skysight-inc/HackerNews huggingface dataset:
The other commenter already said it: Liability. What if the scan is part of a procedure that ensures that the right drug is given to the right patient? Giving someone the wrong drug or even the wrong dose can cause serious harm. Imagine they kill someone that way and then during the investigation it turns out the they didn't scan the meds. It doesn't matter why they didn't scan it (lazy, forgetful, computer problem), it is en enormous legal risk for every party involved. Thousands of people die each year because of medical errors, so trying to prevent doctors from killing people by using strict procedures is very important. Even if it means that in extreme situations like this the procedure can cause harm as well. Overall it will save many, many more people than it will kill.
Yeah I am completely with you and I agree.

But it seems that reducing costs is more important even compared to preventing people on life support in hospitals from dying.

What a world.
Null pointer access caused by bad data is entirely conceivable... esp when you overwrite parts of kernel memory with nulls.
> myopia of greed that's a universal drain on public wealth, for some petty local optimization.

It's all a question of who gets to do this first, until then everyone who doesn't gatekeep is a sucker. You think M$ won't do this?
They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.
Are there many civilians in the trenches of eastern Ukraine? Again, the discourse around AI weapons seems to consistently neglect the fact that these are already being deployed.
Meth is a prescription drug, so it would. be legal for someone like Biden who can get a prescription to microdose.
I suspect that if the operators of such facilities obeyed all of the terms of use for every product they wanted to use, they’d be using pen and paper for everything…
The records used by xwax have about 100 kilobytes of data on each side of a 12" record. However, the goals are very different here; it's designed to decode the position under specific conditions such as being moved very fast, in reverse and changing direction rapidly. There would be a more efficient encoding if your goal was to fit as much data as possible and relax the other requirements.
I used to scrape the calls for service for my local PD, and the inaccuracies were considerable. Of course there were typos in addresses or cross-streets, but there were also inaccuracies with how the incident was classified (for example, a former coworker and friend said his neighbor called the cops on him in the middle of the night one day- I looked it up and it was classified as a domestic disturbance rather than a noise complaint).

Some records, like those involving child abuse, don’t show on their calls for service website at all, so that’s an entire group of data that we the public just don’t get to know about.

Government data is notorious for being dirty and inaccurate.
I don’t know whether it’s unhealthy to give blood.

But generally speaking doing things our bodies are designed to avoid is unhealthy, such as rapidly losing a not-insignificant fraction of blood.

The onus is on researchers to demonstrate that what seems like a bad idea is actually a good idea.
Music can be copied, shared and redistributed for a marginal fee. Text even more. Nevertheless, you have record and book collectors. What's the difference?
Trial court judges generally do what they want, especially at the state level in the USA.

The appellate courts do the real work of determining the legality of the judge's decisions and fixing them where necessary. If you don't have the resources to marshall a competent appeal, then you're usually out of luck.
So they didn't disclose the bug publically... They simply disclosed that there was a bug.

That isn't IMO disclosure. Nearly anything has a bug if you look hard enough.
I see. That doesn't make it better though, and OK let's forget about other languages.

I mean that the least you can do before pointer dereference is just check for several bad sentinel values, NULL being one of them.

Seems like a rather amateur mistake to me.
I recommend Ghost. You can self host it or use their hosting service.
Wow, yeah, this level of condescension is truly stunning. Talk about a superiority complex.
> If you are actively breaking into websites

They viewed the source code. Despite what the governor of Missouri[1] thinks, that's not hacking.

