skysight-inc/HackerNews huggingface dataset:
The whole point of software like this is a regulatory box-ticking exercise, no-one wants it to actually do anything except satisfy the regulator. Crowdstrike had less overhead and (until now) outages than its competitors, and the regulators were willing to tick the box, so of course people picked them. There are bad cases of people following the herd where there are other solutions with actually better functionality, but this isn't that.
LLM-powered library for querying structured data using natural language
Hey devs,
With my R&D team, I wanted to introduce you to db-ally, an LLM-powered open-source library for querying structured data using natural language.

Why we built it
When working on various projects at deepsense.ai (we're part of the org), we often needed a way to fetch data from databases using natural language queries. The traditional text-to-SQL approach was powerful but failed at understanding domain-specific queries and usually yielded inconsistent results. So, we built db-ally to streamline this process and simplify data retrieval with natural language queries. By defining specific use cases, db-ally makes querying efficient, predictable, and easy to manage.

Asking for feedback
As this is an R&D project, we’re keen to hear your thoughts and feedback. Give db-ally a try and let us know how it works for you. How are you currently handling natural language queries to your databases? What challenges have you faced?

You can find the documentation and repo on GitHub: https://github.com/deepsense-ai/db-ally

We’re looking forward to your insights on what would be most useful for you as we develop it further to meet your needs.

Looking forward to your feedback.
The dreaded exposed loopback interface... I'm an (internal) auditor, and I see huge variations in competence. Not sure what to do about it, since most technical people don't want to be in an auditor role.
As the article points out:

> Meta's issue isn't with the still-being-finalized AI Act, but rather with how it can train models using data from European customers while complying with GDPR — the EU's existing data protection law.
Well, it seems that Windows is not yet accessible remotely when it crashes.

If system administrator had too much free time, and configured every system to probe network on booting, and there is no encryption, it is possible to boot from a minimal Linux image with a script that automatically renames the driver and restarts.

The corporate version of the same approach uses Intel AMT (or however else it is called), but it is only available on licensed hardware from big suppliers.

Otherwise, you can distribute flash drives with the same auto-executing fix to everyone who is able to enter firmware setup, and boot from USB. If it's not available for security reasons, more manual work is required.

But what happens next? If Crowdstrike handled all the security measures, and there was no additional firewall rules, address checks, and so on, your network is now as open as it can be. I suppose certain groups have been celebrating, and uploading gigabytes of data from networks whose detection systems became severed.
Thanks for the reply. I thought as much but just wanted to confirm.

I was initially thinking about whether it would be worth doing the parsing but after reconsidering I think that wouldn't actually add anything.

Thanks!
That would make sense but it appears everyone is doing EBS snapshots in our regions like mad so they aren't restoring. Spoke to our AWS account manager (we are a big big big org) and they have contention issues everywhere.

I really want our cages, C7000's and VMware back at this point.
I'm seeing several reports of things like being unable to buy tickets for the train on-line in Belgium.

They use Windows as a part of their server infrastructure?
Great suggestion! I’ve noted this issue and will work on improving the interaction.

For faces, enabling the "Enhance Portrait" option will yield better results.

However, the effect on your image isn't very noticeable even with the option enabled. I've tested other faces and observed a significant improvement with the option turned on. I'm currently unsure where the difference might be.
I guess a canary rollout of the Crowdstrike patch would have contained the impact of this.
There's Alexandria(https://github.com/btpf/Alexandria), which was inspired by Foliate and supports Windows and MacOS.
> St Petersburg is beautiful and quite lovely.

