skysight-inc/HackerNews huggingface dataset:
We took 911 calls all night, I was up listening to the radio all night for my unit to be called. The problem was the dispatching software didn't work so we used paper and pen. Glory Days!!!!
I think that's the key benefit of using OpenTelemetry - it's pretty efficient and the performance footprint is negligible.
That what I mean above, most people don't speak "modern Ukrainian". Even the language itself drastically changed on TV just in years.
An immutable OS can be set up to revert to the previous version if a change causes a boot failure. Or even a COW filesystem with snapshots when changes are applied. Hell, Microsoft's own "System Restore" capability could do this, if MS provided default-on support for creating system restore points automatically when system files are changed & restoring after boot failures.
If you managed your own servers, you would still need some sort of endpoint security solution too tho…
The Tenerife disaster (second-deadliest aviation incident in history, after 9/11) was ultimately caused by chaotic conditions due to too many airplanes having to be diverted and land at an alternate airport that wasn't equipped to handle them comfortably.
That doesn't sound unique or interesting. Sulfur? So what. Not clicking.

Surprise? Well, I was already pretty sure if it was water or life they'd have said so, but now I'm intrigued. I clicked and now I know why the find is actually pretty interesting after all.
DevSecOps should have you know, tested these updates before they were approved for release company-wide.

If I can't commit code to our app without a branch, pull requests, code review...why can the infrastructure team just send shit out willy-nilly?

"Always allow new updates" must have been checked, or someone just goes through a dashboard and blindly clicks "Approve"
That's just what old people like to think: that they are super important and could never be replaced. A few months ago I replaced a "critical" employee that was retiring and everyone was worried what would happen when he was gone. I learned his job in a month.

Most people aren't very important or special and most jobs aren't that difficult.
However this is only true for miners that are loyal to a coin. If you are in a mining pool that mines whatever is profitable and immediately exchanges it for your favorite currency then you don't care about any given coin. You still want to preserve trust in crypto as a whole though, so you wouldn't go completely crazy
> USPS did not share anything intentionally.

We don't actually know that. What we know is that they said they didn't share anything intentionally. But there is almost no penalty for lying about such things and the USPS is desperate for money, so I don't think it's impossible that some USPS person made an under-the-table deal with Meta or another company to add this stuff to its website in exchange for a kickback. Only a detailed audit would be able to find out the truth, and that seems unlikely to happen unless Congress gets upset about the issue.
At my work in the past year or 2 they rolled out Zscaler onto all of our machines which I think is supposed to be doing a similar thing. All it's done is caused us regular network issues.

I wonder if they also have the capability to brick all our Windows machines like this.
> It feels like humans are driven by individual selfishness, so much that it's threatening the survival of the species.

I'm not sure I'm following. Individual selfishness seems to be driving rapid expansion and propagation of the human species -- where do you see any threat?

> But on a long timeline of centuries and millenia, somehow "collective selfishness" is working out well.

What do you mean by "collective selfishness?" I'm not sure I'm aware of anything that exists that matches how I am interpreting that phrase.

> Who knows, maybe such seemingly destructive tendencies are even contributing to further the collective.

What destructive tendencies are you referring to?
> The simple answer? They can afford it.

I'm honestly not trying to nitpick, but the explanation "they do X because they can X" is not a good one. Being able to do X is a prerequisite for doing X, but it is not a sufficient condition. Why do they choose to, though? Perhaps, a part of it is vanity, but

> nothing to do with your skills

is a bit much. I might assure you, a FAANG interview requires certain skills[1], and it's easy to fail or be "downleveled" to a lower salary.

