skysight-inc/HackerNews huggingface dataset:
In a slightly less threatening but equally noxious box-checking racket, a company I work with is being sued for their website not being sufficiently ADA-compliant. But the first they heard of the lawsuit, before they were even served, was an email from a vendor who specializes in adding junk code to your website that's supposed to tick this box. The vendor happens to work closely with several of the law firms who file and defend these suits.
That’s what laws are ostensibly for
How well does Medicare cover end-of-life care? It depends on what type
Especially since I'm assuming those organisations pay good money for those services (my org hasn't been affected and we don't use them but we're also very small so I wouldn't know).
Anyone who used Windows over Linux for critical software deserves to burn. Windows is a niche operating system for games. What are people thinking?
The actual cap is 54k per seat, so it can scale. You can bring that number up or down as needed to adjust for the seat representation size in the US, but it is significantly below, say, Hakeem Jeffries raising $17M and Mike Johnson $13M.

The other bit is that the Parliament has more constituencies than the US House despite the House representing more people, so the number of people per House member is quite high. And that's not actually specified in the Constitution but a law that could be changed by Congress at any time. https://en.wikipedia.org/wiki/Reapportionment_Act_of_1929
There are no massive waves of vigilantism in places with shorter sentences and less brutal prison systems to suggest that it does.
Why, whY, WHY...are these things connected to the internet?!

It's so that the support engineer at the manufacturer can log in to troubleshoot. And then company IT support sprinkles a layer of antivirus on top. That's how we got here.
Original source is clearer: https://www.reuters.com/technology/space/musks-spacex-is-qui...
Crowdstrike though is not part of a system of engineered design.

It’s a half-baked rootkit sold as a figleaf for incompetent it managers so they can implement ”best practices” in their companys PC:s.

The people purchasing it don’t actually know what it does, they just know it’s something they can invest their cybersecurity budget into and have an easy way to fullfill their ”implement cybersecurity” kpi:s without needing to do anything themselves.
Living the Loopless Life: Techniques for Removing Explicit Loops/Rec in APL [video]
*Lambda Conference 2024 presentation by Aaron Hsu
unqualified people on the internet shouldn't give legal advice, but since we're doing it anyway: no, this is definitely not true and if you make assurances about the fitness of the good you are on the hook when it fails, even if it's some absurdly improbable "I had no way of knowing that our pencils intended for schoolchildren would be used on a spacecraft" situation.

There is a reason you will see a ton of warranties and terms of service/EULA specifically forbid or disclaim the use in life-critical situations, in which case you are safe, because you said don't do it. But if you don't, you generally are going to be liable.

Sadly there is a reason the chainsaws say "do not stop chain with genitals". Not only did someone probably do that, but the damages stuck.

example, I was talking about the CUDA license yesterday and of course one of the clauses is:

> You acknowledge that the SDK as delivered is not tested or certified by NVIDIA for use in connection with the design, construction, maintenance, and/or operation of any system where the use or failure of such system could result in a situation that threatens the safety of human life or results in catastrophic damages (each, a “Critical Application”). Examples of Critical Applications include use in avionics, navigation, autonomous vehicle applications, ai solutions for automotive products, military, medical, life support or other life critical applications. NVIDIA shall not be liable to you or any third party, in whole or in part, for any claims or damages arising from such uses. You are solely responsible for ensuring that any product or service developed with the SDK as a whole includes sufficient features to comply with all applicable legal and regulatory standards and requirements.

Why is this here? because they'd be liable otherwise, and more generally they want to be on the record as saying "hey idiot don't use this in a life-critical system".

There might well be a clause like that in crowdstrike's license too, of course. But the problem is it's generally different when what you are providing is a mission-critical safety/security system... hard to duck responsibility for being in critical places when you are actively trying to position yourself in critical places.
and why do they run spyware?
Hi everyone! I’m currently conducting a survey to understand the key challenges and needs within the engineering simulation community. If you guys and gals wouldn't mind taking the time to fill out this question survey I would be grateful. No personal information required, takes about 2-3 minutes. Thank you!

https://forms.gle/33a7nd3HPM8SHWWC8
Follow more people, and more people will follow you.