You've been to the city center. The outskirts are dull even by Russian standards. Because of the soil there, they tend to build high-rise residential buildings spaced by 500m to 1km. Streets run in-between, there are occasional malls and that's it.
MS Windows Recovery screen (or the OS installer disk) might ask you for the recovery key only, but you can unlock the drive manually with the password as well! I had to do that a week ago after a disk clone gone wrong, so in case someone steps on the same issue (this here is tested with Win 10, but it should be just the same for W11 and Server):

1. Boot the affected machine from the Windows installer disk

2. Use "Repair options"

3. Click through to the option to spawn a shell

4. It will now ask you for unlocking the disk with a recovery key. SKIP THAT.

5. In the shell, type: "manage-bde -unlock C: -Password", enter the password

6. The drive is unlocked, now go and execute whatever recovery you have to do.

Good luck.
Yup! OpenAI's best public English-language text model to date is GPT-4, which came out more than a year ago, March '23.

But this hasn't just held for GPT-4, it's also the case for GPT-3.5 turbo, where I'd say the difference is even bigger! 0301 was the strongest (March 2023). Then we got 0613 (June 2023) and 1106 (November 2023), both significantly worse than 0301.

It's always fun to see on e.g. Reddit, ChatGPT users discussing whether GPT is getting worse or not, with clear "for" and "against" camps. To any production user that has done 1:1 comparisons, it's clear as day. Par for the course for Altman to go for this approach though, it's clear he'll do anything it takes. Taking a page out of the Tesla "FSM in 20XX " playbook of blatant lying to sell a product.

Note: For vision input, things have in fact been getting better. 4-o clearly beats the initial gpt-4-vision.
Nah, more like your security/usability/reliability tradeoff needs to be better.
> but is enormously expensive to write and modify.

We're talking about critical software. If we can't afford to reach the level of safety needed because it's too expensive, well so be it.

Besides, the enormously expensive flight systems don't seem to make my plane ticket expensive at all...
You should try Vinia Traian[1] then, It's very close to the Gagauzia autonomous region, located in the Valul lui Traian PGI[2]. Also anything from Slobozia Mare: Domeniile Davidescu, Vinaria din Vale. They also have Saperavi, a Gerogian grape variety. A popular Moldovan variety is Rara Neagra but you should be careful not to consume it alone without meat or cheese because it's an older variety, it's more acidic and might cause stomach burns if you drink anything in excess of several glasses. In Romania it's called Babeasca Nagra and in Ukraine it's known as Sereksiya. Purcari has a wine called Freedom Blend consisting of Saperavi, Rara Neagra and Bastrado, an Ukrainian variety. The name is obviously a pun.

1. https://www.viniatraian.md/
2. https://wineofmoldova.com/en/valul-lui-traian-pgi-region/
Do not discount the cynic. I persist. Here is my question, for example. How would Apple and its ecosystem have evolved differently if they never adopted Objective-C? Would it be possible to accomplish everything with C and better tooling?
Thai bananas taste at least 3 times as good as regular Cavendish. A much stronger fruity flavor
There is an enormous cost associated with the kind of redundancy you're talking about. Capitalism prevents us from being set up in the way you're describing. Why invest in company A if company B can run the same business with half the operational expenses? Shareholder profit above all.
Absolutely correct. Unfortunately, there is no other solution to this issue. If the laptops were powered down overnight, there might be a stroke of luck. However, this will be one of the most challenging recoveries in IT history, making it a highly unpleasant experience.
You're giving a third-party company remote admin access to all your systems (by their ability to push their own code updates to your systems).
Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
If CrowdStrike can cause this with a faulty update (allegedly), what do you think could happen to Western infrastructure from a full blown cyberwar? It's a valid risk.

> Society was able to move to mass WFH on a global scale in a single month during Covid

I don't know how much WFH saved lives, seeing as ordered isolation and social distancing was a thing during the Spanish Flu too (you just take the economic hit). But yes it allowed companies to keep maintaining profits. Those that couldn't WFH got paid in most countries anyway (furlough in England, etc).

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2862334/
Great suggestion! I plan to add an option to purchase credits separately, which can be used indefinitely once bought. I'll release this feature as soon as it's developed.
> Also explains why Apple isn’t launching in EU

I don't buy it. From the AI act:

> Generative AI, like ChatGPT, will not be classified as high-risk, but will have to comply with transparency requirements and EU copyright law:

> Disclosing that the content was generated by AI
Designing the model to prevent it from generating illegal content
Publishing summaries of copyrighted data used for training

> High-impact general-purpose AI models that might pose systemic risk, such as the more advanced AI model GPT-4, would have to undergo thorough evaluations and any serious incidents would have to be reported to the European Commission.

