skysight-inc/HackerNews huggingface dataset:
This is an area where studying Ukraine's experience will be very useful (and probably has already been useful)

There were years of cyberattacks against pretty much every peice of critical infrastructure they have. Things went down, there were disruptions, but they adapted. Sometimes by falling back to low-tech solutions, sometimes by developing new systems with robustness into new systems and purging the old (much easier to politically justify when the problem is tangible and immediate).

I seem to recall that one of the first things we did when tensions started ramping up was sending teams of cyber security experts from the NSA to help them lock down and root out infiltrations.
Due to the reputational damage they've experienced they are currently in the process of rebranding to the new name, CrowdStroke.
I mean, you can crash Linux too with bad kernel code.
Fair enough, still Rust's unsafe is not dropping all of its guarantees. Quite a lot of them remain in place.

Not saying you can't write bugs in Rust, of course -- that would be crazily delusional. I am saying they needed a better process. And I am saying that a stricter language could have improved the process a bit as well.
Low latency carbon budget analysis reveals decline of the land carbon sink
Have a look at the right hand chart. That shows the increase from 1960 until now. You couldn't spot 2020 by eyeballing the chart.

2020 was a 5% dip in the pace of the increase. It's like someone gained ten pounds in 2019, 9.5 pounds in 2020, and 10 pounds in 2021. CO2 emissions are analogous to a total gain, so a 5% one off cut isn't very meaningful.
On top of that, I am still struggling to understand how the people in charge of running orgs that run highly critical systems were OK with the idea that a 3rd party software provider could push at anytime patches to the software they provide.

Sorry for being harsh with my following statement, but I believe that the companies affected by Crowdstrike share some responsibility on what happened yesterday.
> Huge effort, I know

Okay. There’s 4 front office emails and 4 social media accounts, both presumably manned by non-technical folks.

So now you have to go back and forth just to get routed to the right place. Which may not even happen if this is the first time that employee handled a security incident.

You’re making it sound like sending the email or DM is the end of the work. That is usually far from the case.
Did you add "write the summary in the n-gate.com style" to the prompt too? It sure looks like you did.
Sometimes this is addressed not by fixing one model, but instead running post processing models that are specialized to fix particular know defects like oddities with fingers.
We're already there. The fact that we didn't see civilization collapse is evidence that there is a ton of infrastructure not running Windows and Crowdstrike.
It's really hard to generate "all due respect" for a16z.
If you consider static site generators as a special case of side-server rendering, then that is basically the principle that underlies my personal ssg [0].

Highlevel idea: It reads in all HTML files, parses them with JSDOM, builds a metamodel of the overall website, which (ab-)uses standard HTML meta tags as alternative to a frontmatter (e.g <meta name="template" content="articles"> declares the particular file as the template for the category articles, while <meta name="category" content="article"> declares a particular file as part of the category articles. And then it uses a non-standard HTML tag to call JS plugins with the whole meta-model of the site, so it can plug together content and template, rewrite parts of the DOM (for example add bidirectional links when desired, run a syntax highlighter on <code> tag, count words). When all plugins have run the DOM is serialized into HTML. Admittedly it could be a tad faster, but for my purposes it is good enough. I don't mind running a ton of JS on my machine, but still can serve mostly static HTML with very few sprinkles of client-side JS

[0] https://github.com/fnh/intertwingle/
> If more of the critical machines were running different OS's, the damage would be contained.

Not if they were running the same CrowdStrike.
Ha my actual question was downvoted. I guess people are as entitled as they say.
The HN mods changed the title to a less embarrassing one. Not surprised
We're talking CapEx vs OpEx, not "go back to the pre-industrial era".
It's "Au clair de la lune" FYI.
Yea, I'm sure the Russian/China/NK/Iran hackers are deeply afraid of the CFAA, you got them shaking dude (and vice versa when someone in the US hacks one of their sites).