[1] - not to discourage anyone from trying to, you just need to put in some time and work.
anyone who's had that kind of power, myself included, knows the answer is fuck no.
> Either one of us is staggeringly confused

Yes, I am the one who is confused, which is why I started asking questions all those comments ago in a hopeful effort to try and become unconfused. But at this point you don't seem to even be aware of why you posted the comment, so I suppose we'll just chalk it up to an arbitrary thought crafted while in the middle of a somnambulism.
The taxes you paid don't fund USPS though.
This demonstrated that Crowdstrike lacks the most basic of tests and staging environments.
There should be congressional hearings on this. Not just post mortems.
It wasn't a Windows update. If you got a notification for an update, it wasn't the update that did this.
Somewhat OT, but tangentially related: One of my clients likes to tell me his work requirements by telling me long-winded stories about how he came up with an idea, what exactly happened, etc. that was useful at first but became extremely wasteful of time as years passed. I tried typing down notes while he talked, but it became too hard to write useful ones.

At some point, I resorted to keeping an audio recording of the whole meeting just to make sure I have something to come back to, in case my notes fail me.

I wouldn't do this for everything, but it helped me realize that an audio/video log like a dashcam video can work for certain scenarios.
I don't care about governments, I born and living here. Those who don't like that can go fck themselves.
> Why would an anti-malware program be allowed to install a driver automatically ... or ever for that matter?

Because malware that gets into a system will do just that -- install its own backdoor drivers -- and will then erect defense to protect itself from future updates or security actions. e.g. change the path that Windows Updater uses to download new updates, etc.

Having a kernel module that answers to CloudStrike makes it harder for that to happen, since CS has their own (non-malicious) backdoor to confirm that the rest of the stack is behaving as expected. And it's at the kernel level, so it has visibility into deeper processes that a user-space program might not (or that is easy to spoof).
And then when you or your relative need to buy a house, "Oh woe is me, why is building a house so expensive in the US!"
> Highly doubt it's an accident. The cruelty is the point:

Someone murders another, pleads down to manslaughter. Will spend 4 years in prison... but the cruelty is that after he gets out if somehow he manages to come up with money that the court system can even become aware of, we might make him pay for some of the $250,000 cost of keeping him in the cell?

Or do you just mean the people who were wrongly held before evidence exonerated them? It's not cruelty there either, just revenue collection. Someone's gotta pay for it, and when the people who should be paying get to duck out because their only income is cash from street drug sales or fenced shoplifted goods and impossible to recover, I guess those people who can hold a job that direct deposits into a bank account are on the hook.

God, I'm glad you don't review my code. Full of bugs because I'm in a hurry, don't understand the problem clearly enough, or the specifications were bad... "that's no accident, you're being cruel to the shareholders".
>Prisons are for society’s benefit

Which is precisely why they should be geared primarily towards rehabilitation. We'd all be better off if we can reform people and have them be productive members of society. This is far better than losing productive hands to satisfy our bloodlust and base desire for vengeance.
Who bought massive quantities of put options in anticipation of this event?
No, I believe 3rd party driver developers must pass Hardware Lab Kit testing for their drivers to be properly signed. This testing includes a suite of Driver Verifier passes that are done, but this is not formal verification in the mathematical sense of the term.
Aviator (YC S21) Is hiring engineers to build the DevEx platform
government and military loves that word and will probably never let it go.
The question is what priced in, not what is publicly known. Buy put if you think that the market does not know the above reasoning.
This still doesn't demonstrate that it has any real function tbf.
Yes.

https://www.macrotrends.net/stocks/charts/MSFT/microsoft/gro...
I don't know what that piece of old crap is doing now.
Vigilantism is no better than the crimes that vigilantes seek to prevent.
Windows has restore points that do this in the event of a failed update, but this wasn't Windows.
The drag and drop part is not working for me, Firefox, macOS. I can click on the elements on the left and they will pop up, but I am not able to drag them onto the email.
I'm wondering what that channel would have looked like when there was water flowing in it.
I'm not quite sure with Boeing but they have different economic structures.
Unsure why you used the word “statistic.” A numerical piece of information has to contain a number to be a statistic.
Do they not roll out their new agents in small increments?

I'm trying to understand how there is such a serious issue at this scale.
If you arent doing stuff that touches low level OS or high performance compute, it doesnt really matter what you use. Ive switched to Samsung Dex with a lapdock, and can easily do python and node dev. For high performance, I simply run a cloudflared tunnel to my home box.
The affected "healthcare" providers are slurping up people's money left and right, but cannot dispense the thing if the receipt printer is feeling unwell. How fucking ironic.

