skysight-inc/HackerNews huggingface dataset:
How is it their fault and responsibility? Isn’t falcon sensor basically running like a kernel module? Does it mean that Windows is not engineered properly when it can be crashed by this?
I have been told 'not to worry' because it isn't a cyber attack. Yet the outcomes we are seeing feel a lot like the doomsday predictions of what a cyberattack would do. It is almost as if we are experiencing the cybersecurity/warfare equivalent of 'friendly fire'.
Since we live in a capitalism, financial losses are the only one anyone cares about at scale. What's a human life worth nowadays? About 10 million for a healthy prime age adult? Negative for elderly?
Note: parody of famous Onion article about mass shootings https://www.theonion.com/no-way-to-prevent-this-says-only-na... applied to Crowdstrike and C++ vulnerabilities.
One would hope that Crowdstrike does a similar thing on Linux and relies on fanotify and/or ebpf instead of using a kernel module. The other upside to this would be not having to wait for Crowdstrike to be constantly updating their code for newer kernels.
The government is way ahead of you.

Not even the women will be spared in defence of democracy in the ME and Ukraine.

https://thehill.com/policy/defense/4730560-senate-democrats-...
It's very avoidable. Just don't use shit software.
>Crowdstrike does have Mac/Linux "endpoints" also (IIRC) but I'm unsure if they're affected as well.

We have this crap running on our computers, and only Windows boxes seem affected.

On Linux this isn't running in kernel mode (our kernels are too up-to-date) and we don't seem to have any issue there.

Haven't heard anything about macs though.
AVR has no protection and no segments. I mean really, it seems to be true that new generation of programmers have zero understanding of hardware, nothing personal.
I think Calibre advocates forgot what it's like to setup it for the first time and what a messy ugly process it is for new timers. A containerized version needs VNC access to set it up and perform some un-intuitive UI actions https://docs.linuxserver.io/images/docker-calibre/#applicati...

I've used https://www.kavitareader.com/ but it's not perfect either, this space could be "disrupted" by a Plex like product with opensource + licensed offerings but the target market is pretty small I think.
For years now antivirus solutions have ridiculous amount of control over the OS. I accidentally installed an adware antivirus the other day that was bundled-up with a third party software, and I had to boot to Linux to manage to completely remove the damn thing from Windows. The uninstall option left a process running that couldn’t be forcefully killed.

Microsoft needs to take control and forbid anyone and anything from running software with that kind of behavior.
Yea, came here to say, what about wall! :)
In most appreciations of risk around upgrades in environments with which i am familiar, changing config/static data etc counts as a systemic update and is controlled in the same way
… with unlimited stamina, patience and capacity for negative feedback. If it was forever, you’d probably learn to take advantage of that resource!
Yeah we have a staging and test process where we run their updated Falcon sensor releasees.

They shit all over our controls and went to production.

This says we don't control it and should not trust it. It is being removed.
Ask HN: What is in C-00000291*.sys?
That user is the equivalent of using a screwdriver to look for gold and succeeding.
What happens if you've got remote staff?
Since a vital "un" got missed from the first bullet point:

> By early 2022, when the omicron family of variants predominated, that rate declined to 7.7% among unvaccinated adults and 3.5% of vaccinated adults.
Reading the example:

template <typename... T>
constexpr auto first_plus_last(T... values) -> T...[0] {
return T...[0](values...[0] + values...[sizeof...(values)-1]);
}

it seems there are 5 different kinds of uses of "...".

1. typename...
2. sizeof...
3. values...
4. T... representing multiple parameters in the formal parameter list.
5. T... for the type of the pack (supporting T...[0], the new feature).

I don't have a big point, I'm just mildly amused. Even with the simplifying new syntax, it took me a while to work through what is what in the example.

I wonder why it's T...[0] and not just T[0]? In parameter lists you need the distinction between "T", a single parameter of pack type, and "T...", multiple parameters supplied from the pack. But I don't see a similar need in an expression.
Crowd-sourcing created the Oxford English Dictionary (2023)
Well, if they'd used a different vendor (or nothing) on the DR servers we could have done a failover and gotten on with our day. But alas nobody saw, an app that can download data from the internet, whenever it wants to update itself arbitrarily without user intervention, as a problem.

