skysight-inc/HackerNews huggingface dataset:
This sort of emergent behavior is a feature, not a bug.

Operating systems that don't require frequent security patches aren't profitable.

Anyway, this is the step of late-phase capitalism that comes after enshittification. Ghost in the Shell 2045 calls it "sustainable war". I'd link to an article, but they're all full of spoilers in the first paragraph.

It probably suffices to say that the series refers to it as capitalism in its most elegant form: It is an economic device that can continue to function without any external inputs, and it has some sort of self-regulatory property that means the collateral damage it causes is just below the threshold where society collapses.

In the case of Cloud Strike, the body count is low enough, and plausible deniability is low enough that the government can get away with not jailing anyone.

Instead, the event will increase the money spent on security theater, and probably lead to a new regulatory framework that leads to yet-another layer of mandatory buggy security crapware (which Cloud Strike apparently is).

In turn, that'll lower the margins of anyone that uses computers in the US by something like 0.1%, and that wealth will be transferred into the industry segment responsible for the debacle in the first place. Ideally, the next layer of garbage will have a bigger blast radius, allowing the computer security complex to siphon additional margins.
> Restaurants can refuse access to non-customers.

And many do, because of the repeated experiences of non-customers destroying the restrooms. They aren't doing it just to be dicks to people who need to pee but don't want to buy something.
It's not the same problem at all.

Troubleshooting an issue like this when I have the time and am prepared for a potential outage (with human resources hot and standing by for immediate action) is VASTLY different than encountering it the evening before some critical deadline for a multi-million dollar project (as Murphy's Law will be sure to have it).

When I have control over the deployment of updates I can push them through my own QA environment first, to uncover many of these kinds of issues before they hit production. Vendors pushing them out on their whim leaves me subject to whatever fast and loose practice they use and prevents me from being able to properly manage my own infrastructure.

A slow rollout certainly helps but doesn't satisfy the kind of 9's I demand in the environments I care for.
Governments don't know what has positive ROI... because they don't care about it. Private companies would go down if they do projects with negative ROI.

Tell me the incentives and I'll tell you the result.
No, and I've no idea where you got that from. Here's the HN Title:

"CrowdStrike debacle provides road map of American vulnerabilities to adversaries"

My assertion: America's serious-threat adversaries already had far more detailed road maps, years ago. The intel value of whatever "road map" data they got from the CrowdStrike debacle was pretty marginal.

Neither the HN Title nor I said anything about backdoors. And within 2 para's, the NYT story makes it clear that CloudStrike's Big Oopsied had nothing to do with bad guys hacking anything.
I think the special effects were a problem at the time - Zaphod's heads never really looked good.
The fact that we haven't solved the methane leak problem, despite methane being valuable, makes me think that carbon capture that involves pumping CO2 into caves or whatever will have zero chance of success. Anyone promoting such tech is, IMO, a fraud.
This is very cool work. Nice to see the adults in charge somewhere, planning for managing and mitigating anticipatable disasters that haven't happened yet. Much better than disaster mitigation after the fact.
Really, the problem is that all this critical infrastructure runs on Windows. Critical systems should effectively be appliances that run with a very minimal footprint. If you absolutely need to monitor them you can export disk snapshots or something out of band that can't impact operations.
> There will be consequences, no? Billion dollar lawsuits that cause real and severe damage?

Those lawsuits will be directed at the corporation - which well insulates those who dictate corporate action.

The author seemingly wants to extract the coders from the company structure and have them bear the full weight of the consequences, instead. This would insulate not only the decision makers but the corporation as well.

If there was a gauge like this Evil <---> Ethical, the author's suggestion would land well to the left.
I lived in BGD back in the 70’s, and the same two alternating dynasties still seem to have a hold on the country. Very sad.
I do donate. I do not expect them to be patriots and go die in a trench, but I also expect them to not be creeps and dickheads abroad. Their behaviour and narration presents a couple of cash-rich, entitled people detached from reality. They are not helping their own cause.
How does crowdstrike protect against instructions being saved on the wrong patient’s record?
Actually, I think entitlement is the wrong word. Maybe more like "window washing panhandler who's upset because you don't give them money for their service"
5 hmac-sha256's per signature are slow?
The headline reminded me of the Vernor Vinge book A Deepness in the Sky.
That's just normal in Italy. The seats are often missing. People are used to it.
even web3 could protect a16z ugh, thats very bad
If CrowdStrike's system wasn't able to prevent a kernel driver thats all zeros from getting by, you can be sure a malicious payload would have breezed right through.
Lessons from CrowdStrike's Buggy Update
Zig is amazing. What started as a one-man project is becoming a mature software ecosystem capable of standing on its own as a peer with the major languages.
> I would not be surprised to see Mangroves at that latitude.

