skysight-inc/HackerNews huggingface dataset:
Gosh, my first job was writing HTML emails. Those heady days of lamenting the fact that some companies STILL use Lotus Notes not dead, I see.
How did it get broken then?
I do not believe these attempt to exploit regularities.
The real trick would be for LLMs, which currently do math very poorly, to simply send "math to be done" into a spreadsheet, and retrieve the results... (If anyone is aware of an LLM that's great at math and physics, pls lmk!!)
Considering what Crowdstrike is intended to do, it's not really possible for it to work without running at the kernel level.
It's not about checking the boxes themselves, but the shifting of liability that enables. Those security companies are paid well not for actually providing security, but for providing a way to say, "we're not at fault, we adhered to the best security practices, there's nothing we could've done to prevent the problem".
I love poker, and I'm solid on the math foundations, but I still suck..

Any book/other resource recommendations for brushing up on this stuff?
I would wager that even most software developers who understand the difference between kernel and user mode aren't going to be aware there is a "third" address space, which is essentially a highly-restricted and verified byte code virtual machine that runs with limited read-only access to kernel memory
And what if this bug happened to affect Linux somehow too? What then?
Linux is blamed for bad device drivers all the time, even on HN.
Worked for me. Working for a few or my colleagues. Reboot again and again.
both are true
well this particular site has survived 98 years. I wonder if it ever got flooded and then restored or if it went the whole time without flood damage
For people protesting desegregation, the laws promoting desegregation were unjust.

For me, personally, punishments like death penalty (and adjacent, maximum security prisons, like ADX Florence) are abhorrent. If I had superpowers, I would violently oppose them. I would literally dismantle ADX Florence brick by brick, if I could. I imagine some people reading this would be equally horrified, and, would also violently oppose me.

The problem with protesting unjust laws is that these laws are just for other people. Coming to a personal conclusion on what laws are unjust is easy. Achieving consensus is impossible. Sometimes, even achieving majority is impossible (see, for reference, the Just Stop Oil guys who got 5 years in prison).

I'm not saying not to resist unjust laws; far from it. I am saying that determining what is moral and what is not is one of the hardest philosophical problems there is. And that opposing can, in some cases, lead to violence and civil war.
Sure but if that Canonical sales person was successful in that, I'd almost guarantee that after they switched the first third they'd be in there arguing to switch out the rest.
Wow love it, great work on this! I think you've tapped into a nice market, trying to reproduce marketing dept. designs into HTML templates are always a pain.

I'm looking forward to seeing the product grow!
How do you objectively assess an operating system's security? I wanted to convince friends that Windows is insecure but I couldn't find unassailable evidence. Got some? There are confounding variables like the age of the operating system and size of the userbase (distorting the event volume), its attractiveness to attackers, and the tendency of organizations of different levels of technical ability to prefer different operating systems...
"empathy" "right" "help" "hope" "same"

None of those words appear in the article. I can deduce that the author of this article would never return a wallet. If they are this perplexed at the good deeds of others, and need to turn to science for a reason, they are as dense as a brick.

Reasons:

- because kind strangers have empathy

- because kind strangers want to do what is right, and help others

- because kind strangers would hope the same thing is done when they lose their own wallet
The second largest hospital group in Nashville experienced a ransomware attack about two months ago. Nurses told me they were using manual processes for three weeks.
No concept of "canarying", eh?
wow, why do lifts require an OS?
You don't like the term "IT managers"? Let's call them "company managers", suits better?

You as a company allowed and external entity to push a completely uncontrolled update on all your production envs. What if crowdstrike had been hackered and instead of a BSOD you get a cryptolocker?

If you don't realize how crazy is this, then I having nothing to add.
>You can't do without airports and airlines, but why PayPal still exists in 2024 - I don't understand.

What don't you understand? In the US, the party that says "the government should not interfere with business" wins a lot of elections and the party that says "the government should protect consumers from corporate harm" wins way fewer elections.

