skysight-inc/HackerNews huggingface dataset:
Is urgency really a dark pattern? To me it seems like basic sales and is present on everything from TV infomercials (buy now, limited stocks, only for the next 15 minutes + operators standing by) to brick and mortar sales that only last until the end of the week. Granted, it's a different version of urgency and the other stuff looks shady, but urgency isn't something I'd automatically put in the 'dark pattern' box.
Well. Now you have something to point to. Next RFO you can ignore the blameless part and point to a executive override of a technical decision.
Of course. The denial rate for schengen visa for Russians hasn't even become lower
There is one aspect to the situation that I'm not sure this blog post factored in - the miners have an enormous incentive to preserve confidence in the integrity of the chain. If we assume that crypto behaves like a social network where there are super-linear advantages to a large number of participants, the most important thing for a large miner is that none of the rational participants feel like they are playing win-lose games with the miners. The worst-case isn't losing a block. There are lots of blocks out there. The worst case is a market participant in YourCoin decides to go hawk OtherCoin instead because they don't know what blocks are trustworthy in the short term.
how much data are they supposed to be collecting from inside an android app that basically takes a credit card payment and displays a QR code?

Ryanair at one point at least had their margins such that every penny a passenger spends other than the ticket was profit, so they actually have less incentive to do this than some of the other carriers.
Surely their should be at least some staging on update files as well, to avoid the "oops, we accidentally blacklisted explorer.exe" type things (or, indeed, this)?
I don't use Ryanair specifically but these patterns are commonly found on all other discount airlines, and even some regular airlines as well.

One particularily devious example is when you log into WizzAir's website, the check box under the login (which takes your email and password) is not "Remember me", but rather "Subscribe me to marketing emails".

Always takes me a moment not to select it.
Ultimately, I think the answer to this kind of customer abuse is for customers to avoid companies that do this, but as far as I know, all the airlines attempt to trick their customers.
> If someone in the security apparatus decides that you should be taken hostage, tortured and beaten to death to show off to your government, they will do it and there will be no way for your consulate to help you.

Nah, just don't break their laws, it's pretty simple.

European friends of mine visited Iran a few years ago, they even had some hookups with Tinder. I was very surprised at the time, their description felt like the opposite of what I was told about Iran by the media.
A local rooflayer is absolutely corrupt. He cheats every customer, produces leaky roofs, doesn't even pay taxes completely.

It takes 2 year for the legal system to catch up, at which point he starts a new company, bankrupts the old one, sells all his tools cheaply to the new company, and fires and rehires his workers. I've seen this game going on for 14 years now.

I think Crowdstrike would do the same: Start a new one, sell the software, fire and rehire the workers, then go on as if nothing happened
> The risk of ZScaler being a central point of failure is not considered. But - the risk of failing the compliance checkbox it satisfies is paramount.

You're conflating Risk and Impact, and you're not considering the target of that Risk and that Impact.

Failing an audit:

1. Risk: high (audits happen all the time)

2. Impact to business: minimal (audits are failed all the time and then rectified)

3. Impact to manager: high (manager gets dinged for a failing audit).

Compare with failing an actual threat/intrusion:

1. Risk: low (so few companies get hacked)

2. Impact to business: extremely high

3. Impact to manager: minimal, if audits were all passed.

Now, with that perspective, how do you expect a rational person to behave?

[EDIT: as some replies pointed out, I stupidly wrote "Risk" instead of "Odds" (or "Chance"). Risk is, of course, the expected value, which is probability X impact. My post would make a lot more sense if you mentally replace "Risk" with "probability".]
This is awesome! How many regular users would you say you get?
Amazon (at least in Germany) does this if you don’t have prime. 2 clicks are required during the order process just to deny getting prime, and then they still have advertisement for it all over, including on the final page.

They had already pushed me away from prime because of their lack of customer service, but this has made sure I’ll never get it again.
> Why don't orgs test their updates?