You should be! Per TFA: "60 miles north of its previously recorded range—by far the northernmost mangrove in the U.S"

IMHO each observation of a new out-of-range specimen will be unsurprising without remembering the poetic lessons of infinitesimals, ex. Ship of Theseus, if not the prosaics of infinitesimals themselves.

> It's probably more surprising that these areas aren't already subtropical.

Given my surprise at this comment, I think I may be missing the significance in the switch from unsurprising there's a new record for US mangrove latitude to surprising it wasn't already subtropical. Is a mangrove a sufficient condition for being subtropical? Is it a necessary condition? My understanding is Florida is firmly subtropical on all the tentpoles: hot summers, mild winters, and rarity of frosts (famously, enabling its orange farming).

> Climate change seems to reduce whatever factor caused the cooling there.

Occam's Razor would say this adds an unneeded factor of a previously-unknown-to-humanity outlier cooled state, to further an irrational argument that it isn't surprising.
Florida Administrative Code Chapter 61C-1.004 2.a requires at least one bathroom for "its employees and guests". It is not clear to me if that means one is required to consider non-customers as "guests". But there is more law than the Florida Building Code.

https://www.flrules.org/gateway/readFile.asp?sid=0&tid=27562...
I am not aware of any good one, but I realized you could probably mechanically extract such a map from Lean's mathlib[0][1].

Since Lean builds everything from scratch, this should be doable, albeit Lean builds everything on top of type theory which is not the only choice possible. Different foundations will result in a different graph.

Also the best way to learn math is probably not by following this sort of graph, it would be far too abstract and disconnected from both the real world and usual practical applications.

[0] https://leanprover-community.github.io/mathlib4_docs/

[1] https://github.com/leanprover-community/mathlib4
External networks are required but it should be possible to air gap the critical stuff to read only. It’s just that it’s costly and hospitals are poor/cheap
Remembering that employees build what they're told to build: Who is the "we" in your pondering?
Wait until you hear about the cost of food, shelter, and healthcare…
The HTMLRewriter API is pleasant to work with. Bun has implemented it in addition to Cloudflare Workers. I would love for WinterCG to work on standardizing this API across JS runtimes so that I don't have to interact with lol-html across a WASM boundary in Node and Deno.
unhandled null in rust will still cause panic. still cause the bootloop.
Because there's stuff money can't buy back, and in a lot of cases, that's human life and health. (1)

And do the markets really decide? Do you really think the C-suite of Crowdstrike is going to spend the rest of their lives destitute for the losses they caused? Of course not. We have laws on the books that limit liability of businesses in these situations, and the "let the market decide" crowd are the first people to tell you these laws are a good idea because you can't possibly expect George Kurtz to do business in an environment where his 3 billion dollar fortune could be completely wiped out as the result of a court case, no matter how much damage his company did.

Meanwhile the people who were screwed by this whole thing will be lucky to get a few grand out of a class-action judgment or settlement in five years.

Markets _never_ actually decide. Not in a way that makes peaceful human society possible. You have to introduce systems to give minor players a way to redress grievances, or they'll find their own, often through less-than-sporting means.

(1)
Table salt has iodine and other additives. Use kosher salt or pickling salt.
bombcar's guide to determining if you're a nice part of town - how easy it is to get to a restroom

nicest places? good signage, no need to even interact with a human, restrooms that look like the Taj Mahal.

middling places? restrooms exist, but you might have to ask

bad places? restrooms are hidden, maybe if the clerk is nice you can use theirs, or you have to buy something

horrible places? restrooms that do exist look like something from a horror movie, they're locked stronger than Fort Knox, and even then you have to buy, beg just to borrow the key
The last time I went I just had to blip my credit/debit card. Very convenient. (Stockholm Central Station, Sweden).
I agree it does seem very impressive. My first thought was that they must be using LLVM for the backend, but it looks like no, it's fully 'self-contained'.
Netware existed and thrived before NT LAN Manager. NT LAN Manager seemed like the one MS product that couldn't make inroads against established competition. It simply wasn't as good as Netware.

The way I remember it NLMs were pretty stable. Anything on Windows was not stable, userspace or otherwise. Netware's TUI was just as good as NT's GUI for what it needed to do. It wasn't a liability. Netware's superior directory service was more important.

Netware's demise was the transition from IPX to TCIP/IP and the explosion of the WWW. And from my perspective it wasn't really NT that knocked Netware down. It was Linux and Solaris. Novell kinda saw that coming and tried to figure out a future with SuSE. They just never got the combination of their directory server with Linux right in time. Microsoft stumbled around for some years, but they got their directory services figured out before Novell got their OS story straight in the new world.
For people with Down syndrome, a longer life, but under a cloud
Nobody seems to be saying that the failure was one of properly testing their release.

Even the CrowdStrike blog said it was doing a root cause analysis into how that poor logic was introduced.

