skysight-inc/HackerNews huggingface dataset:
Debian has 2/3 stages of software deployment that I know of: Unstable, Testing and Stable. By the time it comes to stable it has been quite extensively tested. The exceptions are only security updates which you may want to get very quickly anyway. I really recommend Debian (in particular with unattended security upgrades) for severs.

Other distros have this as well (Thumbleweed, Void, etc.), and I really think most people should not be using recently-deployed software. A small community using them however helps testing so the rest of us can have more stability. Which is why I don't recommend using Arch (or Debian unstable) for general users, unless you specifically want to help testing and accept the risk.

Also randomizing update schedules by at least a few hours does seem very wise (I don't think even the most urgent updates would make or break in say 6 hours of randomization?)
Exactly. Notably, in my experiments, diffusion models based on U-Nets (e.g. SD1.4, SD2) are worse at capturing "correlations at a distance" like this in comparison to newer, DiT-based methods (e.g. SD3, PixArt).
Odd that you choose Windows to swipe at when this was largely CRWD's problem + a mix of awful due diligence by IT departments.
phew...glad that mystery is solved.
GANs do that, I don't think LLMs do. I think LLMs are mostly trained on "how do I recon a human would rate this answer?", or at least the default ChatGPT models are and that's the topic at the root of this thread. That's allowed to be a different distribution to the source material.

Observable: ChatGPT quite often used to just outright says "As a large language model trained by OpenAI…", which is a dead giveaway.
NTFS guarantees file-system metadata integrity, not file data integrity. Subtle but important difference.

The file was corrupted, but the file-system remained consistent.
Yeah in Radiology we depend on Epic and a remote reading service called VRAD. VRAD runs on AWS and went down just after 0130 hrs EST. Without Epic & VRAD we were pretty helpless.
Non-gradual-rollout updates are an exacerbating factor, but it isn't a root cause.
If you have to write your own CMS, make it compile to static files. I did that with Django, used Django-distill, and it's hands down the best static site generator I've ever used. My site never needs updates and never goes down under any amount of load.
I am all for naming people by name next to their actions. There is pushback, but you have the benefit of your statements being factually correct.
"It's the "fuck you I got mine" human mentality."

I would argue that it is more of learned helplessness.

My experience from 35 years of democracy in my country is that either you vote for corrupt old crooks, or you vote for outsider rebels who promise to uproot corruption only to become corrupt crooks themselves once they got to the levers of power.

Once you witness the same process iterating itself five or six times, you start regarding corruption as approximately as inevitable as aging or bad weather.
I’ve supported enterprise software for various big companies and I can tell you that most decision makers for DCs agree with this sentiment.

EMC had a system called Target Code which was typically the last patch in the second-last family. But only after it had been in use for some months and/or percentage of customer install base. It was common sense and customers loved it. You don’t want your storage to go down for unexpected changes.

Dell tried to change that to “latest is target” and customers weren’t convinced. Account managers sheepishly carried on an imitation of the old better system. Somehow from a PR point of view, it’s easier to cause new problems than let the known ones occur.
Sure, gradual rollout seems obviously desirable, but think of it from a liability perspective.

You roll out a patch to 1% of systems, and then a few of the remaining 99% get attacked and they sue you for having a solution but not making it available to them. It won't matter that your sales contract explains that this is how it works and the rollout is gradual and random.

Just a thought.
maybe that's what's required for critical infrastructure
When notepad hits an unhandled exception and the OS decides it's in an unpredictable state, the OS shuts down notepad's process. When there's an unhandled exception in kernel mode, the OS shuts down the entire computer. That's a BSOD in Windows or a kernel panic in Linux. The problem isn't that CrowdStrike is a normal user mode application that is taking down Windows because Windows just lets that happen, it's that CrowdStrike has faulty code that runs in kernel mode. This isn't unique to Windows or Linux.