Also, it isn't Twitter. You're not going to make huge numbers, nor should you expect to.

Also, if you can afford it, a hosted install on masto.host (which I use[0]) will let you federate, but you'll end up using too much space to stay on the lowest tier.

And you can have multiple accounts on multiple servers, which is what I did before (now they redirect to my one instance) and it's manageable through a third party client or password manager.

[0]https://krapp.masto.host
Just don't commit crimes.
Opinion: I'd rather have a headphone jack and a microSD slot than AI in my phone
Curious how others feel about this.
While it probably should, I regret to inform you that SolarWinds is still alive and well.
As in this case, it clearly had a huge impact on people. You can't say it's just a job when people can die because of you.
Some file formats allow data to be appended or even prepended to the expected file data and will just ignore the extra data. This has been used to create executables that happen to also be a valid image file.

I don't know about PNG, but I'm fairly sure JPEG works this way. You can concatenate a JPEG file to the end of an executable, and any JPEG parser will understand it fine, as it looks for a magic string before beginning to parse the JPEG.

A JPEG that has something prepended might raise an eyebrow. A JPEG that has something executable prepended should raise alarms.
Lathes probably have PCs connected to them to control them, and do CNC stuff (he did say the controllers). Laser alignment machines all have PCs connected to them these days.

The cranes and lifts though... I've never heard of them being networked or controlled by a computer. Usually it's a couple buttons connected to the motors and that's it. But maybe they have some monitoring systems in them?
To play devil’s advocate, a staged rollout for antivirus definitions somewhat defeats the point since those definitions are supposed to be constantly updated.

I agree with the rest, especially the use of a memory unsafe language to do parsing in the kernel by a billion dollar security company blows my mind.

How can you even run a security company without any security professionals reading your code even incidentally? An impressive level of incompetence.
It's just a lot of time and resources you're putting in here today in favor of the racist names, for someone who doesn't care particularly. I do care about not having racist names, an apparently unpopular position on this website.

But I think scientists overall are probably smart enough to handle whatever complication is added to their work by it. And again, they must already be able to account for changes for other reasons, so I trust they can make it through this one as well. It's just not a compelling technical argument.
Meanwhile, while HN bubble imagines people doing big data jobs on Excel, in the real world 10s or 100s of millions of people are perfectly satisfied doing small data jobs in Excel.
The Plague of Lust: A History of Venereal Disease in Antiquity (1901 Edition)
Lenovo and Dell have some laptops with Linux, and they are very good ones.

(not sure if you meant rugged ones, that may not be the case, but I guess this is a tiny percentage of the market)
.. and you should say what you actually mean, instead of using corporate euphemisms like "poorly communicated," which can mean anything in the world.

Including, "I don't like that person."

And stop assuming you know anything about my world view.
Probably because some fraction of lift manufacturer's customer base has a compliance checklist requiring it.
Looks very nice. I'm curious about "no mjml" -- I've worked with authoring tools in related domains and found that separating the serialization format from the output format has some benefits. It manifested in needing to store editing concerns like "this element is locked" in the HTML when it had no business being in the HTML output.
Linux kernel memory isn’t paged out to disk, while Windows kernel memory can be: https://knowledge.broadcom.com/external/article/32146/third-...
Certifications by themselves don’t help if the culture around them doesn’t change. Otherwise it’s just rubber-stamping.
AliExpress seems to be down, at least the mobile app.
But then would CrowdStrike stop the startup saying it requires network connectivity to initialize or something? Just wondering how invasive the app is
Foliate itself is about 12 MB.

