skysight-inc/HackerNews huggingface dataset:
Hi! I’ve used three different companies to buy eSIMs in the past, but each time I traveled to a new country in the region, like when I visited cities in Kyrgyzstan, Uzbekistan, and Kazakhstan, I had to buy a new eSIM and switch them manually on my phone. It was quite a hassle. If I understand correctly, does your service offer a universal eSIM that allows me to simply purchase a plan for the country I’m visiting without needing to manually switch eSIMs, while keeping prices competitive with other providers?
No, it can't, if there is no stock exchange online to process the prices.
I'm just curious, don't they have something like "gradual rollout" to update their app? They just bulk-update simultaneously across entire agents? No way. Something is a bit off for me. But there are good lessons to learn for sure.
Are you saying that they should prevent or limit the ability of their users from installing third party software? Or at the very least prevent it from running in kernel mode?
I have been testing this for 15 minutes.

- enforces two page layout. I don't see how to fix it. advice does not fix it: https://github.com/johnfactotum/foliate/discussions/1166

- can't open all pdf that other viewers can.

- zoom does not work, settings do nothing.

Result of the 'style' is smudge view you can't fix.
Just in time for the beginning of school holidays in Berlin. Today, they expected 86.000 travelers in BER alone (https://www.airliners.de/flughafen-ber-erwartet-rekordzahl-p...)
Would this issue not affect bare metal as well?
Also tastes like kitchen sponge but without the nutrition.
That was quick: Microsoft is blaming "3rd party" and announced that "a fix is forthcoming". Very curious indeed.
https://techcrunch.com/2024/07/19/banks-airlines-brokerage-h...
> worded badly whatever

I feel your pain. Perhaps it is time to increase the karma level required for downvoting.
Sounds like it was a 'channel file' which I think is akin to an av definition file that caused the problem rather than an actual software change. So they must have had a bug lurking in their kernel driver which was uncovered by a particular channel file. Still, seems like someone skipped some testing.

https://x.com/George_Kurtz/status/1814235001745027317

https://x.com/brody_n77/status/1814185935476863321
True for all systems, but AV updates are exempt from such policies. When there is a 0day you want those updates landing everywhere asap.

Things like zscaler, cs, s1 are updating all the time, nearly everywhere they run.
Except that anything local will be more expensive than anything globally scaled, and the same people complaining about globalization "suddenly" don't want to pay more for the same.

It's not like alternatives for MS services doesn't exist for decades. There smaller and more people friendly hostings, email services, file shares, office software etc. The problem is that people complaining about MS services don't wan't to use them or pay for them.
Unless his systems are up but critically dependent on other external systems (payment services, bucket storage, auth etc...) that are down. It's becoming increasingly difficult to not have those dependencies.
Just gonna leave this here: https://news.ycombinator.com/item?id=32548671
No code tool to make beautiful charts
The OP's handle of "monero-xmr" might give you a hint why.
> What prevents someone pushing a malicious package that takes my user data

That's not an argument in good faith. If you install unvetted packages in your airline control system, bank, or supermarket, the kind of systems that we're talking about here, you have much bigger problems to worry about.

> I'm not saying that AV software would protect against all of these,

Or indeed any of these. Highly privileged users piping shell scripts from untrusted sources is out of scope for any antivirus system, on any platform.

That doesn't mean all platforms are identical, or share the same attack vectors. It is much more accepted to install kernel mode drivers on the Windows platform, where it is not only accepted but have established quality control programs to manage it, than on Linux, where the major vendor will very literally show you the middle finger on video for everyone to see for doing so.

The Linux community is more for doing that kind of work upstream. If some type of new access control or binary integrity checking is required, that work goes upstream for everyone to use. It is not bolted on running systems with kernel mode drivers. That is because Linux is more like a shared platform, and less like a "product". That culture goes way beyond mere technical differences between the systems.
Or just test your code?
It might work on some machines, but doubt to work on the rest. Worth the try.
I wonder what the rollout procedure is for CrowdStrike.
I put $100 down that this was a minor update they decided was so minimal it didn't need extensive testing.