[1]: https://www.theverge.com/2021/12/31/22861188/missouri-govern...
I think what would also be very interesting in this case is to get latency histogram, This 36ms per second can be 1000 stalls of 36microseconds which might not be significant for your app or it could be one giant 36ms stall... which can be an issue.
Isn't SUSE basically recognized OpenSUSE? What is SUSE to the vast majority of users if not for OpenSUSE.
It’s just that the analogy breaks down a bit. It’s fair to say a dropped wallet in a city is a one-shot game—it’s reasonable to expect neither the participants nor their acquaintances will ever encounter each other again; whereas a security vulnerability is closer to a repeated one—it’s a fairly small world. (Some kind of neighbourly behaviour would work better here, but then again, it’s more difficult to find a universal experience of that kind.) I didn’t misunderstand this, but perhaps GP did?..
What if it turns out they harmed the patient by insisting on following the standard procedure during a worldwide outage? Isn't that the same kind of liability risk, and is the regulation really going to protect them in this case? If so, isn't that a hugely problematic regulation?
I don't want to cramp your style, but displaying those in a table would really improve readability
I never liked it either because to me it's a lie. I'm not getting the open source version of SUSE.
If my endodontist can't rebuild a car engine, what does that say about his ability to perform a root canal?

Turns out, not much.
Yes, latex's HTML output is fairly good nowadays, after a lot of people made very heroic efforts to put it in a system never intended to support it.

Starting a new markup system with no plan for making accessible documents was, in my opinion, a very bad idea. I refuse to use typst until it can produce accessible documents.
Follow up, what is the best way to author blogs for the next decade?
and it was not. No plane was flying with that software. It was booking services and similar needs. Planes could fly just fine, it was impossible to book people, thou.

My guess is that it's similar in this case. (Site is down)
I have no idea about how to measure the happiness of money.
Yeah. I was referring to CentOS pre-Stream and cutoff of updates from Red Hat. Not really comparable though as CentOS was a downstream rebuild. And, as you say, CentOS Stream is roughly the RHEL nightlies. Red Hat (since RHEL) never really had a community distro that was closely aligned with RHEL--at least after Fedora matured as a quasi-independent project.
I wonder if they might be favoring spawning numerous instances of an application with few threads and little memory use to scale at the replica level over just scaling within an application? At least Go defaults do suggest that (and are also the reason for very poor performance on large many-core nodes).
Records and books get official, physical prints? People collect stamps too, but if you turned them into JPEGs those same people wouldn't care anymore.
I don't think a whole lot of the Earth is actually habitable to begin with ;)
I have n things TODO.

I decide to make a TODO list.

Now I have n+1 things TODO.
We're all waiting for your anti-malware Rust Win32 kernel module...

Ok, but seriously I don't believe this will ever happen and I don't really think this is a language debate nor do I want to engage in one.

This is about putting critical infrastructure connected to the internet that's running an operating system that you can't trust out of the box. Since the Windows OS is susceptible to so much malware you need all these third party services (which you also can't trust or audit, but it's absolutely better than not having anything) on top of the OS.

There was a whole host of companies that had zero problems, not because they're using Rust, but because they have much better security practices and quality infosec employees.
The unfortunate fact of the matter is that centralizing IT systems around large corporate products, including the on-prem software and any cloud services, necessarily means less local control of what can go wrong and how it can be mitigated, and thus often problems that simply can't be fixed, even by competent on-prem staff. Even when it is possible, it's often highly illegal, and most organizations do a lot to beat risk-aversion into everyone on their staff, and of course I mean aversion to risk of breaking rules or protocols, not risk like "someone dying"

I think it's always a mistake to outsource control of a mission-critical system, but that is exactly what large tech companies have been encouraging every organization that will listen to them to do for decades now
Perhaps some already exist.

But if they have five security processes that each has a 99% chance of catching a bug, that's still a 1-in-10,000 chance that something will slip through. And I'd wager that a16z has more than 10,000 "components" that goes through those processes.
Of the top of my head:

- Play / stop

- Increase / decrease speed

- Go to next section / riff / verse / chorus [1]

- Loop this phrase / riff / verse / chorus

- Turn off drums / bass / guitar tracks (i.e. isolate)

- Switch to click track mode[2]

[1] It'd be great if I could annotate part of the tab as a riff, phrase, or other section, give it a name, and then loop, repeat, jump around amongst riffs in a song (or even multiple songs).

