to invest to get eyeball reflections right

This isn't how it works. As the models are improved, they learn more about reality largely on their own. Except for glaringly obvious problems (like hands, deformed limbs, etc) the improvements are really just giving the models techniques for more accurately replicating features from reasoning data. There's nobody that's like "today we're working on fingernails" or "today we're making hair physics work better": it's about making the model understand and replicate the features already present in the training dataset.
> Don't think LLM itself will ever be able to out compete competent human + LLM

Perhaps, perhaps not. The best performing chess AI, are not improved by having a human team up with them. The best performing Go AI, not yet.

LLMs are the new hotness in a fast-moving field, and LLMs may well get replaced next year by something that can't reasonably be described with those initials. But if they don't, then how far can the current Transformer style stuff go? They're already on-par with university students in many subjects just by themselves, which is something I have to keep repeating because I've still not properly internalised it. I don't know their upper limits, and I don't think anyone really does.
> A build has to pass that and then get rolled into dogfooding usage internally for a while. And then very slowly gets pushed to customers, with monitoring that nothing seems to be regressing.

That doesn't work in the business they're in. They need to roll out definition updates quickly. Their clients won't be happy if they get compromised while CrowdStrike was still doing the dogfooding or phased rollout of the update that would've prevented it.
The problem you’re fighting is cheat customers who go “random kernel-level driver? no problem!”
30-year mystery surrounding Microsoft's Blue Screen of Death
We can adapt. There's already invite-only and semi-closed online communities. If the "mainstream" web becomes AI-flooded, where you'd you like to hang out / get information: the mainstream AI sludge, or the curated human communities?
That's a pretty broad brush.
this is mainly to prolong time on site / impressions that can be served. of course 98% of the banners on those pages are served by doubleclick (google) and thus google makes more money, the crappier the page.
PH purged all unverified content a few years ago and focuses more on creators like Twitch or YouTube does. You have paid memberships, premium content, tipping, and ads. They even do a pretty good revenue share. It's not the PH of the 2000s.

Their parent company, MindGeek, also owns at least 5+ studios themselves including popular ones like Brazzers so it works as promotion/marketing as well.
> So the server must render the 3d world from each players perspective to do these tests?

Just some raycasts through the geometry should be sufficient, which the server is already doing (albeit on likely-simplified collision meshes) constantly.

If you really do have a scenario where occlusion noticeably depends on more of the rendering pipeline (a window that switches between opaque and transparent based on a GPU shader?) you could just treat it as always transparent for occlusion checking and accept the tiny loss that wallhackers will be able to see through it, or add code to simulate that server-side and change the occlusion geometry accordingly.
This is very elegant. I’ve had my share of nasty system bugs ( compilers and kernels ) , but the dedication and the speed with which he went through it is quite remarkable.

The explanations are also very clear. Thanks for posting.
For sci-fi fans, Stephen Baxter wrote a very cool short story about possible Venetian life. It's part of this collection, and I don't particularly want to spoil anything about it: https://isfdb.org/cgi-bin/pl.cgi?332397
The Flammarion Engraving
Time to get rich off the Beale ciphers…
I can't wait to see malware which downloads and runs LLMs on remote C&C server command.
The question is, why do lifts require internet connection on top of the rest.
I am not defending of excusing anything. I am saying there is not enough information to make a judgement one way or the other. Right now, we have almost zero technical details.

Call me old-fashioned and boring, but I'd like to have some basic facts about the situation first. After this I decide who does and doesn't deserve a bollocking.
from that link about the Bangladesh genocide (wow, I never heard of this):

> Pakistan's imams declared Bengali Hindu women to be "war booty”;[11][12] and Pakistani fatwa were issued legitimizing Bengali Hindu women as spoils of war.[12][13] Women who were targeted often died in Pakistani captivity or committed suicide, while others fled to India.

This is based on a non-contextual reading of Quran 4:24, Quran 8:69, Quran 23:5-6:, Quran 33:50 and various hadiths, which continue to be taken literally (when it is convenient to do so) by belligerents, hundreds of years after they were written. I refuse to cite them here because they are offensive to humanitarian/modern ethical worldviews (and because I do not wish to play a game of moral relativism).
A driver that crashes with bad input is not “fine.” Bad design, bad configuration loading and crap input validation. Did they even fuzz the code?

We’d spend 20x development time on kernel code because BSOD is never an option.

I get that this was a bad release - but IMHO it’s incredible that they pushed this out to a billion devices before the red flags went up.
She is living in the future. Way to go.
> The last several decades of attacking wealth redistribution has created the inequality

This isn't true on the face of it. Redistribution wouldn't be on the populist agenda if inequality didn't exist. It's like saying that anti-vax people created the disease in the first place.
Nope, I have seen software like Crowdstrike, S1, Huntress and Defender E5 stop active ransomware attacks.
I think we can all agree about the evil of the adtech ecosystem. But what do you have against dogs?
Not an excuse - they should be testing for this exact thing - but Crowdstrike (and many similar security tools) have a separation between "signature updates" and "agent/code" updates. My (limited) reading of this situation is that this as a update of their "data" not the application. Now apparently the dynamic update included operating code, just just something the equivalent of a yaml file or whatever, but I can see how different kinds of changes like this go through different pipelines. Of course, that is all the more reason to ensure you have integration coverage.
> If you select the sane option ("other"), you get to explain to technically inept bean counters why you did so.

Tell them it’s for preserving diversity in the field.
Of course the OS matters! Windows is a nasty ball of patches in order to maintain backward compatibility with the 80s. Linux and OSX don't have to maintain all the nasty hacks to keep this backward compatibility.

Also, Crowdstrike is a security (patch) company because Windows security sucks to the point they have, by default, real-time virus protection running constantly (runs my CPU white hot for half the day, can you imagine the global impact on the environment?!).

It's so bad on security that its given birth to a whole industry to fix it i.e. Crowdstrike. Every time I pass a bluescreen in a train station or advertisement I'd like "hA! you deserve that for choosing Windows".
I feel like this is the fake reason given to try to hide the obvious reason: automatic updates are a power move that allows companies to retain control of products they've sold.
maybe there’s a firefox extension you could use that when you set the default file opener it works like that? or drag and drop it on firefox with an extension.
Ad blockers, 30-40% of internet users. getting traffic... if it was that easy everyone would do it, and diminishing returns.