So many places use the "emergency break glass rollout procedure" on every deploy because it doesn't require all the hassle
That's because you were using CoPilot. Try a much better option such as Supermaven. I unsubscribed from CoPilot for similar reasons but after using Supermaven for 3-4 months I will never cancel this subscription unless something better comes along. It's way more accurate and way faster.
Don't put your eggs in one basket, I use multiple anti-virus products so that if one blows up at least not all computers are affected. Looks like my old wisdom is still new wisdom.

Clarification: I mean that every computer has one anti-virus product, but not every computer has the same anti-virus product. I'm not installing multiple anti-virus products on the same computer.
hey, but at least (a) we have a process (b) we documented it and (c) we review it regularly!

what can go wrong?!
Do you have/need GPUs on your 'mission critical systems'? I would bet most of us don't.

I quite agree with OP here. VMs are now quite lightweight (compared to available resources on machines at least) and I would rather use a light, hardened Linux as my base OS that will run windows VM and do snapshots for quick rollbacks. Actually, that's what I run on my own PC, and I think it would be the sanest way to operate.
Powersort Competition – University of Liverpool
Amazing! Thank you for the link.
The flip side is, if you don't do auto updates and an exploit is published and used against you and you haven't yet tested / pushed the patch, that you would have been protected against if it had auto updated, you are up the creak without a paddle in that situation as well.

To some degree you have to trust the software you are using not to mess things up.
No you should switch over to Chromeos, iPads, ... anything but Microsoft.

Crowdstrike only exists because Windows and other Microsoft products are so insecure their default configuration.
Quantum circuits where error mitigation is efficient are classically simulable
> As you can clearly see: Waframe crashes on everything!

made my day
Sounds like it's a majority of KLM flights, so seemingly it's themselves.
You may not want the chat server owner to know which public ssh key you are using for privacy reasons.

Workaround: Specify another ssh keypair
Also, why not have some sort of graceful degradation (well kind of), like: OS Boots, loads CS driver, the driver loads some new feature/config, and before/after new recent thing ("runtime flag") marked whether it successfully worked, and if not on the next reboot that thing gets either disabled, or the previous known good config (obviously some combination of things might cause another issue), but instead of blindly rebooting to the same state....
You are completely right. BTW It wasn't a software update, it was a content update, a 'channel file'.
Someone didn't do enough testing. edit: or any testing at all?

https://x.com/George_Kurtz/status/1814235001745027317

https://x.com/brody_n77/status/1814185935476863321
it hovers around -20% in pre-market (at the moment)
That sounds exactly like my employer, the JHU Applied Physics Lab. We’re a university affiliated research center, so we aren’t tied to the government pay scale and can provide a better career advancement outlook.
There should be a new term called compliance hell.
> more scared of failing an audit than they are of the consequences failure of the underlying systems the audits are supposed to be protecting.

Duh, else there would be no need to audit them to force compliance, they'd just do it by themselves. The only reason it needs forcing is that they otherwise aren't motivated enough.
Practice makes a man perfect.
> if it's not 100% secure

It's 100% broken though...

I guarantee you that the damage caused by Crowdstrike today will significantly outweigh any security benefits/savings that using their software might have had over the years.
People would be horrified if they knew the extent to which basically every corporation shares data with everyone else for "business intelligence"
Do you admire federated system of Germany too? They famously have many department operating semi-autonomous, causing immense friction in adopting any new changes. Do you admire federated system EU? Where countries can run unchecked for years and it is very hard to fix issues in any specific member country.

I'm not criticizing any country or union here, and not praising them. I merely highlighting that maybe federation on its own is not the main cause of success of USA and there are some other more important factors at play.
Show HN: Find the Fox
If you are IT team for a large impactful organization, you have to control updates to your organization's fleet. You cannot let vendors push updates directly. You have to stage those updates and test them and then do a gradual rollout to your whole organization.

Plus, for your critical communication systems, you must have a disaster recovery plan that actually helps you recover quickly in minutes, not hours or days. And you have to exercise this plan regularly.

If you are crowd strike, shame on you for not testing your product better. You failed to meet a very low bar. You just shipped a 100% reproducible widely impactful bug. Your customers must leave you for a more diligent vendor.

And I really hope the leadership teams in every software engineering organization learn a valuable lesson from this – listen to that lone senior engineer in your leadership team who pushes for better craft and operational rigor in your engineering culture; take it seriously - it has real business impact.
People want to make the most of their limited vacation time and don't understand how time consuming and draining traveling between places is.