(Yes, the ubiquitous security theater - featuring such classics as "I was just filing out spreadsheets" by multiple Nortony award winner, best director of the decade Aud Itor, production by the Revolving Door of CISOs Comedy House - also can go and fuck themselves. But let's assign credit where it's due. If IT is critical, then treat it so. Instead what hundreds of millions of people have to suffer through are systems so incompetent and so reeking of agent-principal problems that just the knowledge of how this shit "works" gives me secondhand shame.)
So would the FSB, PRC Army, North Korea, etc…
The fact that a faulty update can get pushed by human error means that adversaries can, too.
I wouldn't expect emergency rooms and 911 to stop working either, but here we are, so until someone says otherwise, I'm assuming some ATCs went down too.
I could certainly see that! Haha.
Your head belongs on the plate for not being able to point back to your recommendation for failover posture enhancement such as identifying core business systems, core function roles, having fully offline emergency systems, warning of the dangers of making cloud services your only services, and then pointing to the proposed costs to implement these systems being lower than the damages caused by outage to core business services.

Move to a new career if you feel you don't have the ability to push right back against this.
Apple gets away with a lot of things MS would never get away with, so I am not sure that saying "apple did it" is a good argument. It still may be a good idea to move away from kernel modules, I would tend to agree with that in general. But there is a whole class of problems that come from allowing third parties to push updates to your critical IT systems- kernel or not.
i work for a diesel truck maintenance and repair shop and its been hell on earth this morning.

- our IT wizard says the fixes wont work on lathes/CNC systems. we may need to ship the controllers back to the manufacturer in Wisconsin.

- AC is still not running. sent the apprentice to get fans from the shop floor.

- building security alarms are still blaring, need to get a ladder to clip the horns and sirens on the outside of the building. still cant disarm anything.

- still no phones. IT guy has set up two "emergency" phones...one is a literal rotary phone. stresses we still cannot call 911 or other offices. fire sprinklers will work, but no fire department will respond.

- no email, no accounting, nothing. I am going to the bank after this to pick up cash so i can make payday for 14 shop technicians. was warned the bank likely would either not have enough, or would not be able to process the account (if they open at all today.)
- Like for Open Source

- Like for PostgreSQL

- Like for transparency for application developers

- Like for the documentation

Usually, developers write their own solutions if the output is better than existing solutions on the market. Eventually this will became smth like ClickHouse. Otherwise, we get 15 competing standards.

It would be interesting to compare SPQR with Citus or anything else in terms of functionality, fault tolerance, transactionality, and perfomance.
Today, we comply by ticking all the boxes in a checklist; it takes care of the most obvious hacks. Is it good enough? Today, we got our answer.

Practically speaking, that is all the end-user can do with Windows machines. My point is Windows is fundamentally unsecure. It is a dike with thousands of holes some of which are not even visible to Microsoft themselves. The reason of that is security has been after-thought. It is band aids/plasters put on top of other plasters.
It would be a change in lifestyle but I am advocating for the change for reasons other the "prepping" as much as a health change in lifestyle. In some situations it might even be a substantial source of food and save or even make a little money. That it might help in troubled times is nice.

It, if nothing else, would teach a lot of people just how important our food infrastructure is.
Wow we're progressing from "if it doesn't work just reboot it" to "if the reboot doesn't fix it, you're just not rebooting it hard enough!"
I would agree this stuff DOES happen, but typically in development environments. And I also think its crappy practice. Nobody should ever pipe a curl into sh. I see it on docs sometimes and yes, it does bother me.

I think though that the culture of robust repositories and package managers is MUCH more prominent on Mac/iOS/Linux/FreeBSD. It's coming to Windows too with the new(er) Windows store stuff, so hopefully people don't become too resistant to that.
That’s both untrue and missing the point.