[2] I've always wanted the ability to play a section of the tab as clicks (not notes), just to be able to hear and feel the intended rhythm of a section.
Why were you using a web-based content management system for secret management?
SteamFork: Immutable Linux Distro for Steam Deck
That's all fine, but this time, no one could get those computers back up in the first few hours, since they were stuck in a boot loop. Plus, systems like hospitals had to be running all that time. Plus, at the scale this outage is reported to be - banks, stores, factories, phones, emergency services, CNC machines, networking, aircon - I imagine everyone was confused and trying to figure out if anything works.

I'm happy nothing significant was hit over here in Poland; reading the main HN thread on the outage feels like reading war reports.
I don't think this would matter, cigarette butts would still be unpleasant even if they'd decompose, much like biodegradable bags are still bad to find around.
What Is Endpoint Detection and Response (EDR)?
Wow, CrowdStrike made it to #6 of all time HN threads by now.. https://hn.algolia.com/?q=
In NetWare 4.x (and even more so in 5.x), you could give NLMs their own address space. But by then, it was probably lost anyway.
A safer language like RUST won't help you against bad practices and poor QA processes. This is a kind of error that you should catch with automating testing, even before pushing the change to main branch.
Ask HN: What are your thoughts on "Backrooms Found Footage" videos?
I have trouble accepting that. Even if they had to unplug the computer from the network and disable SSO and antivirus in safe mode, it's possible to get the computer operational. Even if they had to reinstall the OS and the critical software from scratch. There are solutions, the question is - did they even try? If not, why? And is CrowdStrike really to blame if they didn't? I just don't think so.
uBlock Origin -> Dashboard -> My Filters -> add the line:

||www.kibty.town/files/js/oneko.js^$important
>Implying the Eu will actually do anything at all whatsoever upon reporting a gdpr issue

>Money is something VCs “print” and manipulate.

You wot m8
You are basically ignoring an entire dimension of food taste, enjoyment, and satisfaction by saying complexity is not tastiness. Plus you are ignoring the fact that nutrition includes micronutrient profile. Then you are concluding that high calorie food has high nutrition and tasty foods are foods that you want to eat more of. No offense but this is like a child's view of food, or maybe some kind of food addict view of food. There is a lot more to nutrition and taste than your current definition of it.
"These times" have been around since house doors had locks.
i think you're missing the fact that that indeed is not a security email, and the engineering/security email i found bounced.

i had no ill intentions. stop pretending i did.
As far as I can tell, their tweet was just:

> someone from @a16z get in touch, now. its bad. security related.

https://x.com/xyz3va/status/1807330215955177937

If your email bounces, I think reaching out over social media is reasonable for a fast response.
This piece was written by someone covering national security and the Biden administration for the NYT. It’s a global issue exposing vulnerabilities across the board. It’s journalism like this that’s the real vuln. Word.
In Europe especially, SUSE is a pretty well-recognized commercial Linux distro.
Yes, and yes. Welcome to our messed up society.
According to some comments in Yesterday's thread Debian was also hit with something similar back in April.

Another comment in this thread quotes Crowdstrike's ToS which states that their software should not be used on critical systems.

I blame the hospital for its inability to operate with pen and paper in the event of a computer crash or a power outage.
Lies, Damned Lies, and Productivity Data
Crowdstrike broke the update for Windows only this time. Although look around, they did a bad update on Linux earlier this year (although that only broke some of the Linux installs).
Only thing I can find are office mails, which looks more like a trashbin than mail which would respond. Also not where I'd look for a contact mail.

They seem to only want you to connect via social media (which is a poor choice for primary contact IMO).
No, that’s why medical and aviation products are expensive and these are difficult markets to penetrate.