The particular problem here is we think of the crime on the web in a civil/criminal manner... "People should just follow the law or be punished for a crime". This is not the internet. Regardless of what you think about the internet, it is an international war zone. If you leave the hatch of a tank open and a drone blows it up, that was you being stupid. If you leave an ammunition truck unguarded and the enemy takes it, again, that is you being stupid.

History will look back and say WWIII started on the web, but as of now it seems a huge number of people are in denial about it.
BitLocker recovery in Microsoft Azure [pdf]
Probably not a lot. Blowing up a ship in the middle of the Panama or Suez canal might do it, especially if you wreck it badly enough to block the canal for months. Even easier if you target a big oil tanker.

I don't think this is linear though. It's easy to target a weak point to inflict a small amount of damage, but hitting say 10% of GDP would mean targeting multiple sectors of the economy and putting millions of people out of productive work.
Oh absolutely. This is utterly unacceptable. The ease with which CS pushed willy nilly a bad build to prod in what seems to be a monophasic release is absurd.

Something of this nature would have had our entire team fired. The number of phases and the thoroughness and exhaustiveness of the protocols we have to ensure we don't push bad builds would have most engineers taken aback... but we have to. With great power comes great responsibility.
https://archive.md/CJdHl
Analysis of dump from Crowdstrike effected machine
This has been an open secret for decades. Just a handful of major OS and browser vendors, constantly shipping patches to their systems and most software having such vast software supply chains that it's effectively impossible to audit anything, let alone truly certify anything as safe, and "security" software just expands the attack surface.

Everyone in the industry knows this.

Interesting to see the NYT just catching up.
Ivanti got hacked in 2021.

Two years later it had 1 billion revenue.
For a long time after Burroughs was almost ancient history, banks still ran Burroughs machines. They've probably thrown in the sponge by now.

I'm sure IBM mainframes are still running critical stuff, too.
>Is your opinion suddenly not relevant anymore when you've fled the country?

Again and again the most intelligent people emigrate to the West and then seethe about the politics in their home country. I get why they do it, but it is really obnoxious. One main reason why developing countries have bad politics, is because everyone intelligent is leaving for the west and the same people who, for their own economic interest have left, are then agitating from the other side of the world for political change.

In some real way, leaving your home country also means leaving behind the ability to change anything about it.
My neighbor is 82. Every time I complain about being middle aged she tells me I am young.

Its all relative.

(She also tells me of the time she met the Beatles in Melbourne and that her childhood house had no flushing toilet. A 'nightman' would come to take the waste away. And she's on Instagram)
The author is an American with a degree in literary studies. He has written an absolutely massive chronological history of computer games (mostly focused on adventures and other story-driven gaming, but not exclusively).

This piece about Adams is part of that timeline. Over the past 13 years he’s covered 1971 to 1998:

https://www.filfre.net/sitemap/

It’s not unfair to say that his pieces could use some editing. But he writes them every week, like clockwork, for decades now. As a long-time reader, I find the Digital Antiquarian’s long-winded digressions to be cozy and essential to why I keep coming back. It’s a bit like sitting down with a friend regularly.
why would Microsoft be required to test some 3rd party software? Maybe I mis-understood.
I'm Giving Away My 3D-Printing Business [video]
I agree with you, and kind of even agree that crowdstrike may not directly be at fault. But my point is that this competency is bled out of hospitals by external forces, primarily two: distant administration from companies that buy and manage multiple hospitals, often applying the same "efficiency" mindset that stripmines other industries in the name of profit, and the cloudtech sector, that is Google, Amazon, and Microsoft in particular, are very aggressive about selling their services along with demands that everything be given to their platforms, which often involves purging technicians who want on-site redundancy. This makes the systems more brittle, but also often causes people with the competency you're advocating to be fired
Given that they smash it up, no:-)

Apparently that was based on one at Wimborne - a copy of it, presumably.
You've had some good replies already, but just want to add my thoughts. Markdown to me is more about (a) the content (the actual words) and (b) the semantics (text emphasis, headings, etc, which communicate information about the importance or meaning of particular things).