In a perfect world, AV software wouldn’t be necessary. We don’t live in a perfect world. So we need defense-in-depth, covering prevention, mitigation, and remediation.
You said, "As a matter of practicality, one has to put poorly communicated ideas or those for which the data collection is sloppy or otherwise badly done lower on their priority list."

"poorly communicated" is perfectly well characterized by "how pleasant [it] sounds"

You try again. Maybe you don't like the characterization but it's fair.
Kernel driver bug that essentially defaults, then on reboot loads the same driver early on segfaults and reboots again, ad nauseum.
Oh, one more thing[0]

The guy says 'just promoted to an official status ... in the past month'.

So he himself confirms, what for the 33 years they didn't bother with a language 'which is spoken very widely'. And suddenly, in the year 2022, not only it's spoken 'very widely' despite being non-existent in any conceivable metric[1] before, but promoted to 'a secondary official status nonetheless' absolutely ignoring the language which is used by 30% of the country.

Imagine Ottawa declares what Mandarin is now 'promoted to an official status (not as a primary language, but to a secondary official status nonetheless)' instead of French? [2]

[0] https://www.youtube.com/watch?v=xJ27fEm_ZCA

[1] https://en.wikipedia.org/wiki/Languages_of_Ukraine#2001_nati...

[2] https://en.wikipedia.org/wiki/Languages_of_Canada#The_two_of...
Has anyone discerned the root cause of this in the software?

As in, what exactly is wrong in these C00000291-*.sys files that triggers the crash in csagent.sys, and why?
I was a working cook back then and we switched to makrut lime in like 2006. Line cooks not known particularly for delicate language or sensitivity fwiw.
No restart was needed to cause this crash. As soon as Falcon downloads the updated .sys file ... BOOM.
Yes, of course, I'm speaking approximately.

But given the various evolutionary processes, the trend is improvement over time.
3 -> AI is still a technical concept, and does not yet exist.
Women in Japan: “we can’t get a job after giving birth, no help with child care, husbands out drinking with their boss every night, we don’t want this”

Japanese government: “hmmm… what could the problem be? Let’s set up a commission to investigate this obscure problem! Our top men are on it.”
It’s looking like many impacted end-user machines are hard bricked unless you can get into the hard drive to delete the file causing this. Even if you can do that it’s not something that is easily (or potentially even possible) to automate at scale so looking like this is going to be an ugly fix for many impacted devices. This is basically the nightmare scenario for fleet management… devices broken and can’t remotely fix them. Need to send hands on keyboard folks in the field to touch each device.
Or maybe switch to an operating system that isn't a security dumpster fire?
> x86 gets those instructions very wrong while RISC-V gets them very right

That is heavy over-exaggeration.

> An old ADD instruction was 2 bytes.

By "old" you mean.. 32-bit adds with 8 registers to choose from. Which are gonna be the majority of 'int' adds. Unfortunately, 64-bit, and thus pointer, 'add's do indeed require 3 bytes, but then you get a selection of 16 registers, for which RISC-V will need 4-byte instructions, and on x86 a good number of such 'add's can be "inlined" into the consumer ModR/M. (ok, for 'add' specifically RISC-V does have a special-cased compressed instruction with full 5-bit register fields (albeit destination still same as a source), but the only other such instruction is 'mv'. At least x86 doesn't blatantly special-case the encoding of regular 'add' :) )

> nearly 30 incompatible SIMD extensions

30, perhaps, but incompatible? They're all compatible, most depend on the previous (exceptions being AMD's one-off attempts at making their own extensions, and AVX-512 though Intel is solving this with AVX10) and routinely used together (with the note of potentially getting bad performance when mixing legacy-prefix and VEX-prefix instruction forms, but that's trivial to do, so much so that an assembler can upgrade the instructions for you).