The degree of reliability that is required is insane, I cannot read the article since I am outside the US, BUT if these are the terms of service and the product was used in any area the was excluded under these terms, the entity that used the product might very well be guilty of gross negligence.
Hospital networks and computers running Epic are very much indirect life-support systems, faulire of which can cause lots of injuries and deaths - as we're learning now in real-time.
> They also have contact email addresses listed at the bottom of https://a16z.com/connect, which the researcher conveniently missed.

They have those now. Do we know they did when the researcher tried to reach out?

Edit: I decided to take a look at it myself. It does seem that that was available on June 3rd of this year [0]. (You'll have to look at the source since the archive doesn't do their animations.) It seems to be available on previous snapshots as well [1].

[0]: https://web.archive.org/web/20240603210532/https://a16z.com/...
[1]: https://web.archive.org/web/20240000000000*/https://a16z.com...

[0]: https://web.archive.org/web/20240603210532/https://a16z.com/...
Book Review: How Language Began
Now comes the important question: did CrowdStrike's sales team try to sell solutions to operators of such critical systems? If so, how hard did they push?
> we dont have 911 either

Holy cow...

Who on earth requires a Windows-based backend (or whatever else had CrowdStrike, in the shop or outside) for regular (VoIP) phone calls.

This should really lead to some learnings for anyone providing any kind of phone infrastructure.
> This is about putting critical infrastructure connected to the internet that's running an operating system that you can't trust out of the box. Since the Windows OS is susceptible to so much malware you need all these third party services (which you also can't trust or audit, but it's absolutely better than not having anything) on top of the OS.

Agreed, they should not be using Windows in the first place. That should have been the first line of defense.

> There was a whole host of companies that had zero problems, not because they're using Rust, but because they have much better security practices and quality infosec employees.

Fair enough, I only commented on one layer of the security stack -- so your remark that expands the scope is valid and welcome.

> We're all waiting for your anti-malware Rust Win32 kernel module...

I am done working for free. If I am paid to do it I am sure I would have done better than this poor confused soul who allows NULL pointer dereferencing which is a mistake that most C/C++ interns quickly learn to avoid.
The places you're most likely to get your wallet back in the world are the places you're also less likely to get a reward. The reward for returning a wallet is knowing you're doing your part to make the place you live in a nice place to live.
It only gets worse when the company that published their environment variables sues the security researchers for finding it. It happens.
The whole point of my comment is about the definition of nutrition and taste. It's not made up.
You're using the wrong line of thought on the analogy here.

The value of the wallet is not the cash you'd directly lose inside of it. The value is getting your ID and cards back without them being copied by someone else, along with any other identifying information.

The value of having and up front and easy to use bug bounty system is it's easier to use then selling it off to some blackhats (hopefully). Those blackhats may otherwise scrape all your s3 buckets or somehow otherwise run up a zillion dollars of charges over a holiday with your keys.

Being cheap gets expensive.
Here's an interesting exercise: what's the minimum quantity of explosives that would lead to 1% drop in western GDP? would doubling it lead to 2% or 4%? is the relationship linear?

I don't have an answer, but thinking about it makes one understand how incredible fragile our complex logistic chains (and indeed our economy) are. One day all this complexity will collapse upon itself and we'll wonder what happened.
In that case the nurse or doctor has a strong defense of "I was following policy" for their insurance and boss.

The people writing hospital policies or regulations aren't thinking about individual patient outcomes unless some notable news story came out recently, and even then it's maybe the third or fourth priority on a list a hundred items long.
If it's stuck in a boot loop, the first thing I do is call the local admins and tell them to take a fresh SSD and a Windows installation USB drive with them. Plug the new SSD, reinstall the OS and copy the files from the old one. Computer running in less than an hour.

