skysight-inc/HackerNews huggingface dataset:
Seemingly pretty low. I work in a large org and getting to the point of a quick streamlined solution hinged on just a few people. Without those few, it would have been a 100% manual effort. Most didn’t even seem to know a good way to identify the issue at scale.

The solution didn’t bother with safe mode, it used a boot image that would search for the offending file on all the drives and deleted it, then rebooted back onto the normal boot drive.

With specialization, so few people know all the various pieces to be able to quickly solution something. Good generalists are often overlooked, but they are the saviors in these moments.
Oddly enough, there was an issue last month with CrowdStrike and RHEL 9 kernel where they were triggering a kernel panic when attempting to load a bpf program from their newer bpf sensor. One of the workarounds was to switch to their kernel driver mode.

This was obviously a bug in RHEL kernel because even if the bpf program was bunk it should not cause the kernel to panic. However, it's almost like CrowdStrike does zero testing of their software and looks at their end users as Test/QA.

https://access.redhat.com/solutions/7068083

> 4bb7ea946a37 bpf: fix precision backtracking instruction iteration
Everybody's Free (To Make Websites)
The center in the U.S. has shifted to the right since Clinton’s presidency. It was he who supported and enacted free trade agreements without labor or human rights conditions. He ended Glass-Steagal. Obama enacted the Heritage Foundation’s healthcare plan which used to go by the name of RomneyCare. Bush 2 is seen by many in the right as a RINO. Same for John McCain, Romney, and other prominent Republican politicians.

The theory you posit is not supported by the facts.
I could yes but when I added that page my site was as simple as it gets and it wasn’t worth the hassle to add a bunch of stuff for literally one table in a post out of almost 500 posts on the site.
> You search for domain names using the DNS system itself, via the command line and nslookup or dig. You only go to a registrar once you've identified a name that is not in the DNS, to see if you can buy it.

Why? There's WHOIS servers, that's how you know if a domain actually exists.
Everything is a conspiracy now eh?
How far removed from reality is Don McGowan to brag about using his position to threaten a random child and their family? Lawyers are wild man.
> Is Cuba a dictatorship? No.

Would you clarify what you mean by this? Does the first secretary of the Communist party no longer have de facto dictatorial power?
> Let’s first take a look at what the bootloader actually does. It manages 3 slots for operating system images, with each having around 500 KB reserved for it. Additionally, 2 redundant metadata structs are stored on different flash pages. During an update, one slot is overwritten, and then metadata is adjusted. We are resilient against power failures at any point, and as long as at least one image slot contains an operating system image, we can boot. [...]

> In our bootloader we can now enable a custom boot mode that ensures that if at least one image is bootable, it is booted, which will enable us to fix this problem remotely

"OneFileLinux: A 20MB Alpine metadistro that fits into the ESP" https://news.ycombinator.com/item?id=40915199 :

- eaut/efistub generates signed boot images containing kernels and initrd ramdisks in one file to ensure the verification of the entire initial boot process.

Are there already ways to fail to the next kernel+initrd for uboot, [ventoy, yumi, rufus], grub, systemd-boot, or efistub?
Kind of a side talent, but I’m currently (begrudgingly) working on a project with a Fortune 20 company that involves a complicated mess of PKI management, custom (read: non-standard) certificates, a variety of management/logging/debugging keys, and (critically) code signing. It’s taken me months of pulling teeth just to get details about the hierarchy and how the PKI is supposed to work from my own coworkers in a different department (who are in charge of the project), let alone from the client. I still have absolutely 0 idea how they perform code signing, how it’s validated, or how I can test that the non-standard certificates can validate this black-hole-box code signing process. So yeah, companies really don’t like sharing details about code signing.
pish! this isn't VM/SP! commodity OSes and hardware took over because customers didn't want to pay firms to staff people who grokked risk management. linux supplanted mature OSes because some dork implied even security bugs were shallow with all those billions of eyes. It's a weird world when MSFT does a security stand down in 2003 and in 2008 starts widening security holes because the new "secure" OS they wrote was a no-go for third parties who didn't want to pay $100 to hire someone who knew how to rub two primes together.

