skysight-inc/HackerNews huggingface dataset:
> If you install unvetted packages in your airline control system, bank, or supermarket, the kind of systems that we're talking about here, you have much bigger problems to worry about.

Surely we can agree that if it's a vector with an above 0% chance of it being exploited, then any methods for mitigating that are a good thing. Quite possibly even multiple overlaid methods for addressing the same risks. Defense in depth and all, the same reason why many run a WAF in front of their applications even though someone could just say: "Just have apps that are always up to date with no known CVEs".

> Or indeed any of these. Highly privileged users piping shell scripts from untrusted sources is out of scope for any antivirus system, on any platform.

You don't even have to be highly privileged to steam information, e.g. an "app" for running some web service could still serve to exfiltrate data. As others have mentioned, maybe this is not what AV software has been historically known for, but definitely there are pieces of software that attempt to mitigate some of the risks like this.

I'd rather have every binary or piece of executable code be scanned against a frequently updated database of bad stuff, or use heuristics to figure out what is talking with what, or have other sane defaults like preventing execution of untrusted code or to limit what can talk to what networks, not all of which is always trivial to configure in the OSes directly (even though often possible).

I won't pretend that AV software is necessarily the right place for this kind of functionality, but I also won't pretend that it couldn't be an added benefit to the security of a system, while also presenting different risks and shortcomings (threat vector in of itself or something that impacts system stability at worst, or just a hog on the resources and performance in most cases).

Use separate VMs, use secret management solutions, use separate networks, use principle of least privilege, make use of good system architecture, have good OS configuration, use WAFs, use AV software, use scanning software, use dependency management alerting software, use static code analysis, use whatever you need to mitigate the risk of waking up and realizing that there's been a breach and that your systems are no longer your own.

Even all of that might not be enough (and sometimes will actually make things worse), but you can at least try.
I'm in the UK and would prefer to buy non-Chorleywood bread, but my local corner shops only sell what looks like versions of the regular supermarket stuff, and the only genuinely artisan bakery is a distance away. Our local (medium sized) supermarket has the "bakery" section of unwrapped and traditional looking bread - but they are "baked in store", and I've no idea of the process that's used to produce the incoming dough. I suspect no real baker is involved.
Indeed. Its worse really, it means there was a bug lurking in their product that was waiting for a badly formatted file to surface it.
Given how widespread the problem is it also means they are pushing these files out without basic testing.

edit: It will be very interesting to see how CrowdStrike wriggle out of the obvious conclusion that their company no longer deserves to exist after a f*k up like this.
"The metric becomes the measure", i.e. Goodhart's Law.

https://en.wikipedia.org/wiki/Goodhart%27s_law
In Silicon Valley, I assume?
Linux needs more beautiful apps with attention to UX - the same kind of care that developers of macOS apps put into their apps. That's why even when I'm building an app for Linux[1] I start by trying to make the best macOS app first.

[1] https://www.get-plume.com

EDIT: Spelling errors.
Yep, at least Part of it is down
000 was never down, and most supermarkets and servos were still up. It was bad, but ABC appear to not have the internal capacity to validate all reports.
Yeah the preferred approach would be to run a Prolog engine as a service and access it via usual JSON-over-HTTP/REST protocols. Has the benefit of being able to adapt and scale/provision the specific Prolog engine load as well. For smaller projects I guess you could use Minikanren which is specifically for embedding as I understand it, but even standard job shop scheduling and factory/office resource planning tasks would be better served with a Prolog (micro-/whatever) service already IMO.
> Now after the election, that is another story altogether.

Agree. First half of 2025 could be pretty spectacular (if/when we get through 2024).

I suspect there might be some pretty radical plans for US debt monetisation being drawn up, to be implemented early in the new presidential term.
That's shares number of shares times current share price, not money. If he starts selling those shares they won't all sell at that price.
Obviously you've never been working at enterprise purchasing department and participating in business meetings with Microsoft sales people.
Aiko, mentioned elsewhere, includes a local copy of the OpenAI Whisper model: https://apps.apple.com/app/aiko/id1672085276
yes, as any competent classic old fart network-wide IPS/IDS

endpoint security is a great utopia to strive for, but to get there we ought to starts with having secure by default endpoints.
Yeah, the CrowdStrike issue took down a lot of the Nasdaq's IT systems, ironically
The term already exists, but the "hell" is mostly silent (even in writing).
For all this spying the quality of products and services is going down, so what's the point?
Yeah I'm currently running Calibre, which works fine for my needs, but my gripe is that it takes up around 1gb of space on my tiny old system.

