skysight-inc/HackerNews huggingface dataset:
Well the RP2040 was released over 3 years ago... there have already been many interesting things that have been built with the capabilities. I wouldn't call this just the beginning.
Mass IT Outage: List of Companies and Operations Affected
Sounds like your employer has better auditing processes than most places.
It's not an "app", it's a kernel driver. A serious driver bug is catastrophic in nearly any OS.
Indeed and insurance too. For our business, our professional errors and omissions coverage for years had the ability to cover cyber issues. No more. That requires cybersecurity insurance and the underwriters will not entertain underwriting a policy unless EDR is in place. They don't care if you are running OpenBSD and are an expert in cybersecurity who testifies in court cases or none of that. EDR from our list or no insurance.
I agree; this is my experience too, I've known so many people just like you describe; it describes all the "best" neighborhoods in places like Tulsa, Oklahoma.

And that is why we're in no hurry to buy into that kind of neighborhood and don't see it as any better than decent inner city neighborhood -- in fact, based on experience the education is better in some Philly public schools than some Nice White Rich Suburb schools (although the food and the A/C sure ain't, but that's not what school is for), and the values is why.

That said I spent part of my childhood in Princeton, NJ and that is one sort of "white suburb" that breaks that pattern and actually seriously emphasizes education. Unfortunately the truly nice places like that are truly expensive. Although, to your point... Princeton had a huge Asian and Indian population, and plenty of the white kids had parents who were Princeton professors and such -- not a very common or average job, even among other people of the same race, class, and income.

Perhaps I just need to find an affordable very Asian suburb, somewhere near an H-Mart or something?
It is supposed to be like that.

Antivirus software always works as a driver in the kernel, no other way. You'll get the same in Linux, for example. In MacOS it may be slightly better (if I remember right Darwin is a micro-kernel), but in fact a broken driver still can crash the system there.
The problem is that Bach's ideas will never progress any further. That's sort of sad.
It is. The employee work emails are @yandex-team.ru
True, and they can be very rude about it ;(
> In the real world, "computer security" is a profession full of hucksters

Always has been. The information security model is about analogizing digital systems as physical systems, and employing the analogues of those physical controls that date back hundreds of years on those digital systems. At no point, in my relatively long career, have I ever met anyone in Information Security who actually understands at depth anything about how to secure digital systems. I say this as someone who has spent a lot of my career trying to do information security correctly, but from the perspective of operations and software engineering, which is where it must start.

The entire information security model the world works with is tacking on security after the fact, thinking you need to builds walls and a vault door to protect the room after the house has already been built, when in fact you need to build the house to be secure from the start because attacks don't go through doors, attacks are airborne (I recognize the irony of my analogizing digital concepts to physical concepts surrounding security, but I do it because of any infosec people that may read my comment so they can understand my point).

Because of this model, we have gone from buying "boxes" to buying "services", but it has never matured away from the box-checking exercise it's been since day one. In fact, many information security people have /no training or education/ in security, it's entirely in regulatory compliance.
So it's "the guy" who's job was to make and enforce "the process", got it.
What you described is not a “CD” procedure. Lack of precision around such terms is part of the problem here.
It's a very sensible question. The real Q being asked is:

Is greatness about skill, or about getting lucky (right place at the right time)?

and that question is really:

Do I matter? Do my feelings (which feel so real to me) affect the outside world?
Oh, yeah, hence the "maybe". I've never heard "vodka" used as a generic term for alcoholic liquids anywhere except in Poland, and even there rather rarely.
At a former employer of about 15K employees, two tools come to mind that allowed us to do this on every Windows host on our network[0].

It's an absolute necessity: you can manage Windows updates and a limited set of other updates via things like WSUS. Back when I was at this employer, Adobe Flash and Java plug-in attacks were our largest source of infection. The only way to reliably get those updates installed was to configure everything to run the installer if an old version was detected, and then find some other ways to get it to run.

To do this, we'd often resort to scripts/custom apps just to detect the installation correctly. Too often a machine would be vulnerable but something would keep it from showing up on various tools that limit checks to "Add/Remove Programs" entries or other mechanisms that might let a browser plug-in slip through, so we'd resort various methods all the way down to "inspecting the drive directory-by-directory" to find offending libraries.

We used a similar capability all the way back in the NIMDA days to deploy an in-house removal tool[1]

[0] Symantec Endpoint Protection and System Center Configuration Manager

[1] I worked at a large telecom at that time -- our IPS devices crashed our monitoring tool when the malware that immediately followed NIMDA landed. The result was a coworker and I dissecting/containing it and providing the findings to Trend Micro (our A/V vendor at the time) maybe 30 minutes before the news started breaking and several hours before they had anything that could detect it on their end.
There are so many english centric assumptions here.

