skysight-inc/HackerNews huggingface dataset:
It’s not even about the customers.

We used to worry about trackers duplicating and profiling our player base back when we were running multi-billion dollar mobile games. F2P monetization being the long-tail beast it is, you really worry about ad platforms understanding your revenue dynamics. It was actually the managers who were worrying about trackers rather than the other way around.

I don’t know if you can find a similar argument in your industry, but losing the long tail to customer profiling can be a good string to pull.
believe it or not, most users dont run around downloading random screensavers or whatever. Instead they are receiving phish emails, often from trusted contacts who have recently been compromised using the same style of message that they are used to receiving, that give the attacker a foothold on the computer. From there, you can use a commonly available insecure legacy protocol or other privilege escalation technique to gain administrative rights on the device.
AWS has posted some instructions for those affected by the issue using EC2.

[AWS Health Dashboard](https://health.aws.amazon.com/health/status)

"First, in some cases, a reboot of the instance may allow for the CrowdStrike Falcon agent to be updated to a previously healthy version, resolving the issue.

Second, the following steps can be followed to delete the CrowdStrike Falcon agent file on the affected instance:

1. Create a snapshot of the EBS root volume of the affected instance

2. Create a new EBS volume from the snapshot in the same Availability Zone

3. Launch a new instance in that Availability Zone using a different version of Windows

4. Attach the EBS volume from step (2) to the new instance as a data volume

5. Navigate to the \windows\system32\drivers\CrowdStrike\ folder on the attached volume and delete "C-00000291*.sys"

6. Detach the EBS volume from the new instance

7. Create a snapshot of the detached EBS volume

8. Create an AMI from the snapshot by selecting the same volume type as the affected instance

9. Call replace root volume on the original EC2 Instance specifying the AMI just created"
Fair enough, I think the "well-supported" thing is going to be less true over time, as Asahi keeps improving.
Correction: it is generally accepted that DNA was confirmed as genetic material in the Hershey-Chase experiment (https://en.m.wikipedia.org/wiki/Hershey%E2%80%93Chase_experi...), which predates the determination of the structure of dna by about a year
I don't understand the "galaxy" terminology in the sentence: "To measure the shapes of galaxies, we analyse whether they're centrally compact, whether they're symmetric, and how smooth they are"

Can someone explain?
Not sure what material in their post is ill-informed. Looks like what happened today is exactly what that poster warned of in one of their bullet points.
I always wondered if this would get flagged somehow. I've never tried it myself, but I've thought about doing it.

What I was mentioning though is that countries will let you have a second passport from a single country if you have issues like this, to avoid showing the stamps in one passport.
It didn't come from Microsoft or Windows Update. It was pushed by Crowdstrike to their corporate security kernel extension.
Yes, I have no idea why UI practices need to constantly "evolve". As far as I am concerned a lot of UI is getting worse over time so the less evolution the better.
It's all cold sweats, hot flashes, and the urge to vomit when things go wrong.
Yes, but computers get infected by ransomware randomly; Crowdstrike infected large amount of life-critical systems worldwide over some time, and then struck them all down at the same time.
Come to think of it, the worst hangover of my life was on Hvar.

Where I usually go in the Balkans -- Vojvodina area, if that even counts as Balkan -- the homemade stuff isn't that much stronger than the store-bought. Probably a little, but you end up drinking half a liter of the stuff in a good night, so it can't be much over 40.
I saw one of the surgery videos recently. The doctor was saying, "Alexa, turn on suction." It boggled my mind. There could be so many points of failure.
Phillips (the company) basically killed people with malfunctioning CPAP machines (which are meant to help against sleep apnea) and no one went to jail. So that's a practical example.
> Most administrators at large companies are cautious about rolling out new software versions to their employees. They (normally?) test before broad deployment.

In my experience at both a 70,000 company and a 260,000 person company, both of which I can confirm have outages right now, this just isn't the case.

The security vendor says update and sysadmins say "right away", because the institution has learned that "right away" is the only acceptable answer from auditors, both internal and external.

This story is interesting because there's an entire chain of places you can pass the buck and absolve responsibility if you so choose. You could, if you so desired choose to blame:

1. The crowdstrike developer who pushed the change

2. The developer responsible for the kernel bug

3. crowdstrike as a company for not having better change management

4. microsoft for how they handle kernel access

5. system admins for not owning the update process of their entire body of devices

6. security teams / the CISO for operating on checklists that exist to please auditors rather than treating security as a living, breathing problem

7. Auditors for structuring security audits as a checklist rather than treating security as a living, breathing problem

8. Regulators for using one size fits all audits as the preferred method of determining security compliance
Ok what if they sold it off by default but there was a physical switch that could turn it on, that required hardware access?