So we have almost no consumer protections, so it's largely not illegal or risky for a business to fuck over their consumers which is very profitable so most businesses fuck over their consumers in various ways.
It's currently a DOS by the crashing component, so it's already broken the Availability part of Confidentiality/Integrity/Availability that defines the goals of security.
Not the NSA, but I know of at least one time the FBI did: https://arstechnica.com/security/2024/01/chinese-malware-rem...
Why are these things running Windows!?
I took a film lighting class a long, long time ago at a community college. Even then, you could look at a closeup and tell where the lights were by the reflections in the eyes.
Can auto updates be turned off on the crowdstrike falcon client?
With colossal power, who cares about responsibility
no, CFR is mainly just a way of computing Nash equilibria and (although in some sense it is an online, iterative algorithm) would typically be used to precompute Nash strategies, not update them in real time. real poker playing systems augment the CFR strategies with some real-time solving, but just to get even closer to Nash at the end of a hand.

on top of this, you could think about augmenting these systems to exploit weaknesses in opponent strategies. there is some work on this, but I don't think it's done much. The famous systems that played against professionals don't use it, they just try to get as close to GTO as possible and wait for opponents to screw up.
Once you get legal involved the employee becomes the liability, not the asset.
This is honestly wild. 99% of devs would have found a work around and moved on. Going so far as to create a multi-kernel test bench to narrow down the source of the instability is a level of dedication I have not personally seen, and I respect it.
It's quite handy that all the things that pass QA never fail in production. :)

On a serious note, we have no way of knowing whether their update passed some QA or not, likely it hasn't, but we don't know. Regardless, the post you're replying to, IMHO, correctly makes the point that no matter how good your QA is: it will not catch everything. When something slips, you are going to need good observability and staggered, gradual, rollbackable, rollouts.

Ultimately, unless it's a nuclear power plant or something mission critical with no redundancy, I don't care if it passes QA, I care that it doesn't cause damage in production.

Had this been halted after bricking 10, 100, 1.000, 10.000, heck, even 100.000 machines or a whopping 1.000.000 machines, it would have barely made it outside of the tech circle news.
Surely a computer without internet would not have received the update?
Need to make software developers legally liable like other engineers, that will cause a huge behavioral shift
props to your IT guy for setting up in house phones.
I believe these should be kept and expanded upon.
Sometimes just paying it and moving on is in fact the simplest solution. Fighting it in the courts would have taken time and effort, and unless you could find a good pro bono lawyer, money. Fighting it in the court of public opinion is another option. Visiting you elected representatives offices for a chat about it takes a limited amount of time, but can have a big impact. Please don't misunderstand me, I am blaming you for anything or judging your decisions, I am merely offering suggestions to you and anyone else about ways to make things better :)
I guess it depends whether you want your system to work, or whether you just want it to be not your fault when it breaks
I would also point out that the backup plan (Radio and Binoculars) are not only effective but also extremely cheap & easy to keep ready in the control tower at all times.

The same cannot be said for medical records.
From The Planetary Society: "None of NASA's budget is used for national defense or intelligence gathering programs; it is a civilian agency responsible for the peaceful exploration of space"

Do you have evidence to the contrary you could share?