Because historically orgs have been really bad with applying updates: either no updates or delayed updates resulting in botnets taking over unpatched PC's. Microsoft's solution was to force the updates unconditionally upon everybody with very few opportunities to opt out (for large enterprise customers only).

Another complication comes from the fact that operating system updates are not essential for running a business and especially for small businesses – as long as the main business app runs, the business runs. And most businesses are too far removed from IT to even know what a update is and why it is important. Hence the dilemma of fully automated vs manually applied and tested updates.
Show HN: Node.js UDP proxy for Valheim server Systemd socket activation
I wanted to host Valheim[0] for my friends using a dedicated server on my home box. The server can be heavy, so I didn't want it running 24/7.

Systemd has a feature called "socket activation" where it listens to sockets on behalf of your service and then starts it up on-demand when there is traffic on the socket. Unfortunately Valheim's server does not support this, so a proxy must be used. Double unfortunately, the Systemd provided systemd-socket-proxyd[1] doesn't support UDP, which the game uses.

To resolve this, and half as a learning exercise, I wrote my own small UDP proxy[2]. It opens a socket to the Valheim server for every incoming client address/port combination, so that replies can be routed back to the originating client. I would have written it in Erlang (using Gleam), but Erlang is not currently able to use the socket provided by Systemd. Node.js was a pragmatic choice based on ease of installation/setup and familiarity with JavaScript and the APIs.

The proxy seems to be running smoothly, and the server is started and shut down automatically by Systemd (as the proxy shuts itself down after a period of inactivity). The only remaining problem currently is that the server takes too long to start in the eyes of the game client, and thus the first connection attempt will always fail. For a server between friends, this is a minor issue.

I have also written a more detailed post about the process on my blog[3] if someone happens to be interested, but this post already contains most of the important stuff.

[0] https://www.valheimgame.com

[1] https://man.archlinux.org/man/core/systemd/systemd-socket-pr...

[2] https://git.ahlcode.fi/nicd/valproxy

[3] https://blog.nytsoi.net/2024/07/18/valheim-systemd-socket-ac...
I don't think that is possible. How can an anti-virus not in kernel mode defend against viruses running in kernel mode then?
> In that we can agree. But I would put "build on operating systems intended for the purpose" on top of that list, too.

Agreed, most folks should probably use a proven *nix distro, or one of the BSD varieties. That would be a good starting point.

That said, I doubt whether the OS alone will be enough, even with a good configuration, but at some point the technical aspects have to contend with managing liability either way.
does keeping front intact mean retreating or advancing?
Which IPAs are made from concentrate? I've never heard of this.

Some beers are brewed at a higher gravity and then diluted with water to bring to the correct strength - this allows the breweries to get more beer out of their brewing capacity.
This makes me think of Meta's approach in open sourcing a lot of their AI efforts. I can't find the exact snippet from the Zuckerberg interview, but the reasoning was:

If Meta open sources their models/tools and it gains wide adoption, ways will be found to run the models more efficiently or infrastructure/research built on top of Meta's work will ultimately end up saving them a lot of costs in future. Release the model that cost $10bn to make now, and save yourself billions when others build the tooling to run it at 1/10th the cost.
Ryanair is stupidly cheap. They probably don't make any money on the basic flight.
This is why we need stronger consumer watchdog groups that can combat this kind of behavior by the corpos.
sounds like a very inexperienced person.

If their mission is to protect businesses they should understand your concerns.

Speed is useless without control.
...wtf is "imperial language"?
Other than a lack of redundant systems, it should be illegal to roll out updates like this to more than x% of any gov stuff at a time. Brute force way of avoiding correlational Armageddon.
https://isitbsodfriday.com/
A vault with firearms in the police station to which every staff member has a key. Sounds reasonable to me.