Typesetting systems like Typst or LaTeX go beyond this. They're also about presentation, how precisely it is laid out, on mediums such as print or PDF. Is that something you need? If you care more about the content and its meaning, and are happy to have it rendered differently in different situations (a preview in Visual Studio Code, or passed through a markdown-to-html renderer, or viewed in Obsidian, etc), then Markdown might not just be fine, it may be preferable. But if you need to do things like print this on paper for mailing, email in a PDF, that sort of thing, then you'll want something more.
Dollar blue exchange is at 4400? I don’t see it.

Protests? Yeah the same people who didn’t protest once in 4 years while the whole country was peaking in poverty? Very trustworthy group to use as a measuring factor of the country’s health. That’s just the unions and groups that were getting money under the table getting scared of having to actually work like everyone else.

I don’t know if you’re aware but the average worker did not join these protests like they did for example in the protests that happened during 2001.

Let’s not forget the country we had in 2023. Milei did not cause all these things. The country was already going HARD in this direction.

The reason people voted Milei is up to each person and what you said in your last paragraphs leaves so much untold that I don’t even know where to begin. Just because he’s not a “K/Peron” president doesn’t group him with Macri. Macri was very weak in all his policies and politics. If you have a very large vector going in one direction, it takes another large vector at a substantial angle to change it. Macri did neither.

I gotta say though, my shitty neighborhood was never better than during the macri times… wasn’t the left with their big present and spending state supposed to use all that money on the people? I rather have Milei not spend it and have surplus and not have to print money all the time than get devaluation and still not see any progress.

My guess is that your source of information speaks wonders of Lula and is very anti Milei, because all the things you quoted don’t imply what you think they imply. There are at least 70 years of baggage behind all that.
>Honestly, it sounds like you want to gatekeep political discussion.

Seething about the politics of the country you left behind means you have gate kept yourself already.
The problem I think is that it would just take the form of regulatory capture. A few companies would be blessed, and the rest of us locked out. And we'd still have screwups like yesterday, but this time with Government Approval.

Already it's amazing how the media is presenting this like it's a natural disaster, instead of an entirely preventable display of incompetence... A business entity whose shares only dropped 10% after causing untold billions of damage to the economy.

Gives us all a bad name.
This wasn't nearly as bad as it could have been. What if the crash wasn't just a crash but resulted in data corruption? And what if it took longer to stop the rollout and deploy a fixed version? How long would it have taken to recover from this kind of incident? If affected machines didn't fix themselves after several reboots but needed to be actively reimaged?
There are some point where you should redefine what it mean to be an adversary. To be practically forced into a position that lead to this level of harm, by actors that you don't want to perceive, is something that you may want to analyze.

The purpose of a system is what it actually do, not what it claims to do but fails every time at that. Turning everything to vulnerable as fragile with some big strategic and global plan ahead makes you into a disposable asset, a sacrificial victim in some higher level chess game. And you can agree with that with your decisions.
The are OK with "push at anytime patches to the software" because that's a big part of what they are paying for. Rapid response to threats.
> engineering@a16z.com bounced my emails

No surprise there.
It’s not unreasonable to have microbial life floating around our atmosphere when you consider the fact that there is microbial life deep in the trenches of the ocean
That's odd. I was discussing this very idea with ChatGPT just last night, in the context of coming up with a way to deterministically go from <example code> to <english language description of example code> and back again, and then thought that English might be a good intermediate language when converting logic to a different programming language...

https://chatgpt.com/share/5d2245e8-135e-44f4-a204-401e625183...
Jokes aside, the level of discourse on HN is miles ahead places like Reddit and Twitter. HN's comment section is fantastic compared to them.
Warning: only click that link if you want to see a cyclist get hit by a train
You're making the mistake of assuming that the people running those companies care about anything other than their job security, and buying in solutions is the best way to have a ready-made scapegoat when things go wrong. The mantra "no-one ever got sacked for buying IBM" still holds, you can just substitute "Oracle", or "Microsoft", or now - apparently - "Crowdstrike".
> Interesting to see the NYT just catching up.