The main reason they need to run in kernel mode is you can't do behavior monitoring hooks in user mode without making your security tool open to detection and evasion. For example, if your security tool wants to detect whenever a process calls ShellExecute, you can inject a DLL into the process that hooks the ShellExecute API, but malware can just check for that in its own process and either work around it or refuse to run. That means the hook needs to be in kernel mode, or the OS needs to provide instrumentation that allows third party code to monitor calls like that without running in kernel mode.

IMO, Windows (and probably any OS you're likely to encounter in the wild) could do better providing that kind of instrumentation. Windows and Office have made progress in the last several years with things like enabling monitoring of PowerShell and VBA script block execution, but it's not enough that solutions like CrowdStrike can do their thing without going low level.

Beyond that, there's also going to be a huge latency between when a security researcher finds a new technique for creating processes, doing persistence, or whatever and when the engineering team for an OS can update their instrumentation to support detecting it, so there's always going to be some need for a presence in kernel mode if you want up to date protection.
Really, the example would be refusing to serve browsers that are standards compliant but aren't blessed by some certification authority, kind of like what they tried to pull with WEI. I'm sure FOSS developers will be able to keep up the passkey certification regime as well as the big boys, right?
Exactly! :(

I am drifting towards hating to turn on my computer in the morning. The whole day is like pissing into the wind, trying to find workaround of annoyances or even malfunctions, getting rid of obstructive noise from all direction, my productivity using modern computer systems is diminishing compared to where it was just mere 10-15 years ago (still better than 25 years ago not only becuase of experience but also the access of information on demand). Very depressing. I should have became a farmer perhaps.
The only thing that got Unabomber blacklisted is that he started to send bombs to people. His manifesto was dime a dozen, half the time you can expect politician boosting such stuff for temporary polling wins.

Hell, if we take his alleged (don't have vetted the genealogy tree) cousins, his body count isn't even that impressive.
Well, I care about tiny details like that, so always appreciate such comments (:

I'll try to see what I can do about it to make the transition easier on the eyes, so thanks for the feedback.
Don’t think you’re getting 50k views pm in finance space with some “you’re an expert blog writer” AI spiel
Rare footage of largest uncontacted tribe in the world [video]
In the past, old versions of Windows were often considered superior because they stopped changing and just kept working. Today, that strategy is breaking down because attackers have a lot more technology available to them: a huge database of exploits, faster computers, IoT botnets, and so on. I suspect we're going to see a shift in the type of operating system hospitals run. It might be Linux or a more hardened version of Windows. Either way, the OS vendor should provide all security infrastructure, not a third party like Crowdstrike, IMHO.
>Doing a page fault where you can't in the kernel is exactly what I did with my very first patch I submitted after I joined the Microsoft BitLocker team in 2009.

Hello from a fellow BitLocker dev from this time! I think I know who this is, but I'm not sure and don't want to say your name if you want it private. Was one of your Win10 features implementing passphrase support for the OS drive? In any case, feel free to reach out and catch up. My contact info is in my profile.
> yes CRWD is a shitty company but seems they are a "necessity" by some stupid audit/regulatory board that oversees these industries.

Yep, this is the problem. The part about Windows is a distraction here.

That bullshit regulation is a much larger security issue than Windows. Incomparably so. If you run it over Linux, you'll get basically the same lack of security.
That's because there is no systematic solution to the real problems.
That’s the first output from ChatGPT. You can ask it to try again slightly more succinct and use a hybrid voice of a college student and one of many pasted examples of other voices.
OK, settled the case. Luckily my lawyer was working pro bono as he racked up over $600K in billable hours I understand. I'm waiting for an email back to see if I can discuss it or whether it is NDA'd lol. The judge said that she had never seen any institution so stubbornly against fixing what they were legally entitled to fix.
While Linux isn't a panacea, the OS does matter as Linux provides tools for security scanners like Crowdstrike to operate entirely in userspace, with just a sandboxed eBPF program performing the filtering and blocking within the kernel. And yes, CrowdStrike supports this mode of operation, which I'll be advocating we switch over to on Monday. So yeah, for this specific issue, Linux provides a specific feature that would have prevented this issue.
The same number of eyes will still be driven to a subset of content by algorithmic influence. Whether search engines, algorithmically-generated "viral" popularity, or whatever. Most people are consuming whatever is placed in front of their faces. That content will still have value, the trick will be getting your content into that subset.
As in, there was no way to have configured the sensors to prevent this? They were just going to get this if they were connected to the internet? If I was an admin that would make me very angry.
> Want to know an LLM's limits?

