skysight-inc/HackerNews huggingface dataset:
Cool, but the problem with all these libraries is that the wrap every LLM their own way and require you to pass an API key.

Instead, these libraries should just be producing and consuming messages, so they can fit into our existing workflows and code bases.

i.e. just generate and parse messages, don't call APIs and create yet another abstraction around the LLM providers
Show HN: FCC Broadband Map
Mapping tool and Build an e2e data pipeline for ~10GB of broadband data
What makes you think spam account creation is up and what changed in the last 2 years that made spam accounts so much more easily createable?

Comment counts haven't changed but text post creation absolutely has. Given that no more stories are being flagged than usual, in fact if you amortize this over new user counts a lot less per user, I'm going to say that it's genuinely new text accounts that want to engage with HN by making text posts.
It's "rootkit" because it literally implements remote code execution as root as a feature.
How many more cases and years you need to finally admit that windows is a shitty platform?

Yes all platforms seen bad days and have their own issues.

But windows is different - most of its troubles come from human factor - low quality people making (or made 10 years ago) low quality decisions and every new iteration is just another layer of bad decisions aimed to cover the holes in previous layer.

You can see and feel it even un ui - there is no esthetics nor real usability and never was.
Great, does it support creating monthly newsletter like emails?
I was wondering when someone would bring up Taleb RE: this incident.

I know you aren't saying it is, but I think Taleb would argue that this incident, as he did with the coronavirus pandemic for example, isn't even a Black Swan event. It was extremely easy to predict, and you had a large number of experts warning people about it for years but being ignored. A Black Swan is unpredictable and unexpected, not something totally predictable that you decided not to prepare for anyways.
Yeah that had crossed my mind too. I’m not sure which risk is bigger, breaking things or leaving them insecure.

I lean towards breaking things being the bigger risk.

But if even a handful of the other errors were corrected this would have been prevented and they wouldn’t have had to make that choice.
Yeah. Debugging is getting _way_ less attention than it should. I know some people who _boast_ that they don't use a debugger. To me it feels like a doctor saying: "We don't use new-fangled X-Rays here, you should be able to find problems with just a stethoscope".

And good debugging support doesn't need to be some fancy "Minority Report" style 4D animated UI. Just give us good type rendering support, an easy ability to chain breakpoints and set conditional breakpoints, "watch variable" support. Some other things: "where did this value came from?", "watch for value use".

Go is an especially bad example. Its debugger doesn't even allow custom type rendering, so if you have something like a custom generic map container, you can't inspect it at the debug time.
N97 is better than N100 (it is faster and it supports in-band ECC), but it has a higher power consumption.

ODROID H4+ is faster than Radxa X4, due to the higher clock frequency and due to having a 64-bit DRAM interface, while Radxa X4 has a 32-bit DRAM interface.

Radxa X4 is cheaper, when considering the price including the DRAM & WiFi (under $100 with 8 GB DRAM), and it is much smaller, having the credit card form factor. An advantage of Radxa X4 over almost all other small SBCs is that its USB 3 ports are 10 Gb/s ports, allowing fast links to USB hubs or external SSDs or USB Ethernet interfaces.

When compared to the SBCs using RK3588 or to Radxa NIO 12L, the only cheap SBC with a CPU including a quadruple Cortex-A78 (from Mediatek; comparable SBCs from Qualcomm or NVIDIA are very expensive, starting around $500), Radxa X4 is cheaper than most of them and whether it is faster depends on the application. The N100 CPU will be faster in single thread, but it can be slower in multiple-thread applications, when, depending on cooling, its clock frequency may drop to lower values than for the SBCs using Cortex-A76 or Cortex-A78. Many of those SBCs use 64-bit DRAM interfaces, so they may also be faster for programs that happen to be limited by the memory bandwidth (vs. Radxa X4 with a 32-bit DRAM interface). The GPU of N100 is also much faster and it has much better software support than the Arm GPUs. USB and PCIe should also work better on N100.