Regulation of liability can be very generic and broad, with open standards that dont need to be updated.

Case in point: Most of continental Europe still uses Napoleon's code civile to prescribe how and when private parties are liable. This is more than 150 years old.

The real issue is that most Americans are stuck with an old English regulatory system, which for fear of overreach was never modernized.
If lightsail was comparable Webflow wouldn't have a business. It's like saying a Bentley and a lawnmover are the same because they both require fuel.

The segmentation is, and has always been, based not on underlying costs, but on an understanding of what the segment can bear.
What's your suggestion for fixing broken regulations? Not having any? That is also "broken".
It passed the type checker!
These decisions ruin families all so a small group of elites can profit.

I do wish there was an easy way when things like this happen to immediately say, "if you are happy with this FCC decision, here are the politicians responsible, the FCC directors and employees that did nothing for decades, etc." and then we can deny-list those people and their families from polite society.
I remember when I first went to jail in 2013, every month paying for a $20 phone card and getting to make a 25 minute "long-distance" call. I couldn't believe that this was legal, and even if it was, I was in disbelief that morally, this was allowed to go on.
There are so many other similarities in corrections that my family and I would unfortunately go on to discover over the years, things that until you experience them firsthand, either by yourself or a loved one being incarcerated, that you likely wouldn't believe.
"We give you no guarantees, unless the local law says we have to give them to you, in which case we do."

So they might get sued on a local level?
> So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself.

TIL that US government has pressured foreign nations to install a mystery blob in the kernel of machines that run critical software "for compliance".

If this wasn't a providential goof on the part of Crowdstrike -- the entire planet is now aware of this little known fact -- then some helpful soul in Crowdstrike has given us a heads-up.
If they're a part of EU, EEA, or EFTA, then yes.
Because the punative system in most countries doesn't affect individuals. As a manager, you're not going to jail for breaking environmental laws, a different entity (the company) is paying for being caught. So, it's still the rational thing to do to break the environment laws to make your groups numbers go up and get a promo or bonus.
Those early diffusion generators sure managed to make the flesh monster in The Witcher look sane sometimes.
Yeah it could be very well possible that it wasn't limited to just 3 tries back then, or at the very least the ATM would not block and eat the card then, allowing you to try again or at a different machine.
Where I work we use a combination of lightly customized tools out of the box (Jira, Jenkins, ...) as well as full custom applications such as the editor that our data team uses to maintain our database which is a React app like our customer-facing app.

I also have a number of personal tools such as a Python program that (most of the time) can automatically merge changes to the maven and npm projects I work on, apply liquibase changes to the database and build and test everything plus keep track of branches and stuff so I can sync up most mornings and not have to think about and not make silly mistakes with git and pull requests.

I've worked at places where it took 20 seconds for JIRA to load the page for creating a new ticket but I'm 100% delighted with our JIRA installation. I might have complained about tooling before I built my "maintenance droid" but now I won't. I know the data team and marketing people like our editor (e.g. they use it to manage customer subscriptions)

With control over our internal systems it's easy for us to innovate. For instance we are developing generative AI tools that work together with our data team to speed up OCRing data on paper and getting it up to our standards. You can use all kind of API integrations with prebuilt tools, for instance I use ticket numbers all the time when I discuss my work in Slack and it's not hard to write a program that looks at a year of standup messages in Slack and what is in JIRA to write the beginnings of my performance review.

What I'm not getting about retool is this: it looks like a "low code" or "no code" platform that is intended for internal tools, what stops you from using the same tool for both internal and customer facing applications?
> computers are a very important form of technology. Without it no websites, no Roblox studio, and no nothin. Without computers used have to use tablets. Tablets aren't very useful. Well to do stuff Computers can anyway.

Amen.
> I understand that one of the big issues with microLED is huge brightness variation between pixels. Due to some kind of uncontrollable (so far) variations in the manufacturing process, some pixels output 1/10 the light (or less) as others.

I instead understand that this is false. Available MicroLED screens (TVs) are in fact brighter than normal screens.

The issue with MicroLED is instead that they are extremely expensive to produce, as the article points out, due to the required mass transfer. Polychromatic LEDs would simplify this process greatly.
LLVM can bisect down to individual transformation steps within a pass (for passes that implement the interface): https://llvm.org/docs/OptBisect.html

And there is a script bisecting functions when given assembly produced by working baseline and “bad” compiler to compare: https://github.com/llvm/llvm-project/blob/main/llvm/utils/ab...
when would you use this program?