https://www.planetary.org/space-policy/nasa-budget#:~:text=N....
Expected mission lifetime is often a function of "if thing X, Y, Z goes wrong". As you get past X, Y, and Z, mission lifetime will grow significantly. For example, for the James Webb telescope, its expected lifetime was limited by expected precision of orbit insertion by the Ariane 5 that launched it. Ariane 5 performed perfectly, so the resulting precision means the lifetime of the telescope is extended.
The first. AV evasion is a whole discipline in itself and it can be anything from trivial to borderline impossible. Crowdstrike definitely plays in the champions league.
What, the auto-updating part? Obviously the client is verifying signatures (or using TLS with a client certificate, whatever), not just accepting whatever random file comes down the pipe.
I installed snap version of Foliate on Ubuntu20.04. And it failed to work for me (when I open a valid epub, it is just blank). I’m so disappointed when I see something that I badly want and it doesn’t work.
It's automatic, no? The whole "promise" (oh sorry, the "added value proposition") of CS is that they "keep you safe" automatically! It was a content update. Meaning basically antivirus signatures ... and oops, some minor non-functional changes to the filtering kernel driver.
Have you read Termination Shock, and if so, how do you feel it stacks up? It was, regrettably, my first (and still only) Stephenson book, and I thought it was really quite bad in all the ways that matter to me. (The action was good, but I don't read sci-fi for the action.) But I see so much love for him in hacker circles online that I wave on whether or not I should give his more famous works some attention.
Wow, you know a lot of people!
I used to watch her videos back when she had very little followers. I'm glad to see she picked up so many subscribers, it's well deserved. I enjoy the way she interacts with the people because it seems more natural than the other heavily edited/pro formats.
That would seem crazy. Maybe there is a crowdstrike onprem “master server” that is supposed to be available internally? Just spitballing, have no idea really
You forgot the "... while in kernel mode".
I'm curious if you are sure it's antivirus? WSL networking is weird and can be a pain in the ass. Especially in VPNs are used.

I'm wondering if you know wsl-vpnkit?
Gasoline is very useful. We also take a lot of precautions when using it.

We also have things like inspections and financial penalties if you were storing it in an unsafe manner.

It's clear we need to take more precautions before using Crowdstrike. More testing, ability by IT departments to not push updates, ability to rollback updates.
How come lifts and cranes are affected by this?

Are they somehow controlled remotely? or do they need to ping a central server to be able to operate?

I can see how alarms, email and phones are affected but the heavy machinery?

(Clearly not familiar with any of these things so I am genuinely curious)
CrowdStrike mentioned when Trump talks to Zelensky in 2019
> [Trump]: I would like you to do us a favor though because our country has been through a lot and Ukraine knows a lot about it. I would like you to find out what happened with this whole situation with Ukraine, they say Crowdstrike… I guess you have one of your wealthy people… The server, they say Ukraine has it.
IT departments sometimes ask this for a reason, after you checked if the cable is plugged.
The answer is clearly no.

I genuinely wonder if this is going to result in actual legislation that makes gradual rollouts mandatory for all software.

Because if a developer mistake can hobble critical systems like this, it seems like the risks to safety and national security are too great to leave the decision of instant vs. gradual rollouts for companies to decide themselves.

Of course, the twist here is that it was seemingly a kind of routine configuration file that triggered a pre-existing bug in the software. And gradual rollout of config files quite often seems like overkill. I mean, do you need a gradual rollout of a new spellcheck dictionary? Of new screensaver videos?

And if it's configuration information containing new computer virus or malware signatures, that seems like precisely the kind of thing that you might want to get out to everyone simultaneously, not rolled out over the course of days. And yet, because of antivirus/security software's elevated privileges, it's also ironically where a mistake can do the most damage.
Maybe it will. It really depends whether it's "easier" for the network to learn an intuitive physics, versus a laundry list of superficial hacks that let it minimise loss all the same. If the list of hacks grows so long that gradient descent finds it easier to learn the actual physics, then it'll learn the physics.

Hinton argues that the easiest way to minimise loss in next token prediction is to actually understand meaning. An analogous thing may hold true in vision modelling wrt physics.
Yes - the logo does need a little work. Maybe the font is the wrong choice? And the L perhaps needs something. It almost looks as though they're leaving room for another L to make an LLM logo.

I like most of the styling, though.
I still think of how 'cyber' was used in AOL Chatrooms back in the 90's...
You can do full passive, but you need a quite clunky heat sink.