Can someone please tell me the diskspace requirement for Foliate?
This is my opinion, hopefully this product helps fill that gap a little :)
Could you expand why? It's not immediately obvious why would that be, my understanding is that the general consensus around here is that the JVM is a superb piece of tech with a bad rap due to java the language.
Carbon Black, running in DO NOT LET UNTRUSTED EXECUTABLES RUN mode,
would not let you run binaries that curl | sh just grabbed unless they were allow-listed.
How do you feel about the built-in Apple Books?
"I don't fit in a generalisation therefore that generalisation is not true". At the same time, not sure we have the data to back up the original argument. Personal anecdata? People around do expect to find everything all year round, and they get mad if they don't.
This is just premixed and shaped dough brought into stores and then cooked there surely. There's no guy at the back of your co-op carefully nurturing his bread-mother.
Actually really scary to see/read the comments on. Like Die Hard's 'Fire Sail"
To their credit, the stakeholder that asked for my head personally came to me and apologised once they realised that entire airports have been shut down worldwide. But yeah, not a Friday/funday hahaha
It's not hard to find good bread in the South of UK but you generally are not going to get it in a supermarket and need to know your local area. I live within walking distance of at least 2 independent bakeries and 2 chains[1] that make good bread and for the last 30 years of living in the UK the only times I have had difficulty getting decent bread have been in the North or in Wales. For calibration I am an absolute bread snob having baked my own sourdough for years (although I haven't for a while). I even did a Dan Lepard[3] masterclass once.

For flour the best places to get good flour are either online[2] or in expensive healthfood shops. The one near me that does good flour is where all the local yoga mums buy their candles and whatnot but they do great bacheldre spelt flour for example. But Dove's Farm flour for example is generally pretty good and easy to come by even in supermarkets if you go to a waitrose for example.

[1] Gails and Ole and Steen. If you're a serious snob you can criticise both because the dough isn't made on the premises, it's made centrally and then just baked in the shop but it's still good bread.

[2] https://www.bakerybits.co.uk for example is great.

[3] https://www.danlepard.com/ He's one of the top sourdough bakers in the world, to the extent that Michellin starred-restaurants have been known to get him in as a consultant to come up with the breads to go alongside the rest of their menus.
As an aside - Europes largest producer of bananas is... Iceland.
Interesting that the interest rate increase managed to suck out so much money already.
> the risk of failing the compliance checkbox it satisfies is paramount.

i'm curios as to what compliance is there to be satisfied to necessitate such a hardcore measure?
I'm pretty sure crowdstrike autoupdates, with 0 option to disable or manually rollout updates. Even worse people running N-1 and N-2 channels also seem to have been impacted by this.
Of course, disabling those auto updates will have you fail the external security audit and now your security team needs to fight with the rest of the leadership in the company explaining why you're generating needless delays, costs against the "state of the art in security industry" and why your security guys are smarter than the people who have the power to approve or deny your security certification.
It's driven by a lot of things. Part of it is driven by rising cyber liability insurance rates, for one. A lot of organizations would rather not pay for CrowdStrike, but the premiums for not having an "EDR/XDR/NGAV" solution can be astoundingly high at-scale.

Fundamentally there's a lot of factors in this ecosystem. It's really wild how incentives that seem unrelated end up with crazy "security" products or practices deployed.
A more reasonable claim would be that microsoft should have a way to allow virus-scanners to run without needing to be able to crash the kernel.

That isn't an easy thing to do, but it should be possible.
How is your lack of a stable HDMI signal relevant to that the world's airlines and supermarkets and banks probably shouldn't run Windows with third-party antivirus software bolted on? That is a platform originally intended for office style typewriter emulation and games.

Every engineering-first or Internet-native company that could choose chose Linux and for simple reasons. Anything not Linux in The Cloud is a rounding error. Most of the world's mobile phones is Linux. And most cloud-first desktops too. They don't seem to be particularly more troubled with HDMI signal quality or other display issues than other devices.
Unlike Windows, there is at least the option to use curated software distributions such as Debian or RH that won't apply random stuff from upstream repositories.
We do that. CS literally entirely pushed this over our staging system and straight into production.
>CrowdStrike runs on Linux as well. _This time_ they only crashed Windows devices, but there's no guarantee that switching to Linux would prevent any of it.

In fact there was a recent CrowdStrike-related crash in RHEL:

https://old.reddit.com/r/crowdstrike/comments/1cluxzz/crowds...

https://access.redhat.com/solutions/7068083
And? People and institutions constantly make bad decisions for which there are reasonable alternatives, and that's assuming that the incentives at play for decision makers are aligned with what we would want them to be, which is often not the case. Not that that ends up mattering much except as an explanatory device, because people and institutions constantly pursue bad ideas even seen in terms of their own interests.
Depends on what you mean by enough. It should be more than enough to catch issues like this one specifically.