Editing a text file with includeIf is probably easier than some huge gui tool

[includeIf "gitdir:~/code/"]
path = ~/.gitconfig.d/personal
I complained specifically about that and they bounced it back to me like this was safe and cannot use the machine as I want.
It's like asking, why they don't paint like Caravaggio or sculpt like Michelangelo. There is a reason why these pieces of art are called classical. The same goes with classical literature. They don't write like Plato.
I recently took Wharton's Online Behavioral Economics course by Prof. Kessler. It was my first exposure to this topic, and I really enjoyed his teaching style. The content is supported by references to recent published papers and real-world use cases, which helped bridge the gap between theory and practice. The program is not cheap, it costs around $2600, but I found it to be worth the value.
Well, in all times usually there has been the option to run a local proxy/cache for your updates so that you can properly test them inside your own organization before rolling them out to all your clients (precisely to avoid this kind of shit show). But doing that requires an internal team running it and actually testing all updates. But modern organizations don't want an IT-department, they want to be "cloud first". So they rely on services that promise they can solve everything for them (until they don't).

Cloud is not just about where things are – it's also about the idea that you can outsource every single piece of responsibility to a intangible vendor somewhere on the other side of the globe – or "in the cloud".
It doesn't look like they're sending a huge bill for overages. They're sending a warning letter to get them to switch plans or risk being terminated as a customer. Adding a throttle/quota wouldn't have really made a difference here, as the guy seems to be more upset at how much the new plan would cost.
40-100 euros return for not that short trips. That is only slightly more than 160km train rides here...
It's not like corporate executives have carte blanche to make these decisions. They report to the board, who represent the shareholders, to whom they have a legal duty to maximize profits. The entire construct is set up to promote the alternative to building the next Bell Labs.
I mean they essentially allowed slavery to exist for prisoners with the 13th amendment [1] -- Americans seem to view the prison system as anything goes punishment instead of rehabilitation:

[1] "Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction."
No doubt there will be another piece of software mandated to check up on the compliance software. When that causes a global IT outage, software that checks up on the software that checks up on the compliance software will be mandated.
I think the main difference between the two is, as someone reading and debugging the code, will probably eventually check even those methods that I assume I know roughly what they do. In contrast, I may not even think to check an overloaded operator unless I _already know_ that it's overloaded.

Maybe a good analogous method would be an overloaded `.ToString()` in C# that has side effects or returns the full text of the Magna Carta or something.
Interesting that they push updates on a Friday when support profile will be way different across companies and organizations during that time.
I think they have such dense configurations that they have actual doors. So no worries there...
They've had these forever. They're just not always on the shelves (but nothing is).

These meals also don't seem all that nutritious. A lot of the entrees are high in carbs but low in proteins and fats (affecting satiety and probably long term muscle mass that you'd need to fight off the zombies). Also not sure about their micronutrient profiles. Doesn't matter for 10 days but hard to survive long term with.

Something like Huel or Soylent offers way more consistent meal to meal nutrition for a little more money (double the price per serving, around $4 instead of $2). Not sure about the shelf life though.

Your local food co-op probably also sells bulk dehydrated hearty soups and meal mixes in powder form. Or get MREs from military surplus stores.
> What does perfect mean?

Nothing out of focus or less detailed than other parts of the image...
How can THIS pass any sane Audit?!

Like, «We require that your employees opens only links on white list, and social networks cannot be put on this list, and we require managed antivirus / firewall solution, but we are Ok that this solution has backdoor directly for 3rd party organization»?

It is crazy. All these PCI DSS and SOC2 looks like a comedy if they allow such things.
They did go down! https://www.reddit.com/r/formula1/comments/1e71dtn/mercedes_...

But someone probably fixed it, and the cars were able to go out on track for the first practice session.
Reminds me of how Aeroflot, the Russian national airline, would sneak an insurance into your booking at the very last step, even if you skip right past all the additional steps (hotels, car rental, other bullshit) in the sidebar. They would "accidentally" add it to your order and you have to actively click "remove" to not throw several hundred rubles away. It's almost like they know that no person in their right mind would buy their "insurance for the duration of flight" so they have to push it like that because someone worked hard for that partnership.
Why the fuck didn't MSFT just do blue/green canarying? No update should be rolled out to a billion devices at once until it's baked in a million devices for a bit, and that only after baking in 10,000 devices for a bit.
CrowdStrike CEO is former McAfee CTO; they caused a similar PC meltdown in 2010
If you have a 48 hour window on updating definitions, your machines all have 48 extra hours they are vulnerable to 0-days.
Interesting. To me music is a form of communication. So then obviously I care about who’s on the other side. I guess how people perceive this is quite subjective.
Depends. I'm at an EMR maker; our Windows machines (as well of those of our clients - read: hospitals and doctors offices) are down. That is, of course, bad for the patients under their care.