However, it needs flatpak runtime. If you already have different flatpak apps, this is not an issue, it is going to be shared with them, but if this is going to be your first-and-only flatpak app, you need to add few hundreds MB.
We know, however, that treating people like animals in harsh prison conditions and lengthy sentences does not reduce reoffending rates.

We can tell, from comparing with systems. So the current US prison system imposes vast amounts of violence and abuse on prisoners without achieving anything beneficial.

I've said before and I say it again: If I were to - by some stroke of magic, seeing as I'm neither a US resident or citizen - be put on a US jury, I don't think I could find a moral justification for convicting someone even if I knew with 100% certainty they were guilty. The US prison system stands out as such a barbaric and immoral system that I'd consider inflicting it on anyone hardly any more moral than most violent crime.
That guy is gonna fail all the way right up to the top. Sheesh.
We shouldn't let billionaires destroy language, and we don't have to.
The postmortem will should interesting, can't imagine how even just basic integration testing didn't catch this. Much less basic best practice like canarying.
Bold claim that Go succeeded. A couple of software projects used by a tiny fraction of the population (hell, a tiny fraction of the software development population!) is of dubious success. Just about anyone's pet language can achieve that much. What sees you consider it to be more?

Also interesting that you consider UTF-8 to be a failure. From my vantage point, that was, by far, the most successful thing they created. Nearly the entire world's population is making use of that work nowadays. Most people can only dream of failing like that.

That conclusion, though... We still have no idea what this has to do with the topic at hand. Again, don't let me make you feel rushed to get your replies out. I am happy to wait until you are complete in writing that.
Very nice work and very well deserved the front page #2 spot! Thank you!
>Every Python developer has heard about the GIL

Sadly, that is not the world we live in.

I've cleaned up dozens of applications written by people with flawed understandings of threads, multiprocessing, and asyncio. I don't even blame the developers for this; it's a glaring language design problem.

If you need parallelism, Python is not the language you should reach for. Nobody ever takes my word for it until it's release day and the product is a broken pile of spaghetti code.
Meta Quest mobile app is getting a new name and look
Looks like Meta is going all in on the Horizon brand. Tying VR to Social across all channels, Google+ style.
My response was intended as sarcasm. But eventually, I don't think it will be a two-tiered system. You simply won't be allowed to fly without what is currently required for precheck.

And fwiw, I don't think the strong argument against precheck has to do with social class... it's not terribly expensive, and anyone can do it. It's just a further invasion of privacy.
Shein, Temu face uncertain times in South Africa, EU, etc. amid high-tariff push
SolarWinds story was quickly forgotten, and this one will be too, and we'll continue to build such special single points of global catastrophic failure into our craftly architected decentralized highly robust horizontally scaled multi-datacenter-region systems
As in, does the OS require the internet so CrowdStrike can send telemetry data OR will it skip that step and just boot the OS like normal?
This had to have been only for FAANG companies right? I'm not saying it's unheard of, but I've done dozens of interviews and I've never had more than 1 all day on site. I'm not even sure anything else even justifies it in terms of time spent interviewing and compensation levels.
Right and they need to get the general public interested in this stuff, not nerds on the nerdsite
It does not astound me. Building things underground is expensive and in a lot of cases not cost effective compared to the cost of electricity at human scale.
They should’ve been.
It’s a matter of getting a critical mass of people who do that. In other words, changing the general culture. I’m lucky to work at a company that more or less has that culture.
You can make a system tolerant to certain faults. Other faults are left "untolerated".

A system that can tolerate anything, so have perfect availability, seems clearly impossible. So yeah, totally right, it's always a tradeoff. That's reasonable, as long as you trade smart.

I wonder if the people deciding to install Crowdstrike are aware of this. If they traded intentionally, and this is something they accepted, I guess it's fine. If not... I further wonder if they will change anything in the aftermath.
Lisan Al Ghaib!
Which of course begs the question: How were they able to do that? Was there no internal review? What about automated processes?