> Content that is either generated or modified with the help of AI - images, audio or video files (for example deepfakes) - need to be clearly labelled as AI generated so that users are aware when they come across such content.

https://www.europarl.europa.eu/topics/en/article/20230601STO...

Seems reasonable to me. My theory is that they are still salty about the DMA, so that's the payback.
> "62 minutes could bring your business down"

> I guess they could bring all the businesses down much quicker.

It is because the buyer does not get the message. And, when they get it, it is too late.
Plot twist: The * in C-00000291*.sys is "-block-ultron"

Premature deployment of Crowdstrike AGI disaster response plan.
#KraftPaperMill
Net width: 3800mm
Gram weight: 110–200gsm
Daily output: 150tpd
Welcome to send email or tell me your email to know about the price and details.
#WhatsApp: +86 13526684099
#Email: whiteboardpapermachine@gmail.com
https://pulppaperpump.com/100-180m-min-kraft-liner-board-mac...
[dupe] https://news.ycombinator.com/item?id=40994597
It depends on your lobbying budget vs. the FTC's budget.
Is GPT Expensive? Global LLM Pricing Table Inside
Seems like the solution is right there. "Your claim was denied because we found and app installed on your device that promotes physical abuse."
All down had no backup plan.
So it exists because nobody has any idea what the execution graph of their programs are, and CS is down because of that too.. Do we really need this level of dynamism in our programs?
See my comment here https://news.ycombinator.com/item?id=41003860
Nobody is telling you to use Java. Although, if you want to revive Singularity that would be pretty neat.
to me at least, hazard pointers and rcu seems to be the major changes, for library authors anyways.

i would actually wager that rcu in and of itself is almost at par with atomics and the memory-model :o)

for folks wondering about 'hazard-pointers' this paper https://web.archive.org/web/20171104135736/http://www.resear... is quite useful as an excellent starting point.
I will try to be more charitable in the future with my interpretations.

But as for mechanism, maybe up/down regulation of sertogenic systems, individual specific conditions (kidney disease, liver disease), etc?

https://www.sciencedirect.com/science/article/abs/pii/S03768...

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6322052/
Their Windows sensor has made development almost unworkable. Not sure why but I haven't noticed the OSX sensor slow things down appreciably. I suspect my Windows profile is configured to be more aggressive?
So booting into safe mode should do the trick right, even if Bitlocker is enabled?
I, as a producer of software, have effectively no control over where it gets used. That's the point.

Outside of regulated industries it's the context in which software is used which determines how critical it is. (As you say.)

So what you seem to be suggesting (effectively) is that use of software be regulated to a greater/lesser extent for all industries... and that just seems completely unworkable.
I find that hilarious
The oligopoly is not a "love affair", that's how IT works: prime mover advantage, "move fast and break things" (the first of them being interoperability), moats, the brittleness of programming...

The whole startup/unicorns ecosystem exists only because there is the possibility of becoming the dominant player in a field within a few years (or being bought out by one of the big players). This "love affair with oligopoly" is the reason why Ycombinator/HN exists.
Glad to hear it's helpful to you!
No one is suggesting it is 100% coverage but you would be suprised at the ammount of things XDR detects and prevents in a average organization with average users. Including the people who can't stop clicking YourGiftcard.pdf.exe
1. This is why kernel modules are a bad idea
2. This is why centralism is a bad idea
3. This is why sacrificing stability for security is a bad idea
4. Security still needs to factor in security of supply - not just data safety
Anthem is my favorite Stephenson book, by far. My copy is the only book I own with a broken binding because I've read it too many times. I don't think that one gets enough attention, especially from a world building and technical perspective.
i've never heard of crowdstrike ever but it (co-)runs half of the essential IT infrastructure, worldwide?