Not a specific LLM's limits, the limits of LLMs as an architecture.
I was going to disagree with the article because the content 4o-mini generates isn't there yet.

I run a content site that is fully AI generated, https://tryspellbound.com

It writes content that's worth reading, but it's extremely expensive to run. It requires chain of thought, a RAG pipeline, self-revision and more.

I spent most of yesterday testing it and pushed it to beta, but the writing feels stilted and clearly LLM generated. The inflection point will come for content people actually want to read, but it's not going to be GPT-4o mini.
BERT didn’t go anywhere and I have seen fine-tuned BERT backbones everywhere. They are useful for generating embeddings to be used downstream, and small enough to be handled on consumer (pre Ampere) hardware. One of the trends I have seen is scaling BERT down rather than up, since BERT already gave good performance, we want to be able to do it faster and cheaper. That gave rise to RoBERTa, ALBERT and distillBERT.

T5 I have worked less with but I would be curious about its head to head performance with decoder-only models these days. My guess is the downsides from before (context window limitations) are less of a factor than they used to be.
A lot of your users encountering file corruption on Windows either means that somehow your users are much more likely to have broken hardware, or more realistically that you have a bug in your code/libraries.
Does Starlink work in Bangladesh?
>If I were to - by some stroke of magic, seeing as I'm neither a US resident or citizen - be put on a US jury, I don't think I could find a moral justification for convicting someone even if I knew with 100% certainty they were guilty.

That's called Jury Nullification, and if you ever hope to successfully reserve your right to invoke it you best not tip your hat in any way that you have been made aware of it.

Don't search it on your normie-browser search engines, do it on Whonix or TBB. Remain data vigilant!
> tech circles, which historically stood for liberal (progressive/inclusive) values.

Tech used to be about innovation and changing the status quo. But now with tech dominated by huge, publicly owned companies lacking new ideas and focused on their stock price, it's a very different mindset.
A properly used endpoint protection system is a powerful tool for security.

It's just that you can gamble compliance by claiming you have certain controls handled by purchasing crowdstrike... then leave it not properly deployed and without actual real security team in control of it (maybe there will be few underpaid and overworked people getting pestered by BS from management)
Didn't CRWD cause a similar issue with Debian/RHEL a little while ago?

It sounds to me that the problem lies with CRWD and not with whatever OS it's installed on.
> It is a critical problem if your entire record of life-saving drugs you've given them in the past 24 hours suddenly goes down.

Will outages like this motivate a backup paper process? The automated process should save enough information on paper so a switch over to paper process at any time is feasible. Similar to elections.
Why are we still running ANY operating systems based on Ambient Authority, as part of our infrastructure?

DoD shouldn't have given up on MULTICS. That premature optimization is going to sink the US and the Free World.

Personally, I'm still waiting for Genode to be my daily driver.
Given the younger generations increasing ambivalence to the non-stop fire hose of bullshit that the vast majority of the platform internet already is, and given that we're now forging the tools to make said fire hose larger by numerous factors, I don't think this is going to be the boon long-term that a lot of people seem to think it is.
I'm now so reliant on ChatGPT for gSheets, that I'd be almost unable to maintain my sheets' absurd formulas without it.

It's also really accelerated my knowledge / skills of the specifics of the excel language.