That's literally what we did to restart our forest logging machinery. Are human lives less critical than that?
> The staff in prisons are never motivated to run any kind of real rehabilitation programs

We used to. I have an ancestor who worked for the prison system in Southern California, ~1920s - 1950s. I don't know what they called his role, but for most of his career he was in charge of the re-integration wing, a set of low-security barracks that prisoners moved to for the last six months of their sentences. During that time they did job interviews (maybe even had work release?), lined up housing, received what sounds like "life coaching", and otherwise prepared for their release. Visiting rules were much relaxed.

I never met the man, but have been told by my relatives who knew him that he was intensely proud of his work, and protective of the men for whom he cared. He was regularly stopped on the street to be thanked by former inmates; he was godfather to some of their children. I am proud to have been named for him.

I've become interested in reading about the Progressive Era of American history. We've lost a lot of what was built (physically and socially) ~100 years ago. I'd like to get it back.

(Personal note: Qingcharles, I really appreciate your comments on this site. Thank you for being here.)
Statistically speaking, if you want to murder someone, a car is the best possible murder weapon.
People collect video or digital art. What would be the difference in that case?
We don't know that this is what actually happened in OP's case. I was referring to the comment you replied to and there it is pretty obvious that the regulation is exists to prevent harm from being done. But even if there is a clear justification, you would expose yourself to a lawsuit and need argue all this in court. I can totally understand why people don't want that, especially in the US. So if anything, you should blame the legal system.
"unintended"? -- what is the most obvious thing that can happen if paid toilets are outlawed and there is no money (never is) for public toilets?

Obviously, there is more to the story. People are not that dumb. Somebody wanted it that way for a reason.
I agree. My point was that using a language whose compiler will not allow you to build your production binary if you make a certain mistake could have been one extra line of defense and who knows, that might have prevented this problem this one particular time.

But I am in full agreement with you that sloppy programmers cannot truly be helped. They just screw up and move on like nothing happened. Sigh.
OpenSUSE is to SUSE more as CentOS was to RHEL, than it is comparable to CentOS Stream.

The community can contribute things to CentOS Stream and, so long as they meet Red Hat's guidelines of what is allowable, it can be merged there and flow downstream into RHEL and RHEL rebuilds. I don't think that's the case with OpenSUSE. But then I'm not that familiar with their ecosystem.
Patients coming off anti-depressant pills describe permanent genital numbness
Is this the setting of the final scene in hot fuzz?
I'd be surprised if they were toast. Big companies can fuck up with impunity - just look at Boeing. They can take a bit of an insurance hit, chalk it up to the cost of doing business, and pass the cost back to their customers in the long run.
I'm no kernel expert, but people are saying Microsoft deserves some blame for not exposing necessary functionality to user space, requiring the use of a very-unsafe kernel driver.

Linux provides eBPF and macOS provides system extensions.

I'll also add that Windows itself heavily prioritizes backwards-compatibility over security, which leads companies to seek out third-party solutions for stopping malware instead of design-based mitigations being built into Windows.
They’ll never admit the obvious truth, which is that it was caused by a combination of incompetent administration and incompetent engineering.
I already linked to them in my comment below

Click nav

click “how to connect with us” -> https://a16z.com/connect/

See 4 emails at the bottom for each office

See 4 links to social media pages where every single one has DMs open

Wait at least a couple business days to see if anyone replies, if no one does or it’s not being taken seriously then you can announce it publicly on social media you found something but can’t reach them
Yup indeed. Trying to think of counterexamples for the fun of it. Nirvana (“heaven”) before the grunge band became synonymous with it?
Looks to me like this is an innovation fund project which demonstrates a cool idea. Most of the comments here are complaining about practical issues but I don’t believe running this thing all day long on a public beach is the primary goal.

I’m not sure whether it is the press coverage that implies that this is a highly practical solution, or if the actual makers claim that too. But I look at it as a clever maker hack, not a commercial product which should be picked apart as flawed.
Well, other legal distinctions aside, robbery is taking things by threat of force.

If someone doesn't know they've been a victim of larceny until later, it wasn't a robbery.