Good compromise?
Coal-filled trains are likely sending people to the hospital
It's almost as if we're seeing the downsides to our cloud based decisions. Uncontrolled costs, lack of visibility, placing control of critical processes in the hands of other groups...that also have control of critical processes globally.

Am I bitter at losing the business decisions that push ease of management by sending control to service providers? Not really. It's been dozens of times, and I lose every time.

I can raise the concerns to make sure the decisions are educated ones, and then let the decisions be made.
> It auto-updates on boot? From the internet?

Apparently!
Cyber Security is a matter of national security, but currently we sacrifice our national security for the convenience of companies.

The disconnect is that companies are both (1) the only entity in control of their system and how it is tested and (2) not liable if a security breach does happen.

I believe we need to enable red teams (security researchers) to test the security of any system, with or without permission, so long as they report responsibly and avoid obviously destructive behavior such as sustained DDoS attacks.

A branch of the government, possibly of the military (the Space Force?) could constantly be trying to hack the most important systems in our nation (individuals and private companies too). The bad guys are doing this anyway, but hopefully the good guys could find the security holes first and report them responsibly.

Again, currently this doesn't happen because it would be embarrassing and inconvenient for powerful companies. We threaten researchers who do nothing more than press F12 (view HTML source) with jail time and then have our best surprised Pikachu faces ready for when half the nations data is stolen every week or major systems go down. Actually, we don't make faces at all, half the nation's data is stolen every week--no, actually we don't even take notice, we just accept it as the way things have to be. Because, after all, we can't expect companies to be liable, but we can trust companies to have exclusive control over the testing of their security. How convenient for them.
A CLI written in swift? Nice!

But it’s more of a timer than a progress line/bar as far as I understand.
Yeah, but Microsoft's been trying to convince them to move to Azure's stuff for years, so who knows :)
In American criminal law, the term "innocent" is not a verdict that a jury can return. Instead, the only possible verdicts are "guilty" or "not guilty". No one can declare you innocent because new evidence may come up later finding you guilty.

The presumption of innocence is something else. It's not a verdict.
Show HN: Mistral NeMo finetuning fits in Colab
Managed to make Mistral NeMO 12b https://mistral.ai/news/mistral-nemo/ fit in a free Google Colab with a Tesla T4 GPU (16GB) for 4bit QLoRA finetuning!

Managed to shave 60% VRAM usage and made it 2x faster as well! It should work in under 12GB of VRAM as well!
I thought power management was moved to the GPU firmware in the 20 series, which is why the new driver only supports those?
> Why are so many mission critical hardware connected systems connected to the internet at all or getting automatic updates?

Because it lets them "scale" by having fewer and cheaper offsite IT and contractors to manage vs hiring pesky onsite employees.
Cyber was a 90s buzz word that died out and became vogue when cyber security became cool. I cringe every time I hear it drop.
As far as I know, China has not been hiding this preparation. They are actively preparing to invade Taiwan, at least for the sake of appearances so that they can be seen doing so.
Roasting Startups All Day Friday
Yes, that is as bad as it sounds.
Wouldn't this be an attack vector? Use some low-hanging bug to bring down an entire security module, allowing you to escalate?
> How is it lazy and herd-like to _not_ run the latest and greatest?

I'm not sure what you're asking here. Ethereum incentives don't make you run the latest version of your client's software (unless there's a hardfork you need to support). You can run any version that follows the network consensus rules.

The incentives are there to punish people who use the most common software. For example, let's say there are around 5 consensus clients which are each developed by independent teams. If everyone ran the same client, a bug could take down the entire network. If each of those 5 clients were used to run 20% of the network, then a bug in any one of them wouldn't be a problem for Ethereum users and the network would keep running.

If the network is evenly split across those 5 clients but all of them are running in AWS, then that still leaves AWS as a sigle point of failure.

The incentives baked into the consensus protocol exist to push people towards using a validator client that isn't used by the majority of other validators. That same logic applies to other things like physical host locations, 3rd party hosting providers, network providers, operating systems, etc... You never want to use the same dependencies as the majority of other validators. If you do and a wide-spread issue happens, you're setting yourself up to lose a lot of money.
> i told him no, i wouldn't knowingly participate in that (and i knew that my boss would back me up, so wasn't concerned about my job), so he went to some other guy who wasn't as stubborn and talked him into it.

This is the big problem with standing your ethical ground in software: They'll just find someone else who has no ethical standard to do it. One of my first programming jobs was writing graphics card drivers, and I was asked to write code to cheat a benchmark (basically detect the benchmark was running and send the code into an alternate faster path). I was a junior developer at the time, but I worked up the courage to refuse to do it, thinking I'll probably be fired. Boss said "Hey, no problem, we'll give you other tickets to work on. Bob, over there said he has no problem writing the benchmark-cheating code!" So a lone voice of ethics is never going to change things when the company itself is unethical.
I'm not sure I agree, ransomware attacks against organizations are often targeted. They might not all happen on the same day, but it is even worse: an ongoing threat every day.
Much like the RSA attack, now we get to see how Crowdstrike handles damage control.
In American criminal law, the term "innocent" is not a verdict that a jury can return. Instead, the only possible verdicts are "guilty" or "not guilty". No one can declare you innocent because new evidence may come up later finding you guilty.
Well I mean integral here in that your PC can't boot and do anything useful if the software breaks.