There is also AAEON UP 7000, which is a very similar credit-card-sized SBC with Alder Lake N, but it is 2 to 3 times more expensive.

This year, Intel has introduced a refresh of Alder Lake N, with the code name "Amston Lake". The Amston Lake CPUs are branded in the Atom x7000 series and they are intended for embedded applications. Radxa has said that there will be future variants of the Radxa X4 which will use some Amston Lake models instead of N100, including 8-core models.
> installs a root cert

Wow, I didn't know that, but you're right. It even works in Brave, which I wouldn't have expected:

% openssl x509 -text -noout -in news.ycombinator.com.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
6f:9e:b3:95:05:50:6e:4d:03:d6:0b:a9:81:8c:2f:c3
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=California, O=Zscaler Inc., OU=Zscaler Inc., CN=Zscaler Intermediate Root CA (zscalertwo.net) (t)
Validity
Not Before: Jul 13 03:45:27 2024 GMT
Not After : Jul 27 03:45:27 2024 GMT
Subject: C=US, ST=California, L=Mountain View, O=Y Combinator Management, LLC., CN=news.ycombinator.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)

It seems to hijack the browser somehow, though, because that doesn't happen from the command line:

% openssl s_client -host news.ycombinator.com -port 443
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = "Y Combinator Management, LLC.", CN = news.ycombinator.com
verify return:1
write W BLOCK
---
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Y Combinator Management, LLC./CN=news.ycombinator.com
i:/C=US/O=DigiCert Inc/CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
1 s:/C=US/O=DigiCert Inc/CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2
Ask HN: How to fix Crowdstrike BSOD without admin access?
Does anyone know how to proceed if I do not have administrator level access to the computer?

I do not have access to c:\windows\system32\drivers\crowdstrike folder to delete the corrupted .sys file

I was able to boot on recovery mode with network, after waiting 30 min, as mentioned on a reddit thread [1], but when I rebooted and BSOD persisted.

Are there other alternatives on how to recover?

[1] https://www.reddit.com/r/sysadmin/comments/1e6vx6n/comment/ldwid1f/
Their stock is down 13% right now... pretty huge for an intra-day drop.
Zscaler sounds like it would be a web server. Just looked it up: "zero trust leader". The descriptiveness of terms these days... if you say it gets installed on a system, how is that having zero trust in them? And what do they do with all this nontrust? Meanwhile, Wikipedia says they offer "cloud services", which is possibly even more confusing for what you describe as client software
> it is axiomatic that the government cannot do indirectly what it is prohibited from doing directly

Turns out SCOTUS decided it isn't, and the government is free to do exactly that as long as they are using the services of an intermediary.
They don't get budget by clickbait. How do I even as a registered voter have anything to do with NASA at all? I don't vote on their budget. I've never been offered to vote on a funding package for them. I chose from maybe two candidates as my representative on various levels of government, and am beholden to whatever platform they come up with.
I suspect that detecting ai generated content will becomes an arms race just like spam filtering and seo. Business will be built on using secret ml models detecting smaller and smaller irregularities in images and text. It'll be interesting to see who wins
No, that is standard today. With rising eating disorders, the fear based nutrition advice that simply does not even say the truth is avoided.

A can of coke won't harm you in the slightest.

Especially for teenagers, they would had to eat super massive amount of potatoes, so actually getting calories only from that would be spectacularly bad idea.

Currently nutritionists work really hard to undo damage the sort of things you are saying are causing.
I think clickbait gets clicks, but doesn't build favorable sentiment or interest. I think this is true for the general public as well.

To this end it might make sense for a company/website paid based on click through engagement, but you will notice that most of those institutions are generally despised by the public.

I don't think being annoyed by clickbait is unique to nerds or such a sophisticated concept that the General Public can't comprehend it.