Users are not prisoners left in the burning building without a fire escape.
Emissive means additive, not averaging. Cyan, magenta and yellow are not primaries here. Red and green light adds up to perceptual yellow. Red, green and blue adds up to perceptual white (or grey, at very low luminance). Treating each of these pixels like subpixels (which is arguably a form of dithering) will produce a full color image (at a lower resolution), but given that they did not demonstrate it, color reproduction and/or luminance likely is far from competitive at this point.
I used to use Last FM for this, but no longer. I think this needs to be brought back on modern services. An artist might be in a totally different genre but if they have the same ‘feel’ you might like both
Ye and these types make any problem worse. Any technical problem also becomes a social problem to deal with these lunatics and keep the house of cards from crumbeling.
IIRC @yandex.com is the free email domain they offer.
I think "compliance" would be a better word to use that "safety" when it comes to a lot of "security" software on computers.

And I bring up the distinction because while compliance is "sometimes" about safety, it's also very often about KPIs of particular individuals or due to imaginary liability for having not researched every possible "compliance" checkbox conceivable and making sure it's been checked.

Some computer security software is completely out of hand because its primary purpose is to have the appearance of effectiveness for the exec whose job is to tick off as many safety checkboxes as they can find, as opposed to being actually pragmatically effective.

If the same methodologies were applied to car safety, cars would be so weighed down by safety features, that they wouldn't be able to go faster than 40km/h.
CrowdStrike CEO: "defect in a single content update for Windows"
"CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted"
One place I'm at recently required us to install it in our Kubernetes cluster which powers a bunch of typical web apps.

Falcon sensor is the most CPU intensive app running in the cluster and produces a constant stream of disk activity (more so than any of our apps).

It hasn't crashed anything yet but it definitely leaves me feeling iffy about running it.

I don't like CrowdStrike at all. I got contacted by our security department because I used curl to download a file from GitHub on my dev box and it prompted a severe enough security warning that it required me to explain my intent. That was the day I learned I guess every command or maybe even keystroke I type is being logged and analyzed.
I always wonder about the people that implement this.

They surely know what they're doing, so, do they literally have meetings openly discussing where to put buttons to trick people? Am I just naive in thinking that's insane?
Feels like what people imagined the millennium bug would have been like, just short of PCs catching on fire.
CrowdStrike shares sink as global IT outage savages systems worldwide
Oh, Australia's Kogan -- a wannabe Amazon -- has you beat there.

When you buy anything, you're back on the list. No questions. No option. No chance of not being. You just are.

And it's a really aggressive list. An email a day, minimum.

I've switched to Amazon, and it's nicer. What does that tell you.
Lovely little product !

I wanted to ask how you handle language autodetection for snippets.
Reminds me of knock-age, a perl script to send commands by "nudging" your thinkpad (hitting it not too strong).

The original link was at http://www.ibm.com/developerworks/opensource/library/l-knock... but it's gone and archive.org doesn't seem to have a copy anymore :(

There's a fork at https://github.com/esantoro/knockage it seems
This was Southampton, so probably similar academics standards.
Oooo, interesting! Are you involved in this project at all?
Ask HN: Can we blame Windows for CrowdStrike outage?
CrowdStrike update causes a Windows OS to crash and not even starting. It's definitely CrowdStrike's fault but I feel that good OS should prevent a 3rd party app to cause such damage. Can Windows take part of the blame for that outage? Would it happen on Linux?
Happy weekend to everyone who works there.
That's an urban myth https://en.wikipedia.org/wiki/Banana_production_in_Iceland
https://www.aqr.com/-/media/AQR/Documents/Whitepapers/Unders...

You should stop trying to predict the next crash. According to the study, most people (including institutional investors) consistently believe there is a >10% chance the market will crash in the next 6 months when historically the probability is only 1%
Ryanair is not an airline. It is a byzantine bureaucratic game that rewards successful completion with a cheap airline ticket.
I guess we'll see if equality is something that we really will follow through to the end or we only do it when it is convenient.
This is 100% the reality
It's a cheap airline. Being slightly adversarial can still be worth the price for customers. As a customer I treat booking it a pretty low-stakes adversarial game and try to enjoy the deviousness. Worst case scenario is costs the same as a flight with a more normie airline. (I'm Irish, as is Ryanair, which may be a factor in my fondness ). Anyway, I guess the devs/designers are also playing the same game, just on the other side.
Thanks for the warning for when I return to Australia.
Not sure that's a great idea. This stuff tends to have very high privilege access.