Maybe it has to do with some major incident that happened yesterday, and the fact they are a news company?
slurp + grim
Look at Linux. Getting Rust to work with the kernel is a long story of defining APIs, cleaning up the C-side API to make it tenable, coding test filesystems and whatnot to make sure it all works, and getting buy-in and maintenance for all of the above.

Doing the same with zero control over the non-Rust side of the kernel seems completely untenable.
A lot of their content is duplicated.

De-duping similar uploads of the same version of the same book would cut petabyte down quite a bit.
That assumes it's more likely than crowdstrike mass bricking all of these computers... this is the balance, it's not about possibility, it's about probability.
Oh, my comment must have been too critical of a16z as well. I see it has been moved from top to way bottom without a score change.

That's certainly one way to offer a response!
As a competing theory, since both Minio and Garage are open source, if it were my stack I'd patch them to log with the granularity one wished since in my mental model the system of record will always have more information than a simple HTTP proxy in front of them

Plus, in the spirit of open source, it's very likely that if one person has this need then others have this need, too, and thus the whole ecosystem grows versus everyone having one more point of failure in the HTTP traversal
Good analogy, from a personal perspective.

In this case, a person was yelling through the front door "Your door is wide open!" and no-one was listening.

For a 42B AUM company, at a time where running an IT operation means "use CrowdStrike so that you pass audits", leaving the front door open all night should get you fired, regardless of whether you blame hackers or not.
“Drivers are tested extensively through a process that involves many companies.”

That didn’t happen. Apparently, the policy for drivers does not apply to kernel modules… WTF!!
> Why a language and not a framework?

People said the same about web programming and yet we have e.g. Svelte.

Some things are just not so well expressed in a framework. Especially things that manipulate state in special ways.
Gavin also made a long blog 12 part series about that period

https://all-things-andy-gavin.com/2011/02/02/making-crash-ba...

I wonder how he works these days.
>Agreed, they should not be using Windows in the first place

Crowdstrike borked RHEL 1 month ago https://access.redhat.com/solutions/7068083
Literally the same situation, unbootable machines.

The reality is that shitty software broke everything. Why do we have to drag the OS into this?
Yeah even that guy who always told them they should always do canary deployments should stifle his "I toldja!" instinct and just keep quiet until everybody forgets.
Right. So the model is broken. You cannot both respond to threats in a timely manner and have Microsoft certify that the update is safe.

That leaves you either not responding quickly or responding with uncertified updates. In the past, we have examples of not responding quickly that took down large chunks of the internet (I don't remember the examples, but they were quite famous at the time). Now we have an example of a fast, uncertified update taking down a large chunk of the internet.

So, given that it can take down much of the internet no matter which we choose, now what do we do?
Looking at two countries in an actual long running war, both kept using cashless means, with actually increases in usage:

https://cbr.ru/eng/press/event/?id=18776

https://bank.gov.ua/en/news/all/drugiy-rik-povnomasshtabnoyi...
Previously, my product was going to use ipfs for a purpose similar to cdn. But its use threshold is high, and users must install a client or browser plug-in to use it.
Thanks for bringing that to my attention.

I still haven't seen an AI for a turn based strategy game. There's AlphaStar, but it wins via APM, not strategy.
Oh no CRIME! Thank goodness that something being a crime stops people from committing them.

Thank goodness the internet isn't an international operation filled with nation state level actors and questionable companies running data gathering operations from places they cannot be touched.

Always assume your data has been stolen by an assailant in a place that's only reachable by launching nukes at them. Also assume there is some competitor on the other side of the world now using your data against you.