It's not like when NASA comes up for Budget approval being known as the agency that creates shitty clickbait articles will help them. In fact, I think it is exactly the kind of brand that they wouldn't want to build
If my wife was raped and murdered you think it would be more moral to punish me than the murderer because I want vengeance?
What are you using for an adblocker? I'm using uBlock (I thought it was uBlock Origin but apparently not now that I'm looking), and it also stopped blocking YouTube ads. (When it did block ads I'd have a 15-30 second black screen that I had to wait through.)
- "repeat offenders for illegal dumping"

reads the first link provided

Summarizing the entire article, SpaceX's Boca Chica facility has permits for "domestic wastewater reuse authorization" and "two construction stormwater general permits", but, they apparently don't have a "permit for stormwater discharges."

Not a single word about "illegal dumping". Not a single word about anything that actually happened. Not a single word about anything bad being dumped. The entire article is about SpaceX allegedly not having applied for a specific permit related to stormwater discharge. That's it.
I don't even think Linux is the definite answer. The majority of these critical apps are just full-screen UIs written in C, C++ or Java with minimal computing and networking, so they could just as easily run on Qubes or BSD without all the constant patching for dumb vulnerabilities that still persist even though Windows is 40 years old.

The problem is the middle management class at hospitals, governments, etc., only know how to use Word and maybe Excel, so they are comfortable with Microsoft, even though it's objectively the worst option if you aren't gaming. So then they make contracts with Microsoft and all the computers run Windows, so all the app developers have to write the apps for Windows.
> Is that easy?

Looks pretty easy to me

https://www.youtube.com/watch?v=tj2Ty7WkGqk
It's not the memory that's the problem, it's that games like FGO require 10GB or more of flash storage which is most of a 16GB device particularly when you consider overhead for software updates. It's not like the game has high memory requirements but it sure has a lot of levels, textures and stuff.

It's amusing the the IBM Mainframe world still uses the word "storage" to describe RAM.
Get rid of the windows and other shitty software. Finally start calling out naked kings in the industry.
I work for the government supporting critical equipment - not in medical, in transportation sector - and the systems my team supports not only are not connected to the internet, they aren't even capable of being so connected. Unfortunately the department responsible for flogging us to do cybersecurity reporting (different org branch than my team) has all our systems miscategorized as IT data systems (when they don't even contain an operating system). So we waste untold numbers of engineer hours now reporting "0 devices affected" to lists of CvE's and answering data calls about SSH, Oracle or Cisco vulnerabilities, etc. etc. which we keep answering with "this system is air gapped and uses a microcontroller from 1980 that cannot run Windows or Linux" but the cybersecurity-flogging department refuses to properly categorize us. My colleague is convinced they're doing that because it inflates their numbers of IT systems.

Anyway: it is getting to the point that I cynically predict we may be required to add things to the system (such as embedding PCs), just so we can turn around and "secure" them to comply with the requirements that shouldn't be applied to these systems. Maybe this current outage event will be a wake up call to how misplaced the priorities are, but I doubt it.
I've had CrowdStrike completely delete a debug binary I ran from Visual Studio. Its injected module in every single process shows up in all of our logging.
In most companies, businesspeople without any real software dev experience control the purse strings. Such people should never run companies that sell life-or-death software.

The reality is there is plenty of space in the software industry to trade off velocity against "competent" software engineering. Take Instagram as an example. No one is going to die if e.g. a bug causes someone's IG photo upload to only appear in a proper subset of the feeds where it should appear.

There's a lot of incompetence by choice.
They don't get their funding from writing articles. They get it by marrying scientific goals with defense goals.
Anthropic cut marks in extinct megafauna bones (from Argentina, 20000 years ago)
How to manage Slack access control via Azure AD groups? Even the most basic integrations are missing in other options...
I've co-interviewed about ~15 people or so with the hiring manager and a guy from HR.

We're looking for people that

1. match the requirements at least somewhat.
2. we can get excited about software and technology.
3. can communicate clearly about software.