It's enough that one of your anti virus vendors get hacked for your whole organization to get owned...
Though a lot of people honestly believe every Ryanair flight is £10 and that's not even remotely true
Article on crowdstrike website has not aged well
So far MSFT is down by ~2%... Even Crowdstrike is only -20%. When they probably did more damage in a day their entire net worth.
Me too, as I am also not affected. But I do pity those guys who now try to solve that deadlock.
My brain goes there too, but the other part of my brain says "line always goes up." The richest among us are heavy owners of stocks, and this country does everything it can to keep those numbers up. Look at that insane COVID V-shaped recovery that happened. That's just not a real/natural market reaction in my book.
Well, not sure where they're getting their numbers from but a lot of animals (Ants/Flys) have very short lifespans so if there's 10,000 trillion ants I could easily see more than 0.005 quadrillion ants deaths a year (but not more than 0.06 quadrillion for ants).
Personally I think chemistry is going to trail a long way behind biology for a while (in terms of ML solutions). The data, supporting libraries, and funding doesn't seem to be on the same level.
If you have all of them on a critical path then your risk of blow up increases!
this sounds like a terminal thing. what terminal are you on.
An experiment: walk into a diner in mid-winter and ask for a BLT.
I think we don't do enough to fight back this requests in a language that is understood by management. Ask them to sign a security waiver assuming risks for installing software techs would classify as a malware and RCE risk.

Companies like CS live on reputation, it should be dragged down.
This makes me wish I lived in Japan, imagine being part of a culture where clickbait is so shunned that companies avoid it.
Speaking of dark pattern, I recently resigned my dropbox sub and they have one of the most user hostile flow I've seen in quite a while, at least on a "legitimate" website. Given that they aim mostly for business and big business now, keeping this thing clearly meant to scare or confuse Random Joe felt very surprising to me.

I'm sure they have lots of numbers showing it's worth it, but I can't help notice that companies who know they are good and you need them tend to have a much easier unsub path, frictionless for many. It doesn't inspire huge confidence and very much confirmed my wish to unsubscribe.
None of the points you mention detracts from the correctness of his/her statement.
I'm guessing it works. You piss off the younger poorer generation, whilst capitalizing on the confused older generation with far more cash
It has in my experience with Rocky/RHEL lol.

https://access.redhat.com/solutions/7068083

https://forums.rockylinux.org/t/crowdstrike-freezing-rockyli...
I have read and can recommend everything by the author between and not including 'The Big U' and 'REAMDE'.

REAMDE disappointed me so much, that I haven't touched his later novels.

'Snow Crash' reads like a graphic novel, 'Anathem' is just unique and maybe in my fav top 10 (not considering 'A Canticle for Leibowitz' :), 'Cryptonomicon' + 'The Baroque Cycle' are slow but very rewarding.

'The Diamond Age', what can I say, do yourself a favour and start reading it now.

Sure I forgot one or two, it's been a long time.
Also seen on Booking.com.
Part of the broader Dynamic Currency Conversion scam, also found in person etc. Not as common as it used to be but when travelling I had to be quite forceful in stating I want to pay in $LocalCurrency . I've had many establishments ignore my request, select GBP, then hand me the terminal asking for my pin, then feigning ignorance when I explain that they are trying to cheat me
This is like a very regressive tax policy. If you are high capability individual, you will sail through these screens and avoid adding extra charges, if you are a ... low capability individual, you won't be able to do that, and you end up subsidising the travel of those smarter than you.
You are spot on, we don’t yet say enough that this is primarily an artist centred platform. We want this to be a place that artists share fans and get discovered by industry and playlisters so I think making this clear is key. Thanks for the input!