Having an LLM being able to directly read/write at the sheet level, instead of just generating formulas for one cell, would be amazing.
Yes, no zero shot. Few shot is possible for some use cases with setfit: https://github.com/huggingface/setfit and the very recent Fastfit: https://github.com/IBM/fastfit ( https://arxiv.org/pdf/2404.12365 )
I just tried asking ChatGPT to rate various BBC and NYT articles out of 10, and it consistently gave all of them a 7 or 8. Then I tried today's featured Wikipedia article, which got a 7, which it revised to an 8 after regenerating the respose. Then I tried the same but with BuzzFeeds hilariously shallow AI-generated travel articles[1] and it also gave those 7 or 8 every time. Then I asked ChatGPT to write a review of the iPhone 20, fed it back, and it gave itself a 7.5 out of 10.

I personally give this experiment a 7, maybe 8 out of 10.

[1] https://www.buzzfeed.com/astoldtobuzzy
ah you are right, I misread the Microsoft notification
There's some irony there in that the whole point of CrowdStrike itself is that it does behavioural based interventions. ie: it notices "unusual" activity over time and then can react to that autonomously. So them telling you they can't engineer it is kind of like them telling you they do don't know how to do a core feature they actually sell and market the product itself doing.
I pretty much agree- most systems don't need updating. I've seen and setup OpenBSD servers that ran for a decade without issues never getting updates. I currently run some production web services on Debian where I do updates every 3 years or so, and no issues.

Leaving something alone that works good is a good strategy. Most of the cars on the road are controlled by ECUs that have never had, and never will have any type of updates, and that is a good thing. Vehicles that can get remote updates like Teslas are going to be much less reliable than one not connected to anything that has a single extensively tested final version.

An OS that is fundamentally secure by design, and then locked down to not do anything non-essential, doesn't really need updates unless, e.g. it is a public facing web server, and the open public facing service/port has a known remote vulnerability, which is pretty rare.
I don't mean to sound conspiratorial, but it's a little early to rule out malfeasance just because of Hanlon's Razor just yet. Most fuckups are not on a ridonkulous global scale. This is looking like the biggest one to date, the Y2K that wasn't.
spoiler: crowdstrike is used by companies running on mac and linux as well
You mean “and therefore requiring businesses that take credit cards to enforce the union of all the restrictions imposed by all six companies (which might not even be possible—the restrictions might be contradictory) in order to accept all six types of cards”
How to pwn a billion dollar VC firm using inspect element
Of all the gambling games to insist you know a secret solution too, roulette has to be one of the funniest.
I'm just impressed that the lifts, alarms, cranes, phones, etc all run on Windows somehow.
The culture around the OS matters.

But this is a 3rd party software with ring-0 access to all of your computers deciding to break them. The technical features of the OS absolutely do not matter.
https://github.com/naftaliharris/tauthon

it's already being done!
Sounds like he has a second job. I would bring this higher up the chain if it happens again. Also have proof with code commits you can show as evidence.
This ^^ person knows their law.

Yes, my case was (probably, maybe) barred from injunctive relief because you can't sue to fix problems at a jail or prison if they release you[0]. Some people have been prematurely released just to activate this option.

You can (sometimes) get declaratory judgment though, which at least declares you a winner and you can then pass the baton to the guy behind you who is still behind bars and use that as a stick to hit the institution over the head with.

And sometimes you can also get monetary damages too, which can be another stick to hit them with.

[0] some exceptions apply if the case is likely to repeat itself, but this argument is very, very hard to muster
I added a licence and will try to build documentation. (For the record this code is 10 days old!)
Merely arguing about your _definition_ of 10x engineer and 1x engineer.

Your original comment at the top of the thread implies the engineer who wrote the blog post is a 1x engineer because they spent so much time finding and fixing this bug.
That's a long grudge to hold over a feature that was reconsidered and removed.
Maybe us?

I mean us as in a network of trusted individuals.

For example, i've been appending "site:reddit.com" to some of my Google queries for a while now —especially when searching for things like reviews— because, otherwise, Google search results are unusable: ads disguised as fake "reviews" rank higher than actual reviews made by people, which is what i'm interested in.