For an organization it's always the easiest, most convenient answer to blame a single scapegoat, maybe fire them... but if a single bad decision or error from an employee has this kind of impact, there's always a lack of safety nets.
Does anyone understand what a channel file is? Some sort of patch/dll that a driver loads?
I have to say, it saved our ass a few months ago. Some hacker got access to one of multiple brands server infrastructure, started running PowerShell to weed through the rest and CrowdStrike notified us (the owning brand) that something was off about the PowerShell being ran. Turns out this small brand was running a remote in tool that had an exploit. Had Crowdstrike not been on that server we wouldn't have known until someone manually got in there to look at it.
I just wrote a post about how the Cpython is much faster without GIL:https://news.ycombinator.com/item?id=40988244
I'd thought of going to Greenland when I was in Iceland, but finally the 3-hour flights and lack of much tourist infrastructure finally dissuaded me.

At least in Bishkek you can go to other places, like Samarkand (only a 12-hour drive /s )
> Encrypted content is pretty much indistinguishable from noise or interference.

Wrong. This is only true in the sense that the bits sent appear to be randomly chosen. Encrypted content sent over radio is still going to adhere to a modulation scheme like FSK, QSK, or something. A simpler analogue is sending coded Morse code. Yes, the dots and dashes appear random, but it's certainly not noise you can very clearly recognize it as Morse. Also, you need to send your callsign in clear text in each transmission. So people will see your call sign and then unintelligible bits after it, and it's easily recognized as encrypted transmissions.

What you're describing is more akin to frequency hopping where RF transmissions are sent out over a broad spectrum. But even then it's still distinguishable from noise unless a very fast hop interval is used.

You're right that you'll probably not get in trouble for it. The FCC really only cares if you're disrupting much more important activities.
> overcoming everyone else's shared distress in admitting the emperor has no clothes

I don't disagree, but why do we do we react this way? Doesn't knowing the emperor has no clothes instill a bit of hope that things can change? I feel for the people who were impacted by this, but I'm also a little bit excited. Like... NOW can we fix it? Please?
There are a lot of things running Windows because it's pretty straightforward to write a user-mode driver to interact with custom hardware compared to Linux, where every driver needs to be in the kernel and built with the kernel. Yes, there's DKMS, but it's still more of a faff than the relatively plug-and-play mechanism that Windows offers, especially since Vista.
- This is system has a single point of failure, it is not fault tolerant. Lets introduce these three things to make it fault-tolerant
- Now you have three single points of failure...
Show HN: I built a free tool to analyze your TikTok, Reels and Shorts Account
Hey everyone,

I made a tool that analyzes any TikTok, Reels, and Shorts account in 2 minutes. It gives you advanced insights on your videos, viral stats, outliers, and more.

It's completely free to use. No signup/login.

Would love some feedback from you guys!
You are assuming there are no collusions among players (agreements to play against another one). That perturbs the Nash optimality.
Can you share some basic insight into how your system processes an open source repo to generate a wiki with a hierarchy and structure that maps to the same or similar hierarchy and structure of the codebase?

I can understand the value of marrying that wiki to the codebase and how that would help LLM's better "understand" the codebase.

What I'm lost on is how you can auto-generate that wiki in the first place (in a high quality way). I presume it's not perfect, but a very interesting problem space and would love to hear what you've learned and what you are trying to accomplish this feat!

Thanks for posting btw, this HN comments section has been INCREDIBLE.
These things are "cost optimized" and don't feature the kind of remote management iDRAC/openBMC/piKVM that would allow it to be remotely fixed. Embedded windows connected to the internet is super ***.
Structured Output from LLMs Reliably
The debugger? You mean console.log("here") ?
I love how the hover text references https://xkcd.com/303/
"They don't like it up 'em" - well-known phrase from the British sitcom 'Dad's Army'.
https://archive.ph/r2OfZ
What you say doesn’t contradict my comment. I’m sure that CrowdStrike has disclaimers.
> "Windows has been notorious for forcing updates down your throat"

in the same way cars are notorious for forcing you to run out of gas while you're driving them and leaving you stranded... because you didn't make time to refill them before it became a problem.