So here we are.
help for if you have bitlocker turned on (because of course you do).

https://x.com/attilabubby/status/1814216589559861673

https://x.com/nathanmcnulty/status/1785094215749476722?s=46

GPO to fix:

https://gist.github.com/whichbuffer/7830c73711589dcf9e7a5217...
TradingView's Emotional Subscription Cancellation
Scientists have uncovered the structure of 1918 flu virus (2004)
Since what Moldova is Russia? Am I on reddit or 4chan?
I could never get smooth scrolling to work on Linux in any mainstream web browser, most people don’t seem to see it, but I’m sensitive to things like that.
While it could be that you and them work on different kinds of code, I believe it's just as likely that you're just different people with different experience and expectations.

A "wow, that's a great start" to one could be a "damn there's an issue I need to fix with this" to another. To some, that great start really makes them more productive. To others that 80% solution slows them down.

For some reason, programmers just love to be zealots and run flamewars to promote their tool of choice. Probably because they genuinely experience it's fantastic for them, and the other guy's tool wasn't, and they want them to see the light, too.

I prefer to judge people on the quality of their output, not the tools they use to produce it. There's evidently great code being written with uEmacs (Linux, Git), and I assume that, all the way on the other end of the spectrum, there's probably great code being written with VSCode and Copilot.
Is the alternative "mass hacking"? I thought all this software did was check a box on some compliance list. And slow down everyone's work laptop by unnecessarily scanning the same files over and over again.
It is really good, isn't it?

Also, mandatory reading for context: https://theeggandtherock.com/p/i-wrote-a-story-for-a-friend
This is great, now we just need a way to host it on our mobile phones.
It isn't, though. "You may not sell into a situation that creates an unacceptable hazard" is essentially how hazardous chemical sale is regulated, and that's just the first example that I could find. It's not uncommon for a seller to have to qualify a buyer.
I'd say regardless of the OS, you might find a company like Netflix is less likely to impose security-theatre box ticking exercises.

Which makes it less likely to take a 3rd party agent from a snakeoil company that sells to execs, then embed it at low levels into mission critical services with elevated privileges, then give it realtime external updates that can break your platform at any point.
Yes AI already solved it, my god why people are so high on LLM's solving everything
Interestingly but central Asia it is called Arak. Same root.
Starbucks parts with signature "third place" philosophy
Nothing, but buckle up, we need to refactor our stack again.
Everytime i look into such catastrophic issues, it always boils down to lack of robust canarying mechanisms.

They have enough client base that they can even run an A/B test on the whole binary level, but no.
It's correct that these are political/economical decisions. But most people in society neither have the knowledge for an informed opinion on such matters, nor a vote.
This is how the internet should be used! Awesome stuff
And I never said that anyone is telling me to use Java. It was an example.

Because of the nature of AV software, its code would be drowning in "unsafe" memory accesses no matter the language we chose. This is AV, it's always trying to read the memory that is not AV's, from its very design.

This is a story about bad software management processes, not programming languages.
That's how I read it, ie "will there be severe fines for the loss of life and other losses for this?".
CrowdStrike should have learned the lesson from the more seasoned players in the industry to slow roll their updates and observe.
Same, can't understand people evangelizing Wayland

I have a laptop 10.1 2560x1600 with a 32' monitor, and another 27', never had any problem

Wayland has practically no advantages, you have to spend hours configuring, and still have apps working badly... they are always just a month away from having "everything" fixed

Maybe Wayland is the future but I'll keep using Xorg distros for the foreseeable future
Relying on easy-install "security vendors" is the problem. It's one thing to run an antivirus on a general purpose PC that doesn't have a qualified human admin. But many of the computers affected here are single-purpose devices, which should operate with a different approach to security.
While this is a great theory, how would you actually accomplish this with antivirus software?