Please stop treating data theft like Barney Fife level candy store theft. A huge portion of the time even if you know the name of the exact person who did it, there isn't going to be shit you can do about it.
TLDR: Refreshingly honest video from a maker who went full-time on a 3D printing side hustle, earning $20,000/year, but is now giving it up due to burnout and lack of scalability. He shares his journey from failed Etsy businesses to finding success with 3D printing, but ultimately realizing that the profit margin wasn't enough to justify the time and effort required. A must-watch for hobby startups considering the realities of running a business.
You're sorta describing TPUs, especially early ones: https://cloud.google.com/blog/products/ai-machine-learning/a...

That first generation also included the ability to apply a handful of fixed activation functions, but really that's about it. The array is bigger than 32x32, also.
They share the whole of the responsibility of it. "my antivirus was updating" is not an acceptable excuse for a service to be down.
Yes, the scripting is very nice. At first, I played around with Go templates to generate the Typst templates, since that is what I was used to doing with LaTeX. It was very nice to discover it allows you to use JSON with its scripting engine directly pretty easily.
Bomb in TSMC clean room. Almost any size. That takes out the AI market. 1% of GDP gone. However, it's less than linear; not many targets of such critical importance.

The ability to get the bomb in the right place is far more important than the quantity of explosives, as was demonstrated by the recent suicide sniper missing.

The IRA https://en.wikipedia.org/wiki/1993_Bishopsgate_bombing was estimated to cause more economic damage than all other IRA bombing put together. It's interesting that (apart from the first WTC bombing) American terrorists have stuck strictly to guns and not attempted car bombs.
FauxTRS
So they need to certify that the third party has the right processes in place, as opposed to certifying the binary output. Look up SOC 2.
> Already it's amazing how the media is presenting this like it's a natural disaster, instead of an entirely preventable display of incompetence

Amazing? Super predictable I'd say.

> Gives us all a bad name.

That is sadly true.
A simpler process is to automatically post process the image to “fix” the eyes. Similar techniques are used to address deformities with hands and other localized issues.
It's the equivalent of not writing about Boeing until the day a 737 MAX crashes right in front of your newpaper offices.
Even humans are not good at this. The US military has a test (DLAB) to figure out how good you are at taking in new information in regards to language -- to determine if it is worth teaching you new languages. Some humans are pretty good at this type of thing, but not all. Some humans can't even wrap their heads around algebra but will sell you a vacuum cleaner before you even realize you bought it.

The problem with LLMs is that there is one and it is always the same. Sure, you can get different ones and train your own, to a degree.
A long ago discussion, https://news.ycombinator.com/item?id=10256311
Xsel or Xcel is your friend (think pbcopy pbpaste)
Instead of using vacuum why not collect with with finger like extensions to use less power and better accuracy?

Also does anyone know a good programmable outdoor robot dog made in US?
Parent comment never suggested it was legal. They said it would be bad if this info was in their SalesForce and they leaked the key, which they did.
I am not saying there are no challenges. I am saying that CrowdStrike does not seem to have even tried to have a better process. Rust would be only a small part of the picture; just one more layer in the security posture (a small one at that, admittedly).
The "cyber agencies" focus on offence, because that's easy to score points with and appear to be doing something, whereas defence is a very boring job of securing a zillion outdated endpoints. Or trying to get profitable megacorps to do something less vulnerable and less profitable.
Yes .. better!
I remember working in random IT companies, back in the early nineties, where our "servers" were a collection of random desktop machines running Linux.

At the time I think we had one Sun E450, and 20-30 random desktop hosts. All headless, except for keyboards connected. We also had a bunch of phone lines and external modems, which were used to run UUCP jobs overnight, or transfer files other ways, to remote SCO Unixware hosts.

It was only later that I worked with "proper" servers, with niceties such as remote access, redundant power-supplies, and maybe even multiple hard drives (!)
https://pastebin.com/MeLTjuj1