RISC-V isn't cheaping out on vector extensions either - besides the dozen subsets/supersets of 'v' with different minimum VLEN and supported element types (..and also 'p', which I've still heard about being supported on some hardware despite being approximately dead), it has a dozen vector extensions already: Zvfh, Zvfhmin, Zvfbfwma, Zvfbfmin, Zvbb, Zvkb, Zvbc, Zvkg, Zvkned, Zvknhb, Zvknha, Zvksed, Zvksh

> massive "fill X registers from the stack"

https://github.com/riscv/riscv-isa-manual/blob/176d10ada5d8c...

Granted, that's optional (though, within a rounding error, all of RISC-V is) and meant primarily for embedded, but it still is a specified extension in the main RISC-V spec document.

Now, all that said, I'd still say that RISC-V is pretty meaningfully better than x86, but not anywhere near the amount you're saying.
Of course, but we specifically would like to see a _technical_ postmortem that examines what kind of incremental rollout procedures they have and how this update overcame those.
You need to document everything during a code arrest. All interventions, vitals and other pertinent information must be logged for various reasons. Paper and pen work but they are very difficult to audit and/or keep track of. Electronic reporting is the standard and deviating from the standard is generally a recipe for a myriad of problems.
That's a hell of a take that should not be taken seriously. Perhaps if you hold everything else to the same standard. Anything used on macOS or Linux or whatever else fully and completely represents that core platform, then I'd agree.

Anecdotally, I have zero stability problems on my non-ECC consumer-grade 11th gen Intel Windows 11 system. It'll stay up for months, until I decide to shut it down. I had a loose GPU power cable that was causing me problems at a point, but since I reseated everything I haven't had a single issue. That was my fault, things happen. The system is great.

More significantly, I see no difference in stability between our Windows Server platform and Red Hat Enterprise (Oracle) server platform at work either. Work being one of the top 3 largest city governments in the USA.
My understanding of their argument is that they can't afford the time to see if it breaks the QA fleet. Which I agree with GP is not a sufficient argument.
At one company I used to work for, we had boring, airgapped systems that just worked all the time, until one day security team demanded that we must install this endpoint security software. Usually, they would fight tooth and nail to prevent devs from giving any in-house program any network access, but they didn't even blink once to give internet access to those airgapped systems because CrowdStrike agents need to talk to their mothership in AWS. It's all good, it's for better security!

It never caught any legit threat, but constantly flagged our own code. Our devs talked to security every other week to explain why this new line of code is not a threat. It generated a lot of work and security team's headcount just exploded. The software checked a lot of security checkboxes, and our CISO can sleep better at night, so I guess end of day it's all worth it.
yes but, did it help us meet the compliance targets for this year?

keep'er running...
That's not the big no-no here. Lack of any real DRP is. Sure, it's cheaper to just buy CS Falcon (and who knows what other amazing vendors supplied timebombs are ticking silently) than paying sysadmins and developers ... and letting them build something that does what it needs, not much else, so there's no need to put these fantastic "single agents" from these RCE-as-a-service vendors on all the fucking servers.
Read on Mastodon: https://infosec.exchange/@littlealex/112813425122476301

The CEO of Crowdstrike, George Kurtz, was the CTO of McAfee back in 2010 when it sent out a bad update and caused similar issues worldwide.

If at first you don't succeed, .... ;-) j/k
Yes. Yes. To hold in my hand a button that contains such power, to know that blue screens on such a scale was my choice. To know that the tiny pressure on my thumb, enough to push the button, would end everything. Yes, I would do it! That power would set me up above the gods. And through Crowdstrike, I shall have that power!
Am I missing something? This is to add a toggle button and the developers say they are blocked because GPU acceleration feature doesn't exist so the button wouldn't be able to do anything.
So, in other words, there's a race condition in the CrowdStrike Falcon driver at startup time. That, in itself, should be a major cause for alarm, but here we are depending on it to fix this problem.
It's a Mossad/CIA sponsored spyware agent.
I'd say very special people need malware protection like this on their iPhone.

Remember NSO Group? Or the campaign Kaspersky exposed last year? Apple successfully made malware on iOS very rare unless you are targeted. But right now, it is impossible for these targeted people to get any kind of protection. Even forensics after being compromised is extremely difficult thanks to Apple's walled garden approach.