I miss my AS/400.

This might be a decent place to recount the experience I had when interviewing for office security architect in 2003. my background is mainframe VM system design and large system risk management modeling which I had been doing since the late 80s at IBM, DEC, then Digital Switch and Bell Canada. My resume was pretty decent at the time. I don't like Python and tell VP/Eng's they have a problem when they can't identify benefits from JIRA/SCRUM, so I don't get a lot of job offers these days. Just a crusty greybeard bitching...

But anyway... so I'm up in Redmond and I have a decent couple of interviews with people and then the 3rd most senior dev in all of MSFT comes in and asks "how's your QA skills?" and I start to answer about how QA and Safety/Security/Risk Management are different things. QA is about insuring the code does what it's supposed to, software security, et al is about making sure the code doesn't do what it's not supposed to and the philosophic sticky wicket you enter when trying to prove a negative (worth a google deep dive if you're unfamiliar.) Dude cuts me off and says "meh. security is stupid. in a month, Bill will end this stupid security stand down and we'll get back to writing code and I need to put you somewhere and I figured QA is the right place."

When I hear that MSFT has systems that expose inadequate risk management abstractions, I think of the culture that promoted that guy to his senior position... I'm sure he was a capable engineer, but the culture in Redmond discounts the business benefits of risk management (to the point they outsource critical system infrastructure to third parties) because senior engineers don't want to be bothered to learn new tricks.

Culture eats strategy for breakfast, and MSFT has been fed on a cultural diet of junk food for almost half a century. At least from the perspective of doing business in the modern world.
https://news.ycombinator.com/item?id=40985687
Great to see this article, I totally agreed with the view that rejecting any invalid case by designing the right data structure.

Unfortunately, it is hard to achieve it in practice and people even don't realize this, JSON Object is a good example, Human are incline expecting the duplicated key is not allowed in JSON, but it happens.

For this goal, I think the Protobuf is good way to eliminate the possible invalid data for data transportation.
Thought show HN means being open for feedback not "please whorship my product"

here you go:
your product is the best. You will come out on top in this very crowded market and your stocks will be worth millions.

I dont see it as rude to take my time and explain where their product is lacking. I am a power user of these kind of tools and tried many.
> There have been no remotely exploitable zero days in that stack for what, two decades now?

Incredible how easy it was to prove this wrong in less than 5 minutes.

https://www.cvedetails.com/cve/CVE-2023-38408/
> And this is despite billions of welfare money given for housing, free education, free access to health, etc.

This assumes those things help one integrate. The Unites States notably doesn't have these things to the same degree that countries in Europe do. This means immigrants in America need to work. And work is a strong forcing function for socialization and integration.

> You mentioned Gypsies, well I read scholarly work stating that they were warmly welcomed 4 centuries ago in the towns of my region, until people discovered a tendency of their purses to disappear.

Do you have a citation for that?
Not fixed for me. It’s still the purple scroll bar which is completely unusable on Safari iOS.
Interesting. So in Italy you can’t refuse cash unless there are very specific conditions.

Putting up a sign that says no cash ain’t gonna cut it.

Plus here the opposite is often true: not being able to pay with card because the reader is “broken” so that you’re forced to use cash, they don’t have to pay the transaction fee and more often than not they can also don’t make you a receipt.
Type 10, the most advanced MBT ever put into production in Japan
Didn't at all expect this to be downvoted, but point taken (pun intended)
As always, a relevant xkcd[1]. I would not be surprised if the answer to “how many machines can be compromised in 24 hours by threatening one person” was less than 8 figures. If you can find the right person, probably 9+.

[1] https://xkcd.com/2347/
(2008)

Some previous discussion:

2022:
https://news.ycombinator.com/item?id=30677834

2020:
https://news.ycombinator.com/item?id=23321955
Dangerous sandwiches delayed hardware installation
The authors of this paper are just another instance of the AI hype being used by people who have no connection to it, to attract some kind of attention.