It's not some solitaire app or saas website.

Completely nuked 1000s of companies ability to operate for a day, and the thing is auto-updating with apparently global big bang release push method..
"IT managers" is an awfully big umbrella term. It can refer to anyone making decisions like this. The CIO, the CSO, the CFO (if over IT as in a lot of organizations) and even the CEO. Responsibility may also extend to other mid and senior level managers within the chain of decision making who didn't speak up, to a lesser extent. In my last company I was an individual contributor, and if some one proposed placing an autoupdating, closed source kernel changing program in my critical path, you can bet I would have loudly spoken out against it.
> but then you get popped because something that would have been automatically updated misses a patch because it was too critical to risk automatic updates.

This kind of logic only works if you ignore any kind of possible nuances in the problem and just insist on throwing the baby out with the bathwater. Just because someone let you do automatic updates (or let's be real, you probably didn't give them much of an option) that doesn't mean you should use it for everything.

Automatic update of data (like virus definitions) != automatic update of code (like kernel driver)

And really, the only time you could justify doing automatic updates on other people's machines is when have reason to believe the risk of waiting for the user to get around to it is larger than the damage you might do in the process... which doesn't seem to have been the case here.
how is this AI slop if it was made by me in react and node and just uses the openai api, it was just a project to get the basics of web dev down. Just genuinely curious not trying to be defensive.
Mine certainly does, our key windows based control systems use windows defender, the corporate crap gets sentinal one and zscaler and whatever else has been bought on a whim.

I'd assumed that any essential company would be similar. OK if your purchasing systems for your hospital are down for a couple of days it's a pain. If you can't get x-rays it's a catastrophe.

If half your x-ray machines are down and half are up, then it's a pain, but you can prioritise.

But lots of companies like a single supplier. Ho hum.
I thought Microsoft did use formal verification for kernel-mode drivers and that this was supposed to be impossible. Is it only for their first-party code?
>reboot up to 15 times

I see my orgs SCCM admins have been consulted
Or "log a ticket!"
> Iran has proven itself to be at least better at performing like a democracy than most of our allies

Sure. That wasn't the question. The comparison was between Iran and America, and whether being able to bribe people gives Iranians more power than Americans. It doesn't.

> it's extremely difficult to wield real influence with a vote (or via advocating for any sort of elected official) as most problems are directly avoided during campaigning

You're focussing on Presidential elections. Of course in a national vote the individual will be diluted. That's the point. Go more local (and earlier, to primaries) and you see massive questions resolved with tens of votes, even in New York.

> problems are decided long before they hit the ballot box and you can only really weigh in on certain wedge issues

Correct. Most of what I described above is before the ballot box. That said, even the multiple-choice power exerted at the ballot box is more power than the average Iranian has. (There is an argument to be made that if someone doesn't believe this, they shouldn't vote.)
Those able to write and use FUD malware do not create public documentation. Crowdstrike is not impossible to bypass, but for a junior security journeyman known as a pentester, working for corporate interests with no budget and absurdly limited scopes under contract for n-hours a week for 3 weeks will never be able to do anything as simple as an EDR evasion, however if you wish to actually learn the basics the common practitioner of this art please go study the offsec evasion class. Then go read a lot of code and syscall documentation and learn assembly.
Thanks to this project I can finally play Doom without framedrops!
Well - recognition where it's due - that actually looks pretty great. (Assuming that, contrary to prior behavior, they actually support it, and fix bugs without breaking backwards compatibility every release, and don't keep swapping it out for newer frameworks, etc etc)
This tracks for me. PA-DSS was a pain with ssl and early tls... our auditor was telling us to disable just about everything (and he was right) and the gateways took forever to move to anything that wasn't outdated.

Then our dealerships would just disable the configuration anyway.

It's been better in recent years.
I am aware of LAMMPS or GROMACS which can be used for molecular dynamics simulations and visualizations.

But you probably need some physics degree to use them correctly as you have to specify the potentials that make sense.

It's classical physics so won't be totally accurate.
>Windows is high reliability.

Depends i think. When i was working as a super market cashier the tils had embedded XP. in 2 or 3 years it rarely had issues. The rare issues it did have were with the java POS running on top.

