skysight-inc/HackerNews huggingface dataset:
Here’s Gpt4o:

The thread on Hacker News revolves around a significant incident where a CrowdStrike update led to widespread issues, including Windows blue screens and boot loops. This event affected various industries, including facilities where heavy machinery like lifts and cranes depend on Windows-operated systems.

1. *Incident Overview*: The CrowdStrike update caused critical system failures, leading to operational disruptions across multiple sectors. Users reported being unable to operate essential equipment, disarm alarms, or use communication tools, which brought businesses to a standstill.

2. *Root Cause Analysis*: The primary issue stemmed from an update pushed by CrowdStrike that conflicted with existing systems, particularly those running on Windows. This led to blue screens and boot loops, effectively rendering systems inoperable. The reliance on Windows for industrial control systems (HMI - Human-Machine Interface) exacerbated the impact.

3. *Quality Assurance and Deployment*: There was significant discussion on how such a critical update passed QA. It's suggested that the widespread deployment of uniform security policies without tailored considerations for different system requirements contributed to the problem. In some cases, security software was installed on systems where it might not have been necessary, driven by compliance needs and centralized IT policies.

4. *Implications and Lessons*: The incident highlights the vulnerabilities of interconnected systems and the challenges in managing updates and security across diverse operational environments. It underscores the need for robust QA processes and the potential risks of over-centralized security policies.

For more detailed discussions and perspectives, you can review the full thread [here](https://news.ycombinator.com/item?id=41002195).
Maybe an increasing fixation on individualism is a sort of psychological rebellion against feeling like a disposable part of society. Wanting to feel like more than a worker drone making a billionaire even richer. If you can’t afford a family, having a legacy might feel unattainable.
I basically agree with most of what you've said here, but I'm not talking about humans in general, I'm talking about epistemic authorities. As I said, I think the intuition that leads people to the conclusion that animals think and feel is natural for most people, and I also think there was an era where scientific institutions by and large took the position that because intuition isn't rigorous and explainable, anything we have intuitively come to believe must be wrong. This contrarian bias shows up in more places than just our beliefs about non-human intelligence, too
Oh I get how it happened just fine, man (and thanks for the context for future readers, it's helpful). I think think there are way too many keywords to change context but the LLM of course did not do that. Sigh.
Hotels have difficulty with paper and pen bookings when their computers are down. You expect a modern hospital to function in those circumstances?
Real-Time Hair Rendering with Hair Meshes
Sure there is no perfect solution here.
I guess it’s a good idea to only pentest companies that do have a bug bounty program and an expressed interest in you pentesting.

While I enjoyed the article that GP referenced and agreed with most thing I thought the “hacking bad” take was a bit off.
A brief interview with Tcl creator John Ousterhout (2023)
Have you ever worked a job that requires high degree of physical world logistics? In times where the primary coordination mechanism is down, any action becomes much slower to implement and often at a direct cost to implementing other actions.

With regard to this case, I don't know any specifics, but I can imagine tools require digital calibration, inventories not tracked outside digital systems, certain meds behind digital access control, and emergency response striained to the point where complicated non emergency procedures would be more risk than benefit.
> it was in their docs. So not blaming them. We glossed over it.

You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.
Ah, NetWare! Those were the days...though my memories are mostly of the prior (286) version.

After you got it working right, NetWare was rock-solid. Though if you weren't seriously experienced with NetWare, the "got it working right" could be difficult to distinguish from "went through Hell".

But once MS's OS's grew up enough to cope with running a serious fileserver, NetWare was doomed. Didn't matter that MS OS's were pretty mediocre. Their business strategy was good and ruthless, they had vastly more money, NetWare was a lone-niche product, and Novell wasn't very good at either business strategy, nor bigger-picture technical management.
Any malware capable of modifying files under C:\Windows\System32 has no need to fiddle with these files because to have that capability means it already got the keys to the kingdom and could wreck the system in a billion different ways.

See "It rather involved being on the other side of this airtight hatchway"
https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=10...
Presumably they would fix these computers first thing during the night from a backup? If not, is this really about CrowdStrike, and not about a hospital unable to keep their absolutely critical computers backed up and restored in a timely manner?

Again, I understand that restoring a complex net of servers is hard and takes time. But they surely have local hospital IT admins for these absolutely critical computers who are always available on site and can do it individually - it's not like there will be more than a hundred of these at a particular hospital? Hack it a little if you have to, disable the SSO etc - all that can be fixed later.
I once wrote a web page using Microsoft Word, and a few years later used Google Docs to edit it. I'm not going to blame anyone. Sometimes you use the tools that are at hand and call it a day.
It’s not clear to me that this case is actually life threatening. They have a regular procedure which even in the article they say they have wiggle room for timing.