A good candidate has preferences in technologies and software. Bad candidates don't give a shit or can't mention languages or frameworks when asked.

We ask questions about soft skills too: Have you ever been in a conflict at work, if so how did you approach it. If not, have you had to act "professionally" in other situations?

Good candidates can always tell a story about some conflict where they talked it out with a colleague or a boss, or give some other lame story where they "learned something". Bad candidates can't say shit. The answers to such questions can reveal some true assholes that can easily be filtered.

Finally we ask why you want this job. Why this company?
Good candidates have some bullshit story or can tell something they actually find fascinating about our products. Bad candidates tell you that they don't actually care much where they work, it's just for the money etc. Even whey you give them hints and clues etc., the bad candidates are usually just an obvious bad fit for the role.

Shitty applications get filtered in bunches. Good candidates write applications that read as if written for the job posting. Bad applications read as if written by ChatGPT or plain ol' copy/pasta.

my 2 cents
Paper and pen. Sure might not work on LARGE projects, but when I’m reverse engineering something or trying to debug, I always start with a control flow diagram… works a treat!

But in the past 6 months I’ve started to use graphviz and other tools to quickly document code paths for others
At work we have two sets of computers. One gets beamed down by our multi-national overlords, loaded with all kinds of compliance software. The other is managed by local IT and only uses windows defender, has some strict group policies applied, BMCs on a separate vlans etc.
Both pass audits, for whatever that's worth.
I'd argue that Tenerife was due to taking off (in bad weather), not landing. But of course, a bunch of planes landing at the same airport without ATC sounds quite dangerous.
This is an interesting response. I'm curious why you specifically believe "it’s a half-baked rootkit sold as a figleaf for incompetent it managers."
You do know that when you listen to music there is nobody there, its just a vibrating machine that replays communication that someone did a long time ago? So they aren't communicating to you, that is just an illusion.

So I don't see why you even need that recording, in the end there is no communication happening there in either case. When you go to a live concert sure, which is why people care so much about those and why they wont go away, since then you get the real communication, everything else is just fake, so why not generated communication instead of recorded?

Also the person singing is often just replaying a message written by other people, they aren't communicating anything of their own they are just relaying and repeating the same message someone showed them over and over and over. That isn't communicating any more than what computers do.
This worked for me!
But isn't that a fairly tiny risk, compared with letting a third party meddle with your kernel modules without asking nicely? I've never been hit by a zero-day (unless Drupageddon counts).
For a business that relies on SaaS applications over cloud and uses dumb machines (windows, iPad, whatever) as client terminals, can someone please explain what are the actual threat factors that these EDR tools like Crowdstrike Falcon address? And if SaaS applications can restrict access, detect anomalies with user behavior, have MFA for auth, etc.. will that mitigate these risks? I guess common issues like key loggers, malwares, virus attacks have much simpler solutions than a complex EDR which seems to need root access!! Someone, please educate.
Isn’t that better explained by the fact that neither were created with Windows in mind?

git was literally created to develop Linux.
In NixOS, you have a bootloader to load your OS. Unless you botch your bootloader, you can't paint yourself into an unbootable state. If one system configuration doesn't work, you reboot and choose the prior one before the OS begins to load in a menu displayed by the bootloader.

This is also true of most regular Linux setups. Except that in those, you can only choose the kernel. Hence, if you have broken other parts of your configuration, your system might not be bootable. So the safety net is much thinner.
> The same species will have different Scientific names for suiting the preferences of Chinese, USA, Brazilians or Russians

Generally the sensitivities of Americans take precedence. I can think of many examples in many fields (e.g. the word "master" because of its strongest association in the US is with slavery, which is not true everywhere).
That probably explains how it got past internal testing. Something went wrong after that, during deployment.
Thats exactly why clickbait makes no sense. Who is it targeting? The lay person? They have no say in NASA's budget. If NASA wants funding they have to look at who holds the reigns in congress and give them pork. Thats it. That's their mechanism. When they were extremely well funded around apollo it was because they had pork a la advancing ICBM and surveillance satellite technology. Not because they got billy to tune in between episodes of will rogers.
How did you reliably determine what works and what doesn’t in “untold combination of os/desktop/mobile clients“? Is there a description of that somewhere?
banks would not offer such lucrative interest rates if immortality was a publicly known trait
I'd like to read more about it, but that link is... paywalled I think? It's not even clear.
I think you can transliterate that sentence directly into Japanese, and it would be perfectly acceptable, save a missing particle/honorific.