If they can't even manage that they'll fail at your approach as well.
Both. No testing is going to catch everything. And if it only hits 1 computer in 100 then your local testing will probably miss it
Global cyber outage grounds flights and disrupts businesses
It's somewhat confusing since there are a lot of things based on the Arabic / Persian word arak (arak, raki, rakı, rakija, etc.) but they're not all that closely related drinks.

"Rakija" would usually be translated as "fruit brandy" (but also overlaps with grappa, and then there are Croatian varieties which throw a lot of herbs and flowers in there) whereas arak, rakı and friends are most in the category of pasties, ouzo and sambuca in their flavoring. Confusingly, the Cretan raki is grappa.

The other confusing thing is that most of these words (schnapps, vodka, arak, rakija) are generic words for distillates, not indicative of a style. Vodka can be made of almost anything, but in contrast to other styles, its heavy filtering and purification (basically leaving not much but ethanol and water) is what makes it "vodka", and where I'm skeptical that the Moldovan booze meets that description.
So since I do mission critical healthcare I do run into this concept. But it's not as unresolvable as you portray. Consider for example HIPAA "break the glass" requirement. It says that whatever else you implement in terms of security you must implement a bypass that can be activated by routinely non-authorised staff to access health information if someone's life is in danger.

Similarly, when I questioned, "why can't users turn off ZScaler in an emergency" we were told that it wouldn't be compliant. But it's completely implementable at a technical level (Zscaler even supports this). You give users a code to use in an emergency and they can activate it and it will be logged and reviewed after use. But the org is too scared of compliance failure to let users do it.
Agreed, I think the statement should be "supermarkets want to sell us products all year round".
>Our results provide the most extensive evidence yet, that noisy quantum circuits without error correction can be efficiently classically simulated. In the long-term, this emphasizes the necessity of quantum error correction for achieving a scalable quantum advantage over classical computation.
My point stands then. If you're applying kernel grade patches on machines which you knowingly cannot disable or test, that's just simple negligence.
This never would have happened if all these orgs used a blockchain.

/sarcasm

/but is it really?
I had a rugged android phone from Blackview that was deemed to survive terrible stuff...I managed to drop it into the ocean.

Bought another one for my significant other after changing the screen of her samsung smartphone 3 times. She has used it for more than a year, it slipped from her jacket once from my motorbike. Someone found it 1h later in the middle of a roundabout face down with tire marks on the case. He saw it only because I was calling it and it has some notification lights at the back. Not a single scratch on the screen! Her only complaints is the quality of the photos taken with the camera.

I wish they were supported by alternative roms like lineageos or /e/os.
I guess that people developing critical infrastructure now may consider developing for two operating systems, of which you can roll over if needed.

Who am i kidding, of course they won't. Eggs will always be in a single basket.
> Crowdstrike does have Mac/Linux "endpoints" also (IIRC) but I'm unsure if they're affected as well.

The problem seems to be in a device driver installed by Crowdstrike - so I'm guessing whatever the bug is, it's specific. to their Windows product.
On Linux, I prefer to use MuPDF for just opening any epub file.

That was originally a PDF reader, but it has been working for some time also with epub files.

It renders the pages not only very fast, but also better than any other epub reader that I have tried (all the others seem to make worse choices about the relative sizes of various page elements).
Because the suppliers of IT systems (eg Microsoft, Crowdstrike) do not agree that they can be used for life-critical purposes

If someone is injured or dies because the hospital has inadequate backup processes in the event of a Windows outage, some or maybe all liability for negligence falls on those who designed the hospital that way, not the IT supplier who didn't agree to it.
this "kernel level = invasive" paranoia that's been going on lately is complete FUD at its core and screams tech illiteracy

no software vendor needs to or wants to write a driver to spy on you or steal your data when they can do all of that with user-level permissions without triggering any AV.

3rd party drivers are completely fine, and its normal that advanced peripherals like an Oculus uses them
Given how widespread the issue is, it seems that proper testing on Crowdstrike's part could have revealed this issue before rolling out the change globally.

It's also common to rollout changes regionally to prevent global impact.

To me it seems Crowdstrike does not have a very good release process.
This certainly helped and that's why he is producing drones instead of crossbows, but the secret sauce is dictator father in law.
Why did they have the technical means to do so?
I guess this article might need some updating soon:

https://www.crowdstrike.com/resources/reports/total-economic...
An AI that plays a fixed exploitative strategy will end up getting figured out relatively quickly and counter exploited pretty hard. This actually happens in real life sometimes when people attempt to deploy poker bots online.

Any exploitative AI also needs the ability to adjust in real time to a different exploitative strategy, which also needs to be not easily predictable, etc.
Most organisations seem to have a section of management that dissolve into batshit crazy teapots at the first hint of a crisis.
Good point. But the audit seems useless now. It's supposed to prevent the carelessness from causing... this thing that happened anyway.