My home router is a $80 N100 + 4x 2.5GbE box, passively cooled.
Man that would suck. I rely on muscle memory to recall passwords in everyday usage. Of course I could open a PWD manager elsewhere but it becomes cumbersome.
Crowdstrike needs to be the first person in the room so that they can act like the boss. If other people show up before crowdstrike, there's a possibility that they'll somehow prevent crowdstrike from being the boss. For this reason, crowdstrike integrates with the boot process in ways that most software doesn't.

Their ability to monitor and intervene against all software on the system also puts them in a position to break all software on the system.

more accurately: s/boss/most informed spy/g
This is what kills most "non-standard" homes and buildings - anywhere in the world.

If you build an American-style house in Bavaria it may end up a disaster because nobody around knows the building materials or how to fix it.

It gets even worse when it's entirely custom like this Skywalker style house, where it's a one-off using techniques nobody knows. You need a dedicated maintenance crew for that so they can learn all about it over time.

So something like this could work for a largish company, or a college campus, but as a one-off house it's going to be expensive and eventually abandoned.
Off-topic: thank you for the app! It's (subjectively, of course) by far the best weather widget out there - and I've tried a number of them. Really appreciate your work.
>What nobody seems to want to answer is why it was brought to the discussion, especially when it was already, and explicitly, established that the exact mechanism for the animal's behaviour is irrelevant to said discussion.

Who said that? As far as I can tell the discussion was the difference between domesticated cows and bison, and I didn't see anyone say breeding is irrelevant except you.

> What makes breeding so different that it justifies violating the discussion that was taking place?

What exactly are you talking about? You are being obtusely vague

>Where do you dream this stuff up?

No need to be rude, it's not helping anything. You are being rude to the other poster too, when it's your fault for not communicating clearly and just insisting everyone made the same assumptions as you when it's clear they didn't. Rather than make things clear, you just keep insulting people on top of things.
> but it always puzzled me that anybody in IT would think a mega-priviledged piece of software that looks into all files was a good idea.

Because otherwise, a piece of malware that installs itself at a "mega-privileged" level can easily make itself completely invisible to a scanner running as a low-priv user.

Heck, just placing itself in /root and hooking a few system calls would likely be enough to prevent a low-priv process from seeing it.
Is this site generated by ai? Repeating the same words and making zero points
Nobody did gradual rollout in 1992
There's a video I saw a while back of these Indian women who knitted sweaters for the elephants because there was a very cold winter that year. The elephants, normally aloof, heard them singing at the edge of the woods, saw the elephant sized clothes, came up and let the women put giant sweaters on them and left.
Almost every system you interact with in the world has some critical thing in its innards running windows.
I would love first class support for some limited subset of markdown (same for browsers actually).
Yes it works very well for the intended purpose (which isn't actually security). The intended purpose is CYA. As head of security, if you install CrowdStrike or some other vendor, then a compromise becomes that vendor's problem, not yours.
None of my enterprise ERP/PLM/CRM systems run on Mac Server OS
At least hackers let people boot their machines, and some even have an automated way to restore the files after a payment. CS doesn't even do that. Hackers are looking better and more professional if we're going to put them in the same bucket, that is.
> immature? Yeah, probably!

I find it funny that adult security researchers still get away with identifying themselves with hacking monikers in public as if they were teenagers probing the local telco back in the 1980's.
https://news.ycombinator.com/item?id=41004103
It was a data update that triggered a software bug. It was not a software update. I don't think it's reasonable to make data updates illegal.
Because CrowdStrike is an EDR solution it likely has tamper-proofing features (scheduled tasks, watchdog services, etc.) that re-enables it. These features are designed to prevent malware or manual attackers from disabling it.
Then you will enjoy the digital modes because there are so many different ones that all use different tech to accomplish different tasks. Some are extremely popular (like FT8, which is BY FAR the most popular thing on ham radio, even more than voice), down to very obscure experimental digital modes that very few people use but half the fun is trying to use them and see who else may be out there trying to do the same.