If all of your computers go down your throughput is going to go down because other kinds of organization are going to be slower to do ad hoc… so you triage.
I can get stories like call centers, but I absolutely don't understand how life critical systems aren't air gapped and rigidly controlled.

Fail safe is the only acceptable failure mode for any critical system. Crowdstrike failed here, but they're not the only thing that can go wrong with computers. Where is the redundancy?
I got my CNA in about '92. Really helped land my first full time job.
That's a fair point! It definitely feels easier to make that mistake, and anything where context and discipline is required is a good candidate for making some horrifying blunders :)
>You aren't legally obligated to give them anything,

Acktchually, depending on where you live, you might be.
It's not the same. Figuring out a bagpack is open takes no effort. Finding a backdoor takes a lot of effort.
Will 'AIs' be collected as some people collect books or vintage electronics?
'They have one of the best first wave AI collections'.

'What's the provenance? This AI was first own by X and was later part of Y's collection, one the best institutional collections in Asia'.

Could these be plausible statements in a near future?

How about an AI 'zoo'? Thank you.
You’re the first person I’ve ever seen making these claims. Do you have anything to back them up?
This is a really great write up. Kudos for the obvious effort, both on the technical side and sharing the process with the rest of us.
If you haven't already seen, give the Netflix Show "Dark" a watch: https://www.imdb.com/title/tt5753856/
Let's Encrypt allows issuing wildcards which is what quite a number of folks use for self-hosted services
Neko!

https://en.wikipedia.org/wiki/Neko_%28software%29

The Wikipedia article is missing the implementation in the article. Too bad they don't pay bounties.

^ ^
0 -
*
-
There are fewer and fewer places for young people to meet. And bars aren't really an option for Americans who are under 21.
Does the last part of your comment imply that USA should just give up and accept all its adversaries already have backdoors and nothing can be done about it?
The Kaspersky issue could have been better handled by simply requiring divestment or by having requiring an US-appointed auditor to investigate produce reports to assuage such concerns; as was proposed in the case of Tiktok.
Learn some. Or hire someone who knows cybersecurity. One competent
person will do better than any other equally broken system.
Trying more than one email is not jumping through hoops when it's one of the worst possible vulnerabilities hitting all of their databases/platforms. Being a research means being an adult and having a basic level of responsibility. Just like being a gun owner, it's a powerful tool that needs to be treated with utmost respect.

A lot of pentesters are just kids who are angry at the world and the poor state of security, which I get, but it's not a huge barrier to try a bit more. He would have been rewarded if he did.
Interesting idea. I've just tried it with a couple of languages:

- TS with Vue: SFC are not really working (it's showing a style change as if the whole stylesheet were replaced with a mostly-identical stylesheet).

- Rust: It doesn't seem semantic at all. It's showing a lot of character-level insertions and deletions that seem worse than how git-diff or GitHub would break down the changes.

It doesn't seem ready yet for what I'd like to use it for.
Actually, no it wouldn't, as the licensire would likely be tied with providing the service on a paid basis to others. You could write or maintain any codebase you want. Once you start consuming it for an employer though, the licensure kicks in.

Paid/subsidized maintainers may be a different story though. But there absolutely should be some level of teeth and stake wieldable by a professional SWE to resist pushes to "just do the unethical/dangerous thing" by management.
That is fair enough, I guess it’s not a great analogy overall.

But IMHO it’s hard to feel to bad for someone (az16 in this case) who handles their arguably most valuable goods in such a manner and gets robbed.
This is true, but a very difficult thing to accept as a 16 year old. (At least, it was fairly difficult for me!)
Age profiles of countries are very different around the world. The median age in France is 41, in Sudan it's 18! Just think about what a median age of 18 means - half their population is even younger than that. So when you have Yellow Vests trying to shut down the government in Europe, those are a very different age group compared to Sudanese kids taking to the streets.

I think I can guess why the comment is controversial. Some may have taken it as an authoritarianism apology, which isn't the intention. It's rather a reminder that things are more complex than just rooting for what intuitively feels right, because the average Westerners has little understanding of how such countries work. Since my point is the average citizen doesn't even sufficiently understand, and surely you will agree you understand less about Bangladesh than a student who grew up there.