Do these clients have SLAs? If so, they're definitely on the hook for something. You could probably get a few businesses together for a decent class-action against Crowdstrike. You're then expecting a lawyer to be able to convince a dozen semi-random people with varying degrees of computer knowledge that Crowdstrike's software was negligently designed, developed, and deployed in a way that caused financial or life losses for customers.

So, really, it's a coin flip.
It is important to remember that removing the Chevron defense is not some unknown situation we've never seen before. It is a return to the status quo from before that case, and that was not a situation where every last regulation was instantly tied up in litigation on the theory that when Congress said "set just and reasonable price limits on prisoner comms" they actually meant "do nothing unless every sentence from the regulatory agency has been reviewed by the Supreme Court". The higher courts are all rate-limited by their time and after an initial burst of relitigation on the limits of regulation, we're going to settle into a status quo where federal agencies still have reasonable abilities to implement Congressional dictates, because the higher courts are going to start to refuse to hear cases that are clearly just "industry does not like being regulated in clear compliance with Congressional mandate".

A prison telco can bring any suit they like, but it's not like the removal of the Chevron defense requires the court to accept the case and laboriously work out an exact definition just because the prison telco wants them to. Courts aren't going to want to do this, especially the higher ones.
Genuine question: How the heck crapeware like CloudStrike got into all critical systems from 911 to hospitals to airlines? My understanding was that all these critical systems are just super lazy to upgrade or install anything at all. I would love to know all the sales tactics CS used to get into millions of systems for money!
In addition to the problems you mentioned, biometric systems are basically designed to cause hash collisions. And probably to a higher degree than most people realize.

After all, it would be annoying if FaceID failed just because I haven’t shaved today. So the algorithm has to account for that. As such, the entropy of the input is reduced.
https://www.dropboxforum.com/t5/Apps-and-Installations/New-D...

Is this happening with or without kernel extensions?
Or shortly after
If olive oil was all I had left to eat, I think I'd rather smash my head with the bottle and then slit my wrists with the shards...
> Though I'm not sure how we'd build a jail cell for an entire company.

Same thing with AI. You can't punish an AI, it has no body.
This entire thing is not surprising but it's fascinating to see unfold. In many dimensions, even listening to the wild speculation or weird reporting around it.
Putting aside the semantic swamp of figuring out what an app actually refers to, this seems to be exactly the problem. They should have their signing keys revoked.
Bell Labs did use UNIX, C and C++, otherwise we would be luckly using safer environments.
PayPal once quietly added my European card (EUR zone) as USD. And when I paid for a product in EUR, it "thoughtfully" (for them) converted the amount twice using their special currency exchange rate.

You can't do without airports and airlines, but why PayPal still exists in 2024 - I don't understand.
Mainly because he has intuitions that are wrong. And as a result he is asking to do things like 'hire 10 offshore developers for less than an intern' or 'because the job market is so bad we should be able to hire google engineers for intern level pay'.

Basically lots of free lunch thinking because he doesn't have as much context on the trade offs. Our project is a pretty basic java application. FAANG engineers are totally overqualified to work on it. The scope is relatively constrained so 10 engineers would be too many cooks in the kitchen.

He doesn't need to know git or rails or anything like that. I got him the Mythical Man month as some people recommended.
Nobody is going to learn all the laws of a country. When the laws/custom of a country are so different than yours that a trivially legal act in your country becomes highly illegal in that country you should avoid that country because who knows what else you'll do that'll get you into trouble.
It's not the only one doing this.

It almost feels like a final squeeze before some kind of collapse.
> George_Kurtz, President & CEO CrowdStrike, Former CTO of McAfee

https://x.com/George_Kurtz

https://www.linkedin.com/in/georgekurtz

Déjà vu?
I came to HN hoping to find more technical info on the issue, and with hundreds of comments yours is the first I found with something of interest, so thanks! Too bad there's no way to upvote it to the top.
Nguyen Phu Trong, Powerful Vietnamese Leader, Is Dead at 80
I don't mess with tech stacks, so I immediately jump to the business end of things.

1. Start with a specific goal. What is the thing I want to build and what 1 problem does it solve. Other features can come later.

2. Backwards plan. You generally know what you need to make this 1 thing work and some vague idea of how to organize the pieces. What ever is missing then becomes either a gap or a dependency. If you have written a lot of original software you are in a fantastic place because you can butcher from prior projects.

3. Start with the entry point. In Rust its fn main. As a TypeScript lover I just create some arbitrary file.

4. Build the platform code required by your language. In Rust its a crates file and in Node its a package.json file.

5. Bring in only the dependencies requires to build the minimal code.

6. Get as far as you can before you need additional dependencies.

This is how to get up and running doing real automation as quickly as possible.