The FCC also just increased the bandwidth limit on HF so I expect a ton of new experimental modes to start popping up in short order.
> How do you access the boot menu for a server running in the cloud, which you normally just SSH into (RDP in Windows' case)?

They just said IMPI.
> The Plan 9 guys are UNIX guys.

Who are also the Go guys, but we already know that as it was already talked about much earlier in the thread. If you have some reason to return to that discussion, let it be known that you have not made yourself clear as to why.

> Punchline is without Google's moat, Go would have gone the way of Plan 9 and Inferno.

And that relates to the topic at hand, how? I am happy to wait. No need to rush your comments. You can get back to us when your conclusion that connects this all back to what is being talked about is fully written.
Nah, they just need to install the agent on each engineer's computer from DevSafe.
Even then, how many affected machines there are? Tens of thousands, hundreds of thousands? Compromise these servers and even possible signing server and you have largest bot net or general compromise in history...

It is not unreasonable to think that this sort of software could get compromised.
> why you NEVER have software that updates without explicit permission from a sysadmin

In general I agree, but this case is quite messy. It's more like your anti-virus had a bug since forever that if it loads a broken virus definition it bricks your system. And a broken virus definition finally happened today.

Do you want every virus definition (that is updated every few hours) to require explicit permission from a sysadmin?
You want me to trust random translation tools on the internet for technical issues?

No.
It won't change any minds among the flerfers. Commercial airline flights regularly go to 40,000 feet. You can see the curvature of the earth just fine at 40k feet.

It's clearer at 100k feet, but if you're intent on not seeing it then you still won't see it.

I have doubts that even orbit would change their minds. They've already gone through contortions about why it's night in some places when it's day in others. I am quite certain they're up to the task of explaining why they're over America now and then Africa, previously out of sight, a few minutes later.

It's just not worth arguing with those on intent on being stupid. They can simply say "no" and no power of evidence or logic can force them to do otherwise.
I have a friend in a local county jail. He pays $0.21/minute for calls.

I also communicate with a friend in the state prison system in Texas. An "email" (they do have limited use tablets) costs a "stamp", and each photo I attach is 1 stamp (limited to 5). (each "stamp" costs $0.45)
Right, an OS completely crashing like this is the fault of the OS and the problematic code.

An OS should be really resistant to this kind of things.
Security: You must install Microsoft Defender on all Linux VM's

Devs: Ugh...why?

Security: For safety!

Devs: Fine, we won't argue. Deploy it if you may.

A few moments later...

Devs: All of our VM's are slow as crap! Defender is using 100% of the CPU!

Security: Add another core to your VM's. ticket closed

Management: Why are our developers up 30% on their cloud spend!?
This page is only about using some APIs, that are now supposed to be called through wrappers. I would say it significantly limits the developers, and also may introduce additional flaws.
The argument for this I always get is security. Since email is so critical reducing the surface area of html/css supported somehow makes it secure. I...don't really buy it.
If you're planning around bugs in security modules, you're better off disabling them - malware routinely use bugs in drivers to escalate, so the bug you're allowing can make the escalation vector even more powerful as now it gets to Ring 0 early loading.
More specifically why are they running extra endpoint management software that receives automatic updates from the Internet...

This is basically the IoT apocalypse scenario (AC is down??) but ironically not affecting many IoT devices, I assume.
A lot of industrial machinery is just $x00,000 of equipment strapped to a windows pc. Hell, a lot of it is strapped to a version long EOL
I'm a pretty die hard linux guy, and I think Windows is a bloated nightmare, but it's not insecure IMHO (unless you consider "privacy" to be security, but most people do not (even though I think they should)). There was a time when that wasn't as true, though. If Windows were rewritten from scratch today, I'm certain there would be some different architectural/design decisions made, but that's true for pretty much every piece of software ever written.