"Here is what we think about this current hot topic; please read our stuff and cite generously ..."

> Language completeness assumes that a distinct and complete thing such as `a natural language' exists, the essential characteristics of which can be effectively and comprehensively modelled by an LLM

Replace "LLM" by "linguistics". Same thing.

> The assumption of data completeness relies on the belief that a language can be quantified and wholly captured by data.

That's all that a baby has, who becomes a native speaker of their surrounding language. Language acquisition does not imply totality of data. Not every native speaker recognizes exactly the same vocabulary and exactly the same set of grammar rules.
kernel driver could have data check on the channel file and fail gracefully/ignore wrong file instead of BSOD.

this code is executed only once during the driver initialization, so shouldn't be much overhead, but will greatly improve reliability against broken channel file
the difference is you can get most of the functionality you want without deleting system32, but if you want the super secure version of NT, you have to let idiots push untested code to your box.

linux, Solaris, BSD and macOS aren't without their flaws, but MSFT could have done a much better job with system design.
I will take a look, thank you!
Apologies for the shameless plug but do checkout https://geobase.app We built it with such use cases in mind and solves the scaling issues with geo data driven apps. We are in private beta but happy to give you early access if you hit us up.

We were also recently featured on the motherduck blog https://motherduck.com/blog/pushing-geo-boundaries-with-moth...
My 20 Most Used Command Line Commands (On My MacBook)
Jews were not allowed to own land or engage in trades. What they did have was an ethnic/family presence across national boundaries, which placed a few of them in a unique position to negotiate on behalf of their lords and kings. This led to a condition where a small fraction of Jews became essential to European diplomacy, and subsequently became movers of money. That plus the Christian ban on moneylending and the need for liquidity nonetheless.

Those wealthy "court Jews" largely converted to Christianity and assimilated, leaving their poorer brethren to die in pogroms and the Holocaust, while serving as the proof of blame for Jewish conspiracy at the same time.
As a child who has been bullied by adults for legal behavior this hit home with me. Glad there are more people coming forward.
99.9% of lawyers give the other 0.1% of us a bad name.
Indeed this is an excellent quality site. If you want deep dives into macOS and M-series CPU technical details, there are few other sites as good.
To be fair, the xd backdoor wasn’t immediately obvious https://www.wired.com/story/xz-backdoor-everything-you-need-...
You do remember Solarwinds right? This is an obvious high value target, so it is reasonable to entertain malicious causes.

Given the number of systems infected, if you could push code that rebooted every client into a compromised state you’d still have run of some % of the lot until it was halted. That time window could be invaluable.

Now, imagine if you screw up the code and just boot loop everything.

I’d say business wise it’s better for crowd strike to let people think it’s an own-goal.

The truth may be mundane but a hack is as reasonable a theory as “oops we pushed boot loop code to world+dog”.
> When it’s somebody complaining about workplace issues, I don’t really necessarily want to know who it is,
> unless what they’re complaining about is, ‘My boss is sexually harassing me.’ Then I want to know who it is
> because I want to know who their boss is. I’m investigating, not to try to out the person, but to try t
> assess the truth of what they’re saying.

> I might have a talk with David. I might say, ‘Listen, I’ve figured out it was you. Do I not seem approachable?
> Why are you and I not having a conversation about this?’ Obviously, my job is to protect the organization, but
> ‘protect the organization’ takes on different meanings to different people. To me, ‘protect the organization’
> has always meant: protect your people from bad things.

Good grief - do not fall for this shit.

The reason someone like him tries to figure out the identity of a person claiming sexual harassment is estimating and minimizing the liability. How credible are you (to the public, press, investigators, a potential jury), how big a platform do you have, etc. An unlikable, not-stereotypically-attractive loner who has no little social media connections? Not a threat. A person who has a thousand followers, is likable/attractive, etc? Big threat.