That isn't the point; all software can have bugs. This is a failure of their QA process. It was clearly quite easy to trigger the problem.
Wondering how this can be used in the digital audio tech space. Collaborative tools in DAWs would be amazing!
Hungary facing fuel crisis as Ukraine turns up heat on Russian oil supplies
I happen to be on vacation with a former crowdstrike employee right now, they said none of their old coworker/friends are saying anything. I’m guessing internal comms went out to lock everything down
You do realize that CrowdStrike also runs on Linux and that there have been a variety of instances of bad CrowdStrike updates breaking Linux machines, right?

https://access.redhat.com/solutions/7068083
The update here is relevant to catch 0day exploit.

Without the update, your system is "naked" for the duration.
One could make the argument that automatically patched software is, in aggregate, more secure/less problematic than chronically under-patched software that requires manual, human attention.
I’m sure they will rebrand
> We need more whistle blower protections.

Fully true. But working against that is a human trend so entrenched it isn't discussed.

No one anywhere want to clean their own house.
Semaglutide for weight loss isn't off label. Using Semaglutide in the Ozempic auto-dispenser is off-label. Using it in a different syringe sold under the name Wegovy is the only difference. Same drug, different packaging. It is the exact same medication, delivered via injection, except one is sold in a fancier syringe.

Either way, off-label usage of drugs doesn't bother me. If someone is using off-label Benzodiazepines as an effective treatment under the supervision of a competent doctor, that seems like a good thing. Sometimes I use bandaids to protect against blisters even though the packaging doesn't indicate that usage. It isn't a moral failing to get an effective use out of something that wasn't designed for it?

> Obesity in places like the US is mainly cultural. By trying to solve the problem with technology instead of changing the attitude towards health, they will only become more dependent on drugs.

What you aren't grasping is that actual experts don't see it this way. The use of Semaglutide points to the fact that obesity is caused, at least in part, by a hormonal imbalance. How is culture unbalancing hormones? Experts still don't understand why so many people in some areas are affected. Actual scientists have done controlled studies and found that culturally similar people in different geographies have wildly varying rates of obesity. We live in a culture, where (as you have proven) people will openly judge, insult and shame strangers for being fat. Being fat isn't culturally accepted anywhere (maybe a few isolated cultures are the exception). Nobody wants to be fat. There is a multi-billion dollar industry that serves people doing everything they can to NOT be fat, and it is notoriously ineffective.

If being dependent on pharmaceutical intervention is what it takes to help people live longer, more independent lives, that costs society less in the long run, then that's fine. We happily accept lifelong pharmaceutical dependency for a range of conditions, including ones that are purely quality of life related. Do you go around telling burn victims that cosmetic reconstructive surgery is a moral failing?

I understand that lifestyle affects weight. "Eat less and exercise more". Every fat person already knows this. People who have the willpower to get PHDs, to run successful companies, to do every difficult thing in life, fail at losing weight and keeping it off. Being fat is not a moral failing.

Its like telling depressed people to cheer up. It doesn't work, and it isn't a moral failing to have clinical depression. Lifestyle choices can affect depression, and it is treatable without medication sometimes. But oftentimes pharmaceutical interventions are the best option.
There was also this report of CrowdStrike injecting a buggy DLL into Windows applications, which could cause the app to crash through no fault of its own:

https://x.com/molecularmusing/status/1808756095860543916
Exercises in textbooks usually focus on proofs, but mathematics isn't just about proving theorems. Mathematics is also about:

1. Understanding mathematical concepts (e.g. what is an "acyclic" relation? What is KL divergence?) and theories (several interrelated concepts, e.g. decision theory). This also includes knowing why those concepts are important in the first place, which is often neglected.

2. Knowing the meaning of mathematical notation and technical terms, e.g. to be able to read papers in some field. Papers are often full of mathematical and other jargon while otherwise not necessarily being difficult to follow.

3. Learning mathematical formulas (e.g. Bayes' rule) and algorithms (e.g. differentiation), in order to solve specific problems by calculation or computation (mostly in applied mathematics, more rarely in pure mathematics)

4. Proving conjectures (mostly in pure mathematics, less often in applied mathematics)

5. Learning how to formalize informal problems using mathematical concepts and theories (by applying conceptual understanding gained by 1) in order to understand the problem better, or to make it easier to solve, e.g. by employing calculation (2). (This is often done in engineering and science)

Problem sets in textbooks often focus on proofs (4) or some more difficult algorithms (3) but less on the other applications of mathematics.

They could also check conceptual understanding (1) by asking the reader to explain some concept in their own terms, or how two different concepts relate to each other, or which concepts various example cases have in common, or how the cases differ on a conceptual level. Though verifying the answers might require a human teacher.