I once met a Japanese guy who was "doing" Scandinavia in a single weekend, which basically meant flying into Copenhagen, taking a train to Oslo, another to Stockholm and flying out. I don't think he ever saw a fjord or an island.
Yes. And the vast majority of the time, it doesn’t mess things up.

The notion that you may take on risk to net alleviate risk is somehow lost on a lot of people in these conversations.
https://news.ycombinator.com/item?id=41002245
so Kevin is why we can't have nice things....
There’s already a Wikipedia page on the outage.

https://en.wikipedia.org/wiki/July_2024_global_cyber_outages
It’s rarely that sinister on the political level in my experience. Having worked a decade in the Danish public sector with access to the higher echelons of decision making I’ve never really witnessed influence or blatant corruption amongst the elected official. Well, there is influence but it’ll typically be along the lines of getting better road access or being allowed to expand in zones that weren’t really meant for it. Not because of personal gain but because jobs are just so valuable to a political administration.

Where things get more complicated is typically with the unelected administration. Basically you can view most political decision making as an administration working out action plans and presenting them to politicians. Which is a good concept, until people stop participating in things like public hearings. Because the officials who work in the administration are professional and politicians in cities are often… well you or me. This means that it’s sort of easy for officials to influence decision making by writing and presenting the different action plans in ways where they know which are more likely to be selected. This is sometimes influenced by corruption, and usually that gets caught eventually around here. It’s much more often that it’s simply influenced by the different silos protecting themselves. Which will lead to bad decision making.

Now, I mentioned things like public hearings earlier and these are actually immensely influential because most politicians are actually very open to hear from the public. The big issue is that most of the people who attend or respond to public hearings are either fanatics or crackpots. When regular people actually participate in their local democracy they can have a huge influence, much more so than both administration and business, but people don’t. I’m not a saint myself, it’s been more than a decade since I even bothered to read the proposals which are sent to me. To make things even worse, fewer and fewer people register as members of political parties which means they give up their influence on selecting candidates and when it’s time to vote, many simply vote on a party, not on a specific candidate. So we’re gradually giving over power to anyone who actually does participate, which is often going to be business.
Even if true, the orgs whose machines they are have the responsibility to validate patches.
This is much easier applied personally than it is to a 30k person organisation. No need to be condescending.
I wish the Brits never touched bread recipes. Or the Germans for that matter. I was born in Eastern Europe and raised in simple, tasty bread baked in local bakeries. These days I have to go to small town in France or Italy to get decent bread. What is sold in Britain as bread is nothing of the sort and the "local artisanal" bakeries are often using wholesale produced dough which they simply put in their oven and call it baking their own bread. Basically what IPA beer is, a concentrate mixed with alcohol to produce a brainfuck drink that has nothing to do with beer.
Our worst outage occurred when we were deploying some kernel security patches and we grew complacent and updated the main database and it's replica at the same time. We had a maintenance with downtime anyway at the same time, so whatever. The update worked on the other couple hundred systems.

Except, unknown to us, our virtualization provider had a massive infrastructural issue at exactly that moment preventing VMs from booting back up... That wasn't a fun night to failover services into the secondary DC.
Hell of an article. This what I used to buy newspaper magazines for.
I should remind you that the Scottish character can be summed up by the simple observation that Scotland is the only country whose national dress includes a knife in the sock.
Imho that was somewhat true on x11 but on wayland I feel everything is much smoother. I am more a pgup/pgdown user though.
When we think "security" on HN we think about the people who escalate wiggling voltages at just the right time into a hypervisor shell on XBox, but I've had to recognize that my learned bias is not correct in the real world. In the real world, "computer security" is a profession full of hucksters that can't tell post-quantum from heap and whose daily work of telling people repeatedly to not click links in Outlook and filling out checklists made by people exactly like them has essentially no bearing on actual security of any sort.
Enjoy the circus then!
Reading memory from another process can be done through memory-safe APIs.

To give an example from the linux userspace world: https://docs.rust-embedded.org/rust-sysfs-gpio/nix/sys/uio/f...
I don't even want to know how many mission critical systems automatically deploy open source software downloaded from github or (effectively random