The only reason they care about the identity of the harasser is to figure out how big a deal this might be. Manager of some QA testing group? Not a problem. C-suite or Vice President, etc? Big problem, that both legal and PR will be quickly roped in on.

Just like with HR, nobody that works for your employer ever has your best interests even remotely on their priority list beyond getting you to trust them so they can pump you for as much information as possible to sabotage your claims by doing things like creating alibis, destroying evidence, and searching out reasons to accuse you of being a poorly performing / combative employee who is simply a malcontent.

If you've been or are being sexually harassed, your first stop should be an attorney (and in case it's obvious, not one you find via your company's EAP.)
I don't necessarily think that's true anymore. YouTube comments are important to the algorithm so creators are more and more active in the comment section, and the comments in general have been a lot more alive and often add a lot of context or info for some type of videos. YouTube has also started giving the comments a lot more visibility in the layout (more than say, the video description). But you're probably right w.r.t platforms like TVs.

Before this wave of insane bot spam, the comments had started to be so much better than what they used to be (low effort, boomer spam). In fact I think they were much better than the absolute cringy mess that comments on dedicated forums like Reddit turned into
it is though being the little guy.

But that is not my problem. I am just a consumer. I will use what ever is the best and pragmatic solution to my problem.

I even logged in to phind after a while because it is nice to have access to my old chats.

But you need to provide value first before I bother with this.

Why do I need to explain these basic things?

pls dont get defensive when you get free feedback. not a good sign
Not one that literally fucks my users up the ass!
at that point your just a rounding error
this is the most holier-than-thou (literally and figuratively) broad strokes opinion phrased as if it's a nuanced opinion about cultures.

i think it's self-evident from history and society that "importing" "barbarism" into "society"* is how we even started doing things like not unashamedly harming marginalized groups in the West. if i'm not mistaken most christian sects, whether in europe or america have had various levels of being okay with ostracizing and harming queer and trans people until very recent times. your comment smacks incredibly of thinking only western white civilizations are capable of overcoming "barbarism" and evolving into a more just society for people over time, especially using the common scapegoat of other cultures taking longer to catch up on LGBT rights.

fascinating that other people's systems of being is "barbarism" and yours is "society". and thus, it's reasonable that most of the world thinks american society was barbaric with their deep rooted slavery and racism, and european society barbaric with their violent colonial extractionism defining much of their past and present.
What if some highly intelligent people oppose American values and abuse the first amendment by spreading hatred and neo-Nazi propaganda in the town square?

It’s a rhetorical question — this happens already and we handle it the way we’d handle your rhetorical question: shake our heads at the misguided worm brains, ignore it or confront them directly. But either way it’s not a threat to American civil liberties, the Bill of Rights is more robust than that.
I mean this isn't some bizarre edge case bug, its a file full of nulls and a broken parser that blindly imported it.

Its negligence.
Such an invalid access of a very small address probably does result from a nullptr error:

struct BigObject {
char stuff[0x9c]; // random fields
int field;
}
BigObject* object = nullptr;
printf("%d", object->field);

That will result in "Attempt to read from address 0x9c". Just because it's not trying to read from literal address 0x0 doesn't mean it's not nullptr error.
Garrity's All the Math You Missed book, mentioned elsewhere in the comments, draws a nice map of subjects, along with little introductions and book recommendations. The map is good for continuous mathematics, but IMHO fails to consider logic and type theory, which is a bit odd given the separate chapter for category theory. It also does not do proper justice to computation and clumps everything together under the label "algorithms".

Good alternatives are The Princeton Companion to Mathematics by Gowers and Mathematics: Its content, Methods and Meaning by Alekxandrov, Kolmogorov, et al. Those present much more detailed maps so YMMV.
The whole "oh I have totally pure motives for wanting to identify someone saying they're being sexually harassed" angle was a little more concerning. It's wild so many comments thusfar are about that and not about the blatant bullshit around why he hunts down sexual harassment victims.
Internet infra won't be even close to a concern in the big one. I mean sure you've got some 911 infra and first responder stuff tied into that, and they have some backup radios, towers, and generators.