5) could be taught by coming up with word problems from a scientific or engineering (or economics etc) example, where the solution is easy once the correct formalization is known.

Unfortunately it is hard to come up with such artificial word problems in which the correct formalization is unique, non-trivial, and doesn't require technical background knowledge from engineering/science etc.

Moreover, in the real world, the difficulty with formalization is often to recognize in the first place that there is some problem that could be formalized, which can't be replicated in an artificial word problem.

Overall, coming up with good exercises, especially for 5, but also partly for 1, might require the writer of the textbook to know a lot of possible practical applications. Writers of math textbooks are often mathematicians, so they probably don't know a lot about engineering, computer science, empirical science etc in order to come up with good word problems.
Ah thanks. I've made the title questionable now.
It will rename itself pay some damages and keep fing up
Don't forget that Methane decays into water vapour and CO2
My slightly out of date iPhone has a hard time rendering this site. Choppy scrolling, delayed/choppy animations.

If it aint fast, it aint worth it
What if work isn't scarce so companies can get all workforce they need without considering most people then not everyone has to and it's still true.
+1 to the lol_html HTML rewriter. Basically you can give it a bunch of selectors and code that will do whatever with what is matching. It's very fast and quite nice. It has bindings to Lua and a few more, but not to Python.

https://crates.io/crates/lol_html
Apple Maps already shows restrooms available publicly - search "restroom" and you'll see.

But it finds things like mall bathrooms and park bathrooms but not gas station bathrooms, at least the first time I tried it.

The real problem is when you're in an unfamiliar area and don't know the local secrets about where restrooms can be found.
Airport staff need to be able to support them. Not HN types.

Most people know how to use a windows computer.

Most IT desktop support knows how to use and manage windows. Even building facilities folks can help support them.

Microsoft makes it easy to manage a fleet of computers. They also provide first party (along with thousands of 3rd parties) training and certifications for it.

Windows are the de facto Business Machines.

Most signage companies use windows.

Finding someone who knows a BSD is not easy.
That entire thing was caused by stupid draconian regulation.

Systems like CrowdStrike are mandated, not hired freely.
I remember as a poor student, having to pay the equivalent of 50 cents felt like robbery. Today with a steady income I’m happy to pay a dollar, or even two, to be able to use a clean restroom.

I think the general problem is interesting: how do we price necessities when our ability to pay is so different?
Oh yeah, at a quick glance looks like that file could have had any payload and it would have been loaded right into the kernel.
Easy: plenty people in this forum aren't entrenched in the security field.

That's why there are so many misinformed assumptions
> Any thoughts?

10–50 pages per second is already more output than a human can produce input for, so it shouldn't be considered a problem.
> We do not incentivize companies to operate secure, redundant, reliable computer systems.

Except in the gambling industry. As part of a long-standing tradition, companies in the gambling industry are usually contractually required to take financial responsibility for errors.
GTECH's annual report, before they were acquired by an Italian company, says "We paid or incurred liquidated damages with respect to our contracts in an amount equal to 0.61%, 0.18%, 0.50%, 0.47% and 0.14% of our annual revenues in fiscal 2006, 2005, 2004, 2003 and 2002, respectively."[1]

So, forcing a transaction process service to take full responsibility for errors cost, at worst, 0.61% of revenue. This is sufficient to force gambling companies to use unusually good security technologies.

The Nevada Gambling Commission has technical rules.[2]

* "On-line slot systems may only communicate with equipment or programs external to the system
through a secure interface. This interface will specifically not allow any external connection to directly access the alterable data of the system." Which means no privileged "security" systems such as Crowdstrike.

* "Gaming device application
access to the system based game must be logged automatically on the system component of the
game and on a computer or other logging device that resides outside the secure area and is not
accessible to the individual(s) accessing the secure area." Which means the really important info must not only be logged, the logs have to be kept where the people who run the systems can't get at them. There are more logging requirements. Most things require two logs, one used for normal operation and a remote backup with tamper resistance and secure hashes.

* "Conditions for changing active software on a conventional gaming device or client
station that is part of a system supported or system based game:
(a) Be in the idle mode with no errors or tilts, no play and no credits on the machine for at least
two (2) minutes;
(b) Not be participating in an in-house or inter-casino linked payoff schedule..." There's more, but the general idea is that to change anything, you have to take the component being changed down to the idle, fully backed up state. Only then can changes be applied. All of which are logged.

The gaming industry has faced hostile actors for decades. They have reasonably strong defenses. Yet they're still very profitable.

[1] https://www.sec.gov/Archives/edgar/data/857323/0000950123060...

[2] https://gaming.nv.gov/uploadedFiles/gamingnvgov/content/Home...
Combine it with AI video recognition. If you walk up calmly its $1, if you're dancing around and crossing your legs it's $5.
You might be thinking of the US Digital Service (https://www.usds.gov/)