(also, great choice of name i must say)
Their stock price will suffer but they can waive license fees for a year or so for every endpoint affected (~$50).

They better pin this on a rogue employee, but even then, force pushing updates shouldn't be in their capability at all! They must guarantee removal of that capability.

Lawsuits should be interesting. They offer(ed?) $1 mil breach insurance to their customers, so if they were to pay only that much per customer this might be compensation north of $10B. But to be honest, wouldn't surprise me if they can pay up without going bankrupt.

The sad situation is, as twitter people were pointing out, IT teams will use this to push back against more agents for a long time to come. But in reality, these agents are very important.

Crowdstrike Falcon alone is probably the single biggest security improvement any company can make and there is hardly any competition. This could have been any security vendor, the impact is so widespread because of how widely used they are, but there is a reason why they are so widely used to begin with.

Oh and just fyi, the mitigation won't leave you unprotected, when you boot normal, the userspace exe's will replace it with a fixed version.
> Crowdstrike has a linux version

But would it crash the OS?
Ironically some /r/wallstreetbets poster put out an ill-informed “due diligence” post 11 hours ago concerning CrowdStrike being not worth $83 billion and placing puts on the stock.

Everybody took the piss out of them for the post. Now they are quite likely to become very rich.

https://www.reddit.com/r/wallstreetbets/s/jJ6xHewXXp
What has js done
BFMTV, French broadcaster, reports:

"Selon le quotidien The Australian, qui relaie les déclarations du ministère australien des Affaires intérieures, l'entreprise Crowdstrike pourrait être en cause, après avoir été victime d'une brèche au sein de sa plateforme."

Translated/summarized: "According to the publication The Australian, Crowdstrike may be the cause of the outage after having suffered a security breach"

I like how it redirects blame away from those responsible and perpetuates the idea that "hackers" are the real threat.

Source: https://www.bfmtv.com/tech/direct-une-panne-informatique-mon...
FigJam is also something in its own right. Try creating a sequence diagram there. Arrows just randomly have their own behavior of sticking somewhere where they shouldn’t or sometimes just not. You just keep copy-pasting that one arrow that doesn’t misbehave but still you end up with a horribly misaligned diagram.
> this odd pressure against people who might be hesitant to sleep with someone U=U always feels uncomfortable and manipulative to me.

That's because you're a probably a normal and well-adjusted person with no chips on their shoulder.

> I see it a lot around the internet.

If you think the population's attitudes are what is visible to you on the internet, you'd be wrong 100% of the time.

Turns out, shaming people into silence on the internet does not change their minds about anything.
> Calibre works exactly the way you suggest, so I'm not sure why you haven't found it.

JFC, that's not how the installation and the first run of Calibre works at all. I'd write "I'am not sure why you think people would think calibre is first a manager library and not a book reader after installing it" but I'd be lying.
The shocking truth about bread: https://www.independent.co.uk/life-style/food-and-drink/feat...

There's a real bread campaign: https://www.sustainweb.org/realbread/
2000s vibes.
We completed it all at once.
Microsoft Teams really sucks. It's one of the reasons I'm leaving my current company. I can't stand it anymore. We sometimes use a page with WebRTC to communicate to avoid it.

It's so unstable on a Mac, it always breaks, resets my configuration and leave me in bad place during meetings, all while wasting a lot of computing resources.

Maybe get a Windows computer if you want to be less frustrated, but you'll get frustrated by other reasons then.
Going to every system manually, then delete a file via command line in Windows' recovery environment.
>If anyone feels like disagreeing about Azure

Talking with people in the MSFT camp is like talking with people in a cult. I'm not being melodramatic.

Pointing out these issues is good, but to them, they'll just shrug it off.