There are many such examples. Taking out Gaddafi has not proven to be positive for Libya. Sometimes the "old witch" is actually the lesser evil. I'm talking strictly about politics in terms of practical reality, not what we wish were true. Of course we all root for the people to win and then they live happily ever after.
OpenSUSE must needle them as a name, since that makes them the provider of "closed" SUSE. Had the open project been named "Community SUSE", I doubt it would have come to this. RedHat made their community project take a different name too, "Fedora". It makes a lot of sense.
From having seen the infusion process myself, I take it that it requires precision measurements over an extended period of time. This would seem unreasonable requirement for staff to perform.

Again, from what I've seen, infusions are not just "throw it in an IV bag and wait".
Yes that would have been a much better analogy.
What is up with the faint angled Fs?
Expectation failed is specifically a response to an unknown value for the Expect header.
Do it really make sense to blame just CrowdStrike for this?

They were one link in what appears to be a pretty fragile dependency graph.

For example, wouldn't it possibly make sense to also blame:

* Regulators / insurers / etc. who require passing the audits that mandate using services like this.

* System designers who failed to implement disaster recovery plans for this scenario.

* Auditors who failed to highlight this risk.

* Device vendors who made medical equipment susceptible to this kind of DoS.

* U.S. FDA / DEA who allowed and/or mandated systems with this kind of vulnerability.

* Voters (in democracies) who ultimately bear responsibility for their government's actions/inactions.

Etc.?
I have managed IT departments that managed hundreds of locations and thousands of computers running Windows XP and Windows Server 2003, no cloud at all. And I went through several similar outages (similar in impact on our operations, not cause or impact on others). Our first priority was to get the critical computers that operated machinery running - we did that hours (1-2) after the problem started. Then we played around with the servers and network for few weeks - but critical stuff was operable, albeit with lesser capacity and efficiency.

And we were managing forests and waterways, not hospitals and human lives.
Frontier Cities
Because the next person will know there's a good chance you'll give them a cash reward, and that will tip the "immorally take all the cash" vs "return it and hope for a reward" balance more in favour of it being returned.

I would have thought that was completely obvious so maybe that's not what you were asking?

(On the other hand this is HN...)
Not sure why you are being downvoted. Take a look at ChromeOS and MacOS to see how those mechanisms are implemented there.

They aren’t perfect, but they are an improvement over what is available on Windows. Microsoft needs to get moving in this same direction.
I'm sure there's a few adversaries who could pull something like this off, and have 0-days ready. But if they use them, the US could see that as a hostile action and get very upset about it.
I don't think the onus should be on the researcher, and I think A16Z should have paid them. But if they actually wanted to get in touch, I'm just saying they could have.

If they're putting the effort into vuln scanning the site, they can also put in the effort to get in touch like a professional. You could just as easily say "why should the onus be on the researcher to find vulnerabilities when it's A16Z's job to secure their own site". The researcher is in this to find holes and make a few bucks (which is fine!). The job is complete when you get in touch.
Wouldn't any memory-safe language help prevent this NULL pointer access? Why are all these crucial pieces still written in C/C++, when it's obvious to anybody keeping even remote track of CVEs that these languages are just not up to the task with today's climate of a 24/7 shadow internet war? (The one that's likely been going on for at least 25 years at this point?)

When will we learn?

You hate Rust -- fine (not fine but OK, I guess people get super triggered over it and it's a reality I can't change but I am still baffled by it because they throw away reason for emotions and these people should really know better). Fine. Just use Golang or any other GC language really (Java or C# as well, if you must).

When will we abandon convenient routine and start adapting to modern realities? ("Modern" being at least 25-year old here but hey, I am willing to give you some leeway and not roast you too much. Let's assume these are "modern" realities, f.ex. just the last 5 years.)
*because of CrowdStrike and Microsoft
“Linux distros are dying!!!”

“The young people are <slur>!!!”

Literally in the same thought. It’s almost impressive.
>What certifications should I have?

ChatGPT
Obtaining relevant certifications can enhance the credibility of your antivirus software and reassure customers about its security, reliability, and compliance with industry standards. Here are some key certifications you should consider:

1. Security Certifications:
ISO/IEC 27001: This certification specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). It demonstrates your commitment to managing and protecting sensitive information.
ISO/IEC 15408 (Common Criteria): This certification provides assurance that the security features of your software have been rigorously tested and meet internationally recognized standards.
2. Quality Management Certifications:
ISO 9001: This certification focuses on quality management systems and ensures that your processes consistently provide products that meet customer and regulatory requirements.
ISO/IEC 25010: This standard specifies a model for evaluating software quality, ensuring that your software meets high standards of functionality, reliability, usability, efficiency, maintainability, and portability.
3. Data Privacy Certifications:
GDPR Compliance: If you operate in or serve customers in the European Union, demonstrating compliance with the General Data Protection Regulation (GDPR) is essential.
CCPA Compliance: For customers in California, compliance with the California Consumer Privacy Act (CCPA) is important.
4. Industry-Specific Certifications:
HIPAA Compliance: If your software handles protected health information (PHI) in the United States, ensuring compliance with the Health Insurance Portability and Accountability Act (HIPAA) is crucial.
PCI DSS: If your software processes payment card information, compliance with the Payment Card Industry Data Security Standard (PCI DSS) is necessary.
5. Product-Specific Certifications:
ICSA Labs Certification: ICSA Labs, an independent division of Verizon, provides testing and certification for security products, including antivirus software. Certification from ICSA Labs can validate the effectiveness of your software.
AV-TEST Certification: The AV-TEST Institute is an independent research institute that evaluates and certifies antivirus software for its protection, performance, and usability. An AV-TEST certification can enhance your product’s credibility.
VB100 Certification: Virus Bulletin (VB) offers the VB100 certification, which is awarded to antivirus products that meet specific criteria for detecting known malware without generating false positives.
OPSWAT Certification: OPSWAT offers certifications that validate the interoperability and effectiveness of cybersecurity products, including antivirus software.
6. Environmental and Occupational Health Certifications:
ISO 14001: This certification demonstrates your commitment to environmental management, which can be important for corporate social responsibility (CSR) and sustainability.
ISO 45001: This certification focuses on occupational health and safety management systems, ensuring a safe and healthy workplace for your employees.
how do I disable the cat following my cursor animation on your website? how insanely distracting
Life-critical systems are air-gapped. Just no one considered systems running Epic to be life-critical. It turns out they are, probably more so than most.

Also, air-gapping helps only so much when network dies and hospitals can't exchange patient information or send images from MRIs and X-rays to radiologists.
> over fears that Kaspersky could cause such an outage (among other fears)?

Citation? I thought it was the "other fears"; this is the first time I'm hearing accidental outages were one of the concerns.
> You could extend the types of resource supported by means of a template, itself stored as a resource, so developers could define new resource types appropriate to their own apps.

That’s not true. ‘TMPL’ resources solely were for ResEdit (and fairly late version of ResEdit; the first versions didn’t have the. ‘TMPL’ extension mechanism) so that it could display some resources in a dialog. Developers would just ask the resource from the system and interpret its bytes in any way they saw fit.

> In those days, it was ResEdit that displayed the Get Info dialog for folders and files, where the sizes of resource and data forks were revealed.

It wasn’t. The finder showed the “Get Info” dialog. ResEdit had its own more extended version (the one shown in the article)

> Resource forks and the thinking behind them are ingenious and empowering, but open up many security issues

I don’t think it’s fair to blame resource forks for that; it was the combination of the Resource Manager with its “when asked for a resource, I’ll go through all open resource forks, starting with the last one opened” and the Finder with its “when a disk is mounted, I’ll open a resource fork to the desktop file and keep it open”.

This is somewhat similar to having “.” In your PATH. That can cause your shell to run programs that you don’t expect to run, but you don’t blame the existence of executable files for that do you?

A security-conscious API design for the resource manager would have it require a (file ID, resource type, resource number) triple to obtain resources, or require explicit buy-in for “put this file in the set of files to search”.
If one person learns this lesson it's good. If it's on the public Internet, best to expect it will be found. Stick it behind an auth wall of some sort.

I've put internal sites behind AWS ALB's plugged into an OIDC provider[1] (Google), which works well.

1: https://docs.aws.amazon.com/elasticloadbalancing/latest/appl...
Florida’s Building Code requires restaurants to have one or more public restrooms.

There is no state law that forces restaurants to allow people to use those restrooms.

Restaurants can refuse access to non-customers.
Tourists Are Set to Spend a Record $869B in Europe This Year
Yes, if they can’t do web development what does that say about their ability to deploy capital?
No not really. "AIs" today are entirely digital LLMs that can be copied, shared and redistributed for a marginal fee already. "Collecting" AI would make absolutely no sense, especially since most of the AIs worth collecting cannot be used for commercial/museum-fee purposes. The only such thing that will exist in the future are the people that digitally archive today's model files.
How is this relevant? I didn't say we should allow smoking everywhere, or that smokers don't need to exercise basic courtesy when they are around non-smokers. I said it's not my business whether someone else decides to be a smoker or not.
Windows does not support drivers based on rust language, so perhaps may be another 5 years