Original: Who? Marvin! Marvin friends?
Transliterated: だれ？マーヴィンさん！マーヴィンさんの友人？
Google Translate: Who's that? Marvin! Are you Marvin's friend?
Hope she's okay. For better or worse, our entire emergency department flow is orchestrated around epic. If we can't even see the board, nurses don't know what orders to perform, etc.
Totally with you. Pre-check is an ugly band-aid on a flawed system.
Why is the emergency department using windows?
Presumably those other companies try running things at least once before pushing it to the entire world though.
I think a major thing with viruses is access to filesystem.

If programs asked for permission to access folders or we gave the program their own volume to work within then they couldn't access, run or modify sensitive/important files.
> Since TuxGuitar appears to be unmaintained

The development of TuxGuitar has recently resumed

https://github.com/helge17/tuxguitar
It's because Windows is a mature, professional-grade operating system developed and maintained by extremely competent people with a lot to lose.
Wishing you and your mom the best
How long will the thrust gas last before needing a refill?
Worth $3.7B, paid $148M in 2022.

Edited to add: I wonder what the economic fallout from this will be? 10x his monetary worth? 100x? (not trying to put a price on the people who will die because of the outage; for that he and everyone involved needs to go to jail)
No MJML feels like a mistake. I design emails and that is literally the most important feature to me.
What evidence are you referring to? Was there a company that was breached for taking a few days or weeks to update crowdstrike?
CS recently went through cost cutting measures, which is likely why there's not a QA fleet to deploy to or improving their engineering processes.
Boats are mostly air by volume, which isn't heavy at all compared to water.
> Swap Chromebooks for PCs and you still have the problem-- how do you handle centralized management of that "fleet"?

Simplicity (and hence low cost) of fleet management, OS boot-verification, no third-party kernel updates, and A/B partitions for OS updates are among the major selling points of Chromebooks.

It's a big reason they have become so ubiquitous in primary education, where there is such a limited budget that there's no way they could hire a security engineer.
.plan was the original status update.
> Maybe because everyone else in "security" and DRM does it, so they figured this is how it's done and they should do it too?

What DRM uses kernel drivers? And how do you plan to prevent malware from usermode?
> I get that in abstract improvements "could" trickle down from that but once again without any performance benchmarks that is the definition of speculation.

Fair enough, I am not sure whether CPU schedulers are shared across architectures, I am also not aware of any recent benchmarks other than: https://www.phoronix.com/review/apple-m2-zen4-mobile

Where I was going with my original statement/post is that I wouldn't be surprised to see Linux doing better in some benchmarks due to improvements in the kernel, there has been many recent developments such as io_uring[0], MGLRU, etc. that could make a difference compared to other systems.

[0] https://www.youtube.com/watch?v=9-IWMbJXoLM&t=1004s
This was my first thought too. I'm not that familiar with the space, but I would think for something this sensitive the rollout would be staggered at least instead of what looks like globally all at the same time.
Did you tried to delete the folder or the driver?
I think you are largely right here, but disappointing to see in an HN comment section.
I think the wider societal impact from the loss of availability today - particularly for those in healthcare settings - might suggest this isn't always the case
https://slate.com/business/2017/04/a-garage-door-company-s-r...
> It's probably because more applications are written in C++ than anything else

I imagine Java is as popular as C++ if not more. And C# is (or at least was) huge in Europe too.