But it won't matter when there's a life-threatening situation on every block. Unchecked fires with no water lines to put them out. Trains & trucks unable to get in or out with provisions, overwhelmed hospitals, zero police presence. You'll have to drive from downtown Portland to Salem in order to cross the Willamette, and I have no idea what'll happen to the I-5 corridor.

PNW has been proactive in enforcing its code on big buildings/new construction, and kudos to them. But if you live in the area, be prepared to leave and not come back for a long time.

Source: father is a lifelong building inspector in one of the larger PNW cities. They've been wargaming this stuff for decades, and it ain't pretty even in best-case scenarios.
Sure. I speak C++ ;) You can do this in C++ but I think it's generally more crash prone than Go. Based on personal experience of ~20 years of C++ and ~10 of Go I've debugged many a core dump in C++ and I think zero in Go. You can restrict yourself to the somewhat safer parts of C++ for sure.
I think the type signatures are really helpful in this regard. It makes it really easy to tell what’s happening and if I have to worry about mutations.

Writing the signatures can become a pain because you have to think everything through up front, but we spend more time reading code than writing it.
To what degree does it make one vulnerable to social hacking? Cult recruitment tactics may work best on "narrative" people, for example.
Did they tell the google maps team?

If I open the mobile app, click a pin, and press share, I get a maps.app.goo.gl link

Will this break every map ever shared?
Why You Should Not Use Tcl (1994)
Many small harms to our quality of life, in other words.
Writing your own simple programs and debugging/disassembling them is a solid option. Windbg and Ida are good tools to start with. Reading a disassembly is a lot easier than coding in assembly, and once you know what things like function calls and switch statements, etc. look like you can get a feel for what the original program was doing.
See also Ousterhout's reply:

https://groups.google.com/g/comp.lang.tcl/c/7JXGt-Uxqag/m/vQ...
I think there's good reason why Lisp's `apply` and `eval` functions are the "Maxwell Equations" of CS. Going back to the Lambda Calculus, `apply` is the β-reduction rule, which is the basis for everything, and `eval` is how you cross the data-code boundary. Between the two you get a system that can 1.) perform any computable function, and 2.) easily work with its own structure.
EUV lithography might as well have been invented at Hogwarts as far as I'm concerned.
Average Chinese national now eats more protein than an American
X.com refuses to open with Firefox strict tracking protection enabled
and agent orange, and destroy literally everything before we tail it back to our own country, not before we tell our vets to “suck it up” and bootstrap their PTSD due to exposure of aforementioned war crimes.
What’s the reference?
Astro is awesome. It’s easy enough to get started with a template for a static site and flexible enough to build dynamic web apps.

My static personal site is Astro hosted on cloudflare pages https://github.com/ShaunLawrie/shaunlawrie.com

And I used their documentation template https://starlight.astro.build/ for my autogenerated docs on https://pwshspectreconsole.com/

I love having the ability to focus on the content and never having any blockers if I want to do something weird like embed a prebuilt react component for some edge cases.
If you have a page mapped at address 0, accessing address 0 is valid.
It’s a cliche mathematician debate. I don’t disagree. In any case, if you aren’t able to do proofs, you don’t do math.
And George RR Martin. :(

I am truly not mad at either of those guys. At the end of the day they gotta live their lives the way they see fit. But it is a real bummer that we are unlikely to see the end of either series. And unfortunately for up-and-coming authors, it makes me very leery of picking up any unfinished series again.
I’ve seen places where failed releases are just “part of normal engineering.” Because no one is perfect, they say.
VAC is not kernel level. Valorant’s Vanguard is kernel level - it runs at all times and if you exit it out, you must reboot your computer to play Valorant
How would you accomplish this without every website asking for phone number and photo ID?