And businesses will keep giving them money. Madness.
Assuming this event itself isn't malicious, what an excellent POC for something that is. I sure hope every org out there with this level of market reach has good security in place. It's certainly going to be getting some probing after this.
Windows blue screen was never Microsoft's responsibility. /s
.sys files on Windows are typically drivers and driver-related files
It's backdoor as a feature. It even has a cute name - "CrowdStrike Real Time Response".
It's a very high bar
There was a law passed that allows ISPs to block sites that host copyrighted content illegally. It's not just Italy, also the Netherlands and many other countries. You can still access it with a vpn or tor. Tor browser on the phone works fine for mobile carriers that block the sites.
One of the downsides of WFH. How do you contact your IT support via Microsoft Teams when you don’t have your laptop or Microsoft Teams.
I have never seen an on-premise environment down as much as Azure is.
Totally this - one of my concern about the current outbreak is that this outbreak is in prisoners, so men who are kept in closer than normal quarters, increasing the risk of a person to person transmission taking hold.

Hopeful that this fizzles out and we can worry about something else next year, but there seems like a good chance that we are now just waiting for this to spread between humans, and it appears bird flu is going no-where.
worded badly whatever
Perverse Effects in Defense of Computer Systems: When More Is Less (2013) [pdf]
Haha, unfortunately, you guessed wrong—it’s not Stable Diffusion.
No, the userspace program will replace it with a good version.
I assume this is irony, since isn’t Crowdstrike exactly that these days?
How would you install it without them distributing it?
At most places there is an iPad app that does the calculation locally. So it's mostly entering a lot of numbers and checking that the results make sense. Usually both crew members do it individually, and then cross check the results.
And this explains why the (Linux) HPC that I'm using is having so many troubles today, and keeps complaining that I don't exist.
> Gatekeeper is actually just a big back door that gives its programmers (and Devlin's paymasters) access to pretty much everything, since every single company in the world and also the FBI and New York Stock Exchange have been spooked into using it for security

Seems prescient.
I see it's not just the Software development ecosystem that got affected by the cult of Hipsterism.

If I was Alex Jones, I'd go further and blame this on a decade of DEI and fluoride in the water. /s
Yeah in context we have about 1000 remote workers down. We have to call them and talk through each machine because we can't fix them remotely because they are stuck boot looping. A large proportion of these users are non-technical.
Maybe if they got off their "asses" and did some more comprehensive assessments we wouldnt be in theis mess.
I am going to stop saying this but people don't realize CS has an official RCE as a feature. As in run remote commands as root/admin on windows or linux/mac through their web.
> The data come from a unified Google Analytics account for U.S. federal government agencies known as the Digital Analytics Program.

Well…
We have multiple exits to avoid trapping people in a fire. Redundancy is important when the cost of failure is high.
Easy to state; non-trivial to implement.
Assuming that they also have a regular Bitlocker password, there's hope with a bit manual effort. https://news.ycombinator.com/item?id=41003893
This is the best definition of "Single point of failure" i have ever seen.
> this suggests a different generative-testing approach: generatively inject behavioral perturbations which don't violate equivalence, attempting to provoke failures in client code

There is a compiler fuzzing method called "equivalence modulo inputs" that does something like this. Take a fuzzed program with fixed inputs and profile it to find parts that are never executed. Change only code in those never executed parts. If the original and modified programs behave differently, you found a compiler bug: The compiler got confused by code that it can see but that (unknown to the compiler) cannot dynamically influence the program's behavior on the given inputs.

Like so many things in fuzzing, this sounds silly but actually finds bugs in practice.
A long time ago, I was in Burma. My friends and I were working for the local government. They were trying to buy the loyalty of tribal leaders by bribing them with a tangerine. But their caravans were being raided in a forest north of Rangoon by a bandit. So we went looking for the tangerines. But, in six months, we never met anybody who traded with him. One day, I saw a child playing with a tangerine the size of a ruby. The bandit had been throwing them away. Some men aren’t looking for anything logical, like money. They can’t be bought, bullied, reasoned or negotiated with. Some men just want a tangerine.
Why wouldn't it? This particular bug wouldn't, but another one...
Log into hypervisor, rollback VM