Windows 10 for my home desktop crashed a lot more and just seems to have gotten more "janky" with time.
Alabama should be included on any list of states terrible to inmates. We still have jails and prisons without HVAC. I really don't care what you did, having to live in a metal and concrete box in the middle of an Alabama summer without basic air conditioning is absolutely torture in my book.
https://medium.com/@confusedcyberwarrior/when-security-becom...
But it doesn't matter. That changes nothing more than semantics, which doesn't explain or justify anything.
This outage may be more expensive and cause more damage than any cyberattack in history.
A Single Line of Code Brought Down a Billion Dollar Rocket
If 90% of the world runs in AWS, and I'm the only one running on my own hardware, do I get a benefit when AWS goes down?
Retribution shouldn't even be on this list, tbh.
It turns out a CMS can be pretty awesome
As an American you're raised not to think cultural nihilism as a bad thing. And have been exporting this nihilism to Europe for several decades :)
"best in the market"

I think the evidence shows that no, they aren't.
I am still not following you at all. I honestly feel like either you or I are replying to the wrong comment chain.

> It was established that the exact mechanics don't matter

Please show me what was established and where. I genuinely don't know what you are talking about.

> But then you introduced an exact mechanic

Again, please show what I introduced and where.

>This means that there must be something incredibly interesting or noteworthy about said mechanic to violate the notion that the exact mechanics don't matter

Ahhh, really lost now.

> But you have not yet shared what is notable about it.

Notable about what?

Either one of us is staggeringly confused, or I'm having this conversation with an AI in training.
Who knew: "Did you try rebooting it?" actually works :)
When I shot events years ago, I always used a flash for fill, even outdoors. People like the glint in the eyes that it added.

Before the photoshop times you could sus out lighting setups based on the reflections.
Sorry, I think I formulated it not quite precisely.

Selecting a background image is not an extra step in installation, but the layout choice is. My idea was that Linux Mint is one of the top choices for the new Linux users who migrate from Mac or Wn, that's why I wanted them to have a possibility of adding a familoar layout. See this step here: https://github.com/klad-design/linuxmint-brand/blob/main/OS%...

The idea with a blank background is that the system can look without a background image overall and with just filled screen. You can see more "first load after installation" examples here: https://github.com/klad-design/linuxmint-brand/tree/main/OS%...
Well, not the OS, per se, but macos updating mechanisms have auto-restart path, and I imagine any Linux update that touches the kernel can be configured in that way too. It's more the admin's decision then OS's but on all common systems auto-restart is part of the menu too.
Prisons should act in societies benefit not the fulfillment of your personal revenge-fantasies.

Because that is what you propose. The goal of prison is to take people put of the environments they are in, as a punishment, to stop them from doing things they shouldn't, but also to not have them do it again.

I'd argue, not having them do it again is The most important goal of prisons. And it turns out, that rehabilitation is very good at that given scientific consesus.

It is just not good at fulfilling personal revenge-fantasies like yours.
I love how this is solution for security, while sounding like most insanely unsecure thing...
Ignoring all of the other approaches to that problem I wonder if this update will take the record for most damage done by a single virus/update. At some point the ‘cure’ might be worse than the disease. If it were up to me I would be suggesting different cures.
>>murderers, rapists and thieves to walk free after receiving a slap on the wrist.

You think spending potentially decades of your life in prison is a slap on the wrist?
Some government should force them to release a technical postmortem. Feels that they don't do it otherwise.
I get nervous just pushing updates to my stupid little website. I simply cannot imagine.
I don't know about MacOS, but at least as recently as a couple years ago crowdstrike did ship a Linux kernel module. People were always complaining about the fact that it advertised the licensing as GPL and refused to distribute source.

I imagine they've simply moved to eBPF if they're not shipping the kernel module anymore.
Tail Recursion for Macros in C
Yeah, all depends on how much config you want to allow employees to do, but I’m sure the functionality is there if you wish to enable it.
I don't blame Microsoft in the tactical sense for this outage, but I blame them in the strategic sense. Here's what I mean.

Microsoft is all in on kernel extensions, when Apple has shown that you can deprecate them and move the most important use cases outside the kernel. I blame Microsoft for not starting the herculean task of deprecating kernel extension. Remember, Satya Nadella said recently that Microsoft will put security above everything else, even backward compatibility. Then the Recall fiasco happened and Nadella was caught pants down with the useless value of his word.
The people working in those professions are; their bosses and their IT departments are not. IT security is treated as solved problem - if you deploy enough well-known solutions that prevent your employers from working, everything will be Safe from CyberAttacks. There's an assumption of quality like you'd normally have with drugs or food in the store. But this isn't the case in this industry, doubly so in security. Quality solutions are almost non-existent, so companies should learn to operate under the principle of caveat emptor.
The incentives are perverse. Opening a prison in a small district can result in 75% of the population being prisoners, which counts towards census->congressional seats and for gerrymandered power. Some states somehow even keep you in the prison's district even after release, but I'm having trouble finding specific instances.