> "Things like this is exactly why people hate auto-updates."

And people also hate making time for routine maintenance, and hate getting malware from exploits they didn't patch, and companies hate getting DDoS'd by compromised Windows PCs the owners didn't patch, and companies hate downtime from attackers taking them offline. There isn't an answer which will please everyone.
It could be like an "insurance" where people pay for politician lobbying. Pool our resources and put it in the right spots.
Wondering, how were you affected if you didn't update?
Why would they give up on three sources of extra revenue?
Chess manages in practice to be a game of imperfect information, like poker. Obviously it is explicitly a game of perfect information on the board, but the hidden information is all psychological. For instance: "do they actually know this opening/endgame? do they see a tactic? did they take a long time because they calculated that it's a good move, or are they bluffing by making it seem like they calculated something? are they actually better than me or just acting like they are?". etc.

It's true that "bluffing has minimal value against best play", but no human is in that situation. Even super-GMs will play "bluffs" if they are behind (or playing a lower-rated player and sure they can recover later. or just for fun if the stakes are low).

And that's not even mentioning optimal strategy under time pressure. For instance some of the Lichess tournaments are structured such that winning fast is more valuable than winning slowly because the resulting score comes from how many wins you can get in (or in other cases, how big of a streak you can get). So people will play in a way that optimizes for winning quickly by taking big bets / bluffing / creating chaos with un-calculated gambits, especially if they have a good reason to believe they're better than their opponents.
I have so many tablets and cheap phones that don't have the storage to play high-end mobile games, it would make a difference to me if I could expand my memory easily. (Edit: some folks got excited because I said "memory" when I meant "storage")
When I lived in Sierra Leone circa 2012, a lot of expats had phones like this. Ruggedized, could handle anything - dust, falling into a silty river, anything. Many a game of catch were played with them.
don't call a thing stupid until you find out it's beautiful (and i've just found out that your site actually is, let alone hilarious).
>And if you cannot actually abandon someone like microsoft that consistantly screws up their QA

The last outage I can remember due to an ms update was 7 or 8 years ago. Desktops got stuck on 'update 100% complete'. After a couple of minutes I pressed ctrl+alt+del and it cleared. Before that...I don't remember. Btw MS provides excellent tools to manage updates, and you can apply them on a rolling basis.
Does it have to be an SBC?

A modern MCU will absolutely run circles around the processing and memory capabilities of the Model 100, and can probably even do that for 20 hours using four AA batteries.
Playing stupid games with accounts payable is standard big corporation bullshit. It is so refreshing to work with corporations that don't play those games, although they are the exception rather than the norm.
We had cylance take out all of our kubernetes clusters a few years ago.

The whole cybersecurity concept of installing third party mystery meat in the kernel controllable over the internet by a different company seems contrary both to good security practices and software quality assurance, immutable production architecture and repeatable builds.
Universities Don't Want AI Research to Leave Them Behind
Do any old Android phones have this combination?
> Isn't Crowdstrike the same company the heavily lobbied to get make all their features a requirement for government computers?

Do you have any more sources on this specifically? The link you gave doesn't seem to reference anything specific.
Well, probably no?
I've never seen liabilities in dollar value, or rather any significant value. Also I saw our company Ceowdstrike contract for 10k+ seats, no liabilities there.
Well, how else is the operator supposed to see outside?
Makes me think the Soviets may have been correct in their obsession over Venus, if only by sheer luck.
Not sure what the OS has to do with CrowdStrike's fuckup. CrowdStrike also runs on Linux and macOS.
GP was talking about correctly convicted prisoners who had completed their sentences, you are talking about wrongful convictions. You seem to think you replied to someone upthread who told a different story about wrongful convictions in Florida, but have inadvertently replied to the wrong person.
Just read the comment you replied to. You're charged if found not guilty.