Sure, maybe it prevented even more events like this from happening. But still.
> So we need to hold regulatory bodies accountable as well - when they frame regulation such that organisations are cornered into this they get to be part of the culpability here too.

No, we need to hold Architects accountable, and this is the core of the issue. Creating systems with single, outsourced responsibility, in the critical path.
I love the name! Really tells you what's going on ^^
Looking for tech cofounder/s – India
Hello,

Looking forward to connect with tech-folks who want to explore starting up in AI space - use cases in consumer/real estate/enterprise, few more sectors; willing to explore & brainstorm on few ideas

My workex lies in consulting, retail sales;
Mba, btech

Pls comment or dm if up
Is there a nice ebooks reader on android. The options I keep running to are rather very disappointing
No worries for us. https://pinggy.io/ is working like a charm :)
>LLMs in programming absolutely have their uses

Absolutely. LLMs let you make more programming mistakes faster than any other invention with the possible exceptions of handguns and Tequila.

To be fair, it is also really good at spewing out industrial levels of boilerplate. As we all know, 99% of the effort in coding is the writing of code and the more boilerplate in your code base the better. /s
Was involved in a "security mandated" mandatory rollout of Crowdstrike at my prior company.

This software was utter shit, and broke stuff all over the place. And installs itself as basically malware into critical paths everywhere. We objected to ever using it as a SPOF, but was overruled.

So yeah, not remotely surprised this happened.

Any kind of middleware/dynamic agent is highly suspect in my experience and to be avoided.
Botnet that checks if your bots in the botnet act like bad bots and can be considered bad too. Also checking if some of your files match AV signature. Also reading all your logs if you really want.
I think it depends what passport etc. you hold...
One dystopian take is the trolley problem, where the self-driving car in question uses smartphones to determine the identity of the people involved, to work out who is cheaper to kill.
Apparently, CS and ZScaler can apply updates on their own and thats by design, with 0day patches expected to be deployed the minute they are announced.
I'm talking about all sorts of software projects implemented using especially Python, Ruby, node.js etc.
> we'll all end up eating food that it is just nutritious enough to keep us from starving

That's not what the ongoing obesity epidemic shows.
"personal anecdata" or not, what he is saying is market demand. If you offer cavendish that taste like mashed potatoes, you won't see that persons money. Mine neither. Fact.
It reminded me (in a distant way) of the poem program “Now Press Return” by Roger McGough, on the BBC micro Welcome disc. That program also started by prompting you for your name. What a funny coincidence.
Because our security guys are fuckwits.

(I am operations management and fought against this product and approach for months)
Well played, I've glossed over the significance of that sentence!
It's not just ASML that is involved in R&D for new chip nodes. And ASML itself has a large part of its operations in the US.
So it would still hold 80% of yesterdays value? That doesn't feel right
Computer systems have gone down before. It's only when people actually die, rather than merely be inconvenienced, that change happens.
What are you supposed to say if you read a statement that includes you in a group you don't belong? That's why it's important to be more precise instead of saying "customers" in general.
They did around 8:30 CEST (6:30 GTM) as I understand it. Some of our servers managed to unbork themselves after a number of boot loops, but not all.
And the response for the curious: Logic programming is underrated (also 2013): https://news.ycombinator.com/item?id=5846185
The obvious follow up question: are there methods in use to bait such models into suboptimal play and then switch play style to exploit that?
KOreader is quite nice after some setup.
I mean, "GitHub" itself is the same problem, as is their libgit2 library, and that whole morass is now also owned by Microsoft, who probably feels like they deserve it.
Windows being clown solution? Out of touch with reality is huge here
"The world will look up and shout, "Save us!" and I'll whisper "No..." -- Rorschach
A related tool, except for monitoring I/O, is Progress [1].

Imagine that behind the scenes it does something like lsof every second (-m flag) and tracks the progress of any file open by the specified process(es) (-c or -a flags). Works great for copying and downloading, doesn't work for rewriting in-place.

This reminds me that I wanted to modify my GNU Screen hardstatus to call it.

[1] https://github.com/Xfennec/progress
I recall a pattern they used to use, probably illegal, when paying for a flight quoted in a foreign currency. Ryanair would "helpfully" offer for you to pay in your own currency with their awful exchange rate, with the option to instead pay in the advertised foreign currency (thus making use of your credit card's exchange rate - typically the market rate) on a pop-up only visible if you click the tiny "more information" link made to look like terms and conditions. The opt-out was not even on the same page, invisible to anyone but those most alert to these tricks. That probably netted them a good 10% extra margin on 95% of sales through deception. Disgraceful behaviour.
Maybe humbles all the other surviving companies? We can only dream
For any remote workers - send laptop to HQ and get it back a few days/weeks later. IT Support depts are going to be overwhelmed.