I wouldn't be surprised if we evolve some similar adaptations to deal the flood of AI-generated shit. Like favoring closer-knit communities of people we trust, and penalizing AI sludge when it sips in.

It's still sad though. In the meantime, we might lose a lot of minds to this. Entire generations perhaps. Watching older people fall for AI-generated trash on Facebook is painful. I hope we acted sooner.
(Your user name is wonderful.)

> It's akin to not renewing an SSL certificate.

Your choice of analogies is a good one. I have done SSL type stuff since 1997.

Doesn't matter: I would have to work a few hours very carefully before modifying my web server config. And test it.

I am terrified by scale of deployment involved in this CloudStrike update.
How exactly do you think they model and validate the relationship between clickbait and budget allocation or public sentiment.
Every model has its own unique vibe to it. It's why new models feel better than they are.
Headlines are usually written like this to avoid libel suits. Even if you have a defensible case it’s quite expensive to go through the motions of a lawsuit.
need to play bee gees on windows media player
This seems like a pretty clear example of the philosophical divide between MacOS and Windows.

A good developer with access to the kernel can create "better" security software which does less context switching and has less performance impact. But a bad (incompetent or malicious) developer can do a lot more harm with direct access to the kernel.

We see the exact same reasoning with restricting execution of JIT-compiled code in iOS.
This was a .dll in all but name fwiw.
I don't think people should restate the basic context of the thread for every post... That's a lot of work and noise, and probably the same people who ignore the thread context would also ignore any context a post provided.
Another version of the "fail big" or "big lie" type phenomenon. Impact 1% of your customers and they sue you saying the gradual rollout demonstrates you had prior knowledge of the risk. Impact 100% of your customers and somehow you get off the hook by declaring it a black swan event that couldn't have been foretold.
T5 is LLM, I think first one of them.
Revised Chinchilla scaling laws – LLM compute and token requirements
I LOVE THIS CONCEPT SO MUCH
Crowdstrike/falcon use is not by any means limited to Windows. Plenty of Linux heavy companies mandate it on all infrastructure (although I hope that changes after this incident).
He was the CTO, what do you mean he wasn't in any way involved?
I used to work with state agencies and they run outdated unpatched Windows computers all over the place.

Nowadays I work in medical software and hospitals are running outdated unpatched Windows computers everywhere.

Nobody cares about updates. Almost nobody. I never saw Windows 11. Windows 10 is popular, but there are plenty of Vistas. I'm outright declining supporting Windows XP and we lost some customers over this issue.

My development tools are somewhat outdated, because compilers love to drop old Windows versions and 32-bit architectures, so sometimes I just can't update the compiler. For example I'm stuck with Java 8 for the foreseeable future, because Vista users are too numerous and it's not an option to drop them.

Hacker News is like another world. Yes, I update my computer, but everyone else does not. Even my fellow developers often don't care and just use whatever they got.
So - what is the lesson learned? The only clear message for me is that critical programs that also demand kernel level access maybe shouldn't update themselves.
Oh yeah, FEAT#927261? Would love to see that ticket go out
That is religion. The belief in an eye for an eye to appease Ahura Mazda™, lest our blessings of good fortune run dry next glowing season!
Ask HN: People who were alive when walkmen were introduced. What was it like?
As the title goes, I was chatting with a friend when we saw someone wearing a VR headset in public. We wondered what it was like when people first started carrying around Walkmans. The idea of a Walkman is to isolate you from the rest of the environment with audio. What was that like for the rest of the people in public? I think of the people sitting on a park bench, seeing someone walking by with a Walkman for the first time.
The idea is to have the current system create a backup paper trail from which you practice resuming from for when computers go down. Nothing about current process for you need change only that you be familiar with falling back to paper backups when computers are down.
From a comment above, Linux has features (ebpf) that key crowdstrike stay out of the kernel.

The old "everyone else is just as bad" adage is bullshit. Some OSs are better suited than others.