Multiple machines, each one using different vendor software? What other software needs to be partitioned this way? What about combinations of this software?

I’m just barely awake but don’t know if I’m affected yet. One of my devs is, our client support staff is, and I have no idea how our servers are doing just yet.
Great little piece of software.
I wonder if these airlines were really affected by that Azure problem or if they were affected by the CrowdStrike issue and were just mixing things up.
The waves that are already looking like a storm in a teacup ?

There is no 'AI', that is always only hype. There is machine learning, which is a very powerful technology but I doubt MSFT will be leading that revolution. As for LLMs, MSFT might have some competitiveness there but I doubt it's going to be a very lucrative market. MSFT is highly overvalued.
I heard the central system was on Azure, running CrowdStrike.
Complexity. As you get further from the driver and the kernel software complexity expands massively. It gets to a point where it is beyond the abilities of humans and processes to manage it in a cost effective manner.
Ask HN: What ChatGPT custom instructions have worked for you?
it has been a while since https://openai.com/blog/custom-instructions-for-chatgpt was released, now that the community has had time to play around with this feature, what are some custom instructions that have yielded useful results for you?
This past week I purchased a thermostat. There were "high-end" touch only models, models that were app-assisted also with analog controls, and then finally old school analog only. I went with the middle / combo so that I have analog as a call back if the pure tech mode fails.

Being prepared can cost more and/or be less flashy (read: I didn't get touch-only) but it's only peace of mind, at least for critical components. I want a thermostat that works, I don't get no satisfaction from any bragging rights. Nod to the Rolling Stones.
Bitlocker keys are apparently not necessary: https://x.com/AttilaBubby/status/1814216589559861673
Why would they roll out this update globally to all users immediately? Isn’t it normal to do gradual rollouts? Or did this update contain some critical security fix they wanted everyone to have as fast as possible?
Like anything else, Poker is a skill that you can learn with time and practice.

It is not really related to your smartness or luck (doesn't apply to _everyone_ of course but I'd wager that the average HN reader is already smart enough for poker)
ALB airport down. Check in systems are in BSOD ‘Recovery Mode’.
In your world i should switch my modest 1000 seats over to Linux desktops?

I'm not sure how i'm going to explain the productivity loss and retraining costs to the board if im honest.
CrowdStrike Stock Down Almost 20% in Premarket Trading
Yup. Well in our case (and we are thankfully not affected), they could call IT support. But then again, if IT support themselves cannot boot their PCs...
Testing is never enough. In fact, it won't catch 99% of issues by the virtue of them often testing happy paths only, or that they test what humans can think of, and by no means they are exhaustive.

A robust canarying mechanism is the only way you can limit the blast radius.

Set up A/B testing infra at the binary level so you can ship updates selectively and compare their metrics.

Been doing this for more than 10 years now, it's the ONLY way.

Testing is not.
if I'm reading this correctly the short interest for the stock doubled over June? :)

https://www.nasdaq.com/market-activity/stocks/crwd/short-int...
> So I am not convinced that there need to be "at least ten alternatives" to be fail safe as society.

The required number "N for safety" is a good discussion to have. Risk-Return, Cost-Benefit etc are essential considerations. We live in the real world with finite resources and stark choices. But I would argue (without trying to be facetious) that they are risk management 102 type considerations.

Why? Because they must rely on the pretense of knowledge [1]. As digitization keeps expanding to encompass basically everything we do, the system becomes exceedingly complex, nobody has a good picture of all internal or external vulnerabilities and how much they might cascade inside an interconnected system.

Assessing cost versus benefit implies one can reasonably quantify all sides of the equation. In the absence of a demonstrably valid model of the "system" the prudent thing is to favor detail-agnostic rules of thumb. If these rules suggest that reducing unsafe levels of concentration is not economically viable there must be something wrong with the conceptual business model of digitization as it is now pursued.