We are already collect genre data so will switch it on and have leaderboards when there is enough tracks of each genre. Just need to build up the pool of tracks and active artists first and prove the concept.
Using two passports is not always the solution. As a dual citizen of two countries, I also have two passports. A couple of years ago I travelled to Malta with the passport from the country I currently live in. One week later I flew over to Israel, where I used the passport of my birth country. I was extensively interrogated at the border, because apparently the system flagged me to the border officer as there was no record of me entering Malta with the passport I attempted to leave the country with.
You don't need to mandate a short term view when the executive's massive pay packages depend on stock valuations: They will chase the money all by themselves, not trying to build a company that might make major discoveries eventually
CrowdStrike have finally posted publicly on it:
https://www.crowdstrike.com/blog/statement-on-windows-sensor...
This is pretty wild. I woke up to a news alert on my phone stating a "global IT outage" took down banks, airlines (who were calling for a global ground stop for all flights), hospitals, emergency services, etc. Expected it to be some sort of Tier 1 Network issue. Nope, a failed update for some third party Windows security app.
It's a design decision. People want the antivirus to protect them even if an attacker exploits a local privilege escalation vulnerability or if an attacker that compromised an admin account (which happens all the time in Windows environments) wants to load malicious software. That's kind of the point of these things. Somebody exploits a memory vulnerability of one of the hundreds of services on a system, the antivirus is supposed to prevent that, and to their benefit, Crowdstrike is very good at this. If it didn't run in the kernel, an attacker with root can deactivate the antivirus. Since it's a kernel module, the attacker needs to load a signed kernel module, which is much harder to achieve.
These are most definitely not vodka in Russia.
I can't imagine starting a project from ~2010 and on while choosing Windows as the stack.
Almost correct, but you mean 'chance' where you write 'risk':

Risk = Chance × Impact

The chance of failing an audit initially are high (or medium, present at least). The impact is usually low-ish. It means a bunch of people need to fix policy and set out improvement plans in a rush. It won't cost you your certification if the rectification is handled properly.

It's actually possible that both of your examples are awarded the same level of risk, but in practice the latter example will have its chance minimized to make the risk look acceptable.
We often read about how organizations are so bad because they don't spend enough on security. That slope is particularly slippy.

Crowdstrike is very expensive.
https://browin.com/shop/product/407400/brew-a-ipa-coopers-be...

https://www.thrillist.com/drink/nation/beer-concentrate-pat-...
I see no relationship between understanding that Azure has a poor security posture and participating in business meetings with salespeople.
"History" might be a thing but Moldova has not been part of the USSR for more than 30 years now, and has been part of the Russian Empire for only about a hundred years (after the peace of 1812 and until shortly after the first World War). It was one of the shortest-lived imperial possessions.

> Also a good portion of the population identifies as Russian.

Said "good portion" is about 4%, according to the latest census [1]. Balti is the only municipality with a substantial Russian population. USSR politics means that much of the Moldavian population speaks Russian (tl;dr you had to learn it at school and were generally forced to use it in any public setting) but only a small minority of the Moldavian population "identifies" as Russian.

Pre-emptive "but ackshually": 1. nothing wrong with identifying as Russian, this is a comment on population statistics 2. the census was conducted the same year that a pro-Russian administration was voted into power so yes, the statistics are perfectly representative, no one had second thoughts about saying they were Russian.

1. https://statistica.gov.md/en/population-and-housing-census-i... .
you can configure sshd to run any random executable when a user connects
There's nothing special about Windows beyond the fact that you can run arbitrary executable files. The problem could just as easily have happened for Linux or iOS/Mac and in fact it has. ChromeOS kind of works if you want to run a web application that's hosted on some web server... but it's not appropriate for running programs where a dumb browser doesn't suffice.
Was this update meant to save from a 0 day?
The most successful malware of 2024, even though it only does denial of service.
It’s mostly through drug use, poverty, etc.