[1] https://www.nobelprize.org/prizes/economic-sciences/1974/hay...
If you ever try bananas from Philippines, the Latundan is great. In general, once you taste how good all the different bananas can be, you'll never want to just go back to the Cavendish which is mostly boring.
Or like...one power company in Texas?
My source: I review a lot of contracts. It's very common for things to be explicitly required.

Yes you can go back and forth and argue the toss, but it pushes up the cost of the sale and forces your customer to navigate a significant amount of bureaucracy to get a contract agreed. Or you could just run AV like they asked you to...
Yeah but TPM-only Bitlocker shouldn't be affected anyway by this issue, these machines should start up just fine.

Whoever only has AD-based Bitlocker encryption is straight up fucked. Man, and that on a Friday.
Gloriously pointless, yet frightfully well carried out.
Surfacing New information, especially via cultivating networks is a good recommendation. This is what makes Journos stand out too, in an age of Content Surplus.

Also worth pointing out that Writers (& content creators of any kind) have become front line troops in the Wars for Finite local/global Human Attention being waged by much larger forces. Even before AI showed up.

Content keeps exploding but Attention does not grow. Therefore those with cash and resources (corporates/platforms/politicians etc) are trapped into spending more and more on Attention capturing/stealing Content.

This changes traditional demand/supply equations. Content demand is not driven purely from people or readers or consumers who have finite attention, but from platforms and corporations that are trapped in empire defense or market capture games with different end goals than a reader or a writer. So its useful to separate out the sources of demand for the content to not become too dependent or tied to one source.

Also Platforms might show the content creator they got 1 view from 1 person. But they dont show that 1 person then goes off and consumes 50 other things and the attention the content receives is being diluted. Writers aren't paying attention to the dilution factor. And Platforms aren't advertising it cause they want writers to believe they have much more impact than they actually do so the spice keeps flowing.
How did they fail to test such a critical bug then ?

Clearly shows lack of testing.

If intially good, probably culture & products have rotten.

Not fit to be in security domain, if like this.
Or don't \o/
Why? Because you simply wish it to be so?
This article seems more relevant than ever and was posted a few days ago: https://ea.rna.nl/2024/07/12/no-it-really-no-i-t/
Show HN: Convert Reddit Traffic into Customers
<Points at BBC news live feed>

Its not just us, form an orderly queue and you'll been seen soon.

Do you really all have these mentally unstable userbases?
Something that has managed to ground a lot of planes and disable emergency calls today is in fact critical. The outcome of it failing proves it is critical. Whatever it is.

Now, that it was not known previously to be critical, that may be. Whether we should have realised its criticality or not, is debatable. But going forward we should learn something from this. So maybe think more about cascading failures and classify more things as critical.

I have to wonder how the failure of billing and baggage handling has resulted in 911 being inoperative. I think maybe there's more to it than you mention here.
Memory safe language does not prevent crash.

In case of potential UB (and then memory corruption), you get a guaranteed crash.

Wait, crash? :wink:
I only know them because their CEO is a relatively good amateur racing driver lol.
GPL exported symbols are the ones that are thought to be so tightly coupled to the kernel implementation that if you are using them, you are writing a derivative work of the kernel.
They choose because other have. "Look how many others choose us" is a common marketing cry. Perhaps instead too popular is a reason not to choose? Perhaps not parroting your competitors and industry is a reason not to choose?
Now they know the state of each of the affected companies systems. How adept their sysops guys are, a birds eye view of their security practices. Nice move and plausible deniable too :D.

I mean how did this happen at all? Are there no checks in place @ crowdstrike? Like deploying the new update to a selected machines and check whether everything is ok, and then releasing it to the wild incrementally?

Mind boggling.
ChatGPT is not bullshitting; it is outputting words within the same statistics as in training dataset.

The bullshit is only in the actions of marketers trying to engage technically illiterate wallets in funding a bubble out of false promises (such as "dreaming", "imagination", "hallucinations", "bullshitting", "superintelligence", "superalignment", "smarter than human", and so forth).
Would you mind listing some of the killer Calibre features you'd expect to see in an MVP?
TLDR;

The Chorleywood bread process is a method of dough production to make yeasted bread quickly, producing a soft loaf. It allows the dough to be made with lower-protein wheat and it uses more yeast, added fats, chemicals.

80% of all the bread made in Britain, Australia, New Zealand and India, use the process.
Vendors of tools like this drive the cybersecurity industry discourse, so 'defense in depth' often practically sorta means 'add more software that does more things'.

But maybe this kind of thing can actually impart the lesson that loading your OS up with always-on, internet-connected agents that include kernel components in order to instrument every little thing any program does on the system is, uh, kinda risky.

But maybe not. I wonder if we'll just see companies flock to alternative vendors of the exact same type of product.
Central Asia (where I actually live) does not have much to see, esp. Kazakhstan. The main tourist destinations are historical monuments in Uzbekistan which has huge tourist influx lately (every time I am in Uzbekistan I see a good deal of tourists around hotels). Kyrgyzstan and Tajikistan have beautiful mountains, nature. Kazakhstan is bit dull post-Soviet place, Almaty resembles more some city in Eastern Europe than Asia.
So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself. It's easy to blame CrowdStrike but that seems too easy on both the orgs that do this but also the upstream forces that compel them to do it.

My org which does mission critical healthcare just deployed ZScaler on every computer which is now in the critical path of every computer starting up and then in the critical path of every network connection the computer makes. The risk of ZScaler being a central point of failure is not considered. But - the risk of failing the compliance checkbox it satisfies is paramount.

All over the place I'm seeing checkbox compliance being prioritised above actual real risks from how the compliance is implemented. Orgs are doing this because they are more scared of failing an audit than they are of the consequences failure of the underlying systems the audits are supposed to be protecting. So we need to hold regulatory bodies accountable as well - when they frame regulation such that organisations are cornered into this they get to be part of the culpability here too.
AWS is not any better really on this. In fact 2 years ago (to the day!) we had a complete AZ outage in our local AWS region. This resulted in their control plane going nuts and being unable to shut down or start new instances. Then capacity problems.
> If I overload shift-left `<<` for a completely different concept such as "piping", that's my mistake.

Yours and C++'s.
Why CrowdStrike is a part of the Trump whistleblower complaint? (2019)
You don't even need a VPN. Just replace ISP's DNS servers with, say, Cloudflare's

1.1.1.1
1.0.0.1

or maybe OpenDNS's.

[Edit: fixed wrong fallback address.]
I bet BER staff is screaming at the passengers right now "you wanted this, it's your own fault".
I run a website alone. I often use it to find better ways to explain things in plain English. It's good to see how ChatGPT explains a thing, and use it to improve my own explanation.

I'm now testing automated translations of my Markdown-based content, but the unpredictable nature of LLMs mean a lot of potentially costly errors could slip through. However, offering a website in multiple languages without additional labour is very appealing. I could reach a far greater audience, and help a lot more people.

I also use the far better modern text to speech APIs to tell my readers how to pronounce complex German words.
It's funny that you mention co-op and lidl.. neither of them actually have "bread fresh baked on premises including stuff like ancient grain sourdough" [0].

kwhitefoot is correct and the vast majority of bread in the UK is not what you think it is.

The bread in these two stores is mostly baked in a factory and then delivered to the store where it may be heated for a golden crust (at most). The ancient grain sourdough is (likely) just mostly wheat bread [1].

In my personal experience, I was always suspicious of the "fresh sourdough bread" at Tesco. It was far too soft to be real sourdough bread and now I think it was a straight-up lie- sorry just a marketing label.

[0] https://www.theguardian.com/business/article/2024/jun/11/fou...

[1] https://www.sustainweb.org/news/dec23-lidl-sourdough-sourfau...
While I agree 100% with what you say in principal, stats show that these occurrences are increasingly rare.
Even the supermarkets should have quite a bit in their 'fresh' section that's made more normally. Particularly look for sourdough - even if it's not real sourdough you should find stuff that's had a decent amount of time to rise.

Beyond that - visit a bakers or a market or something.
My team and I have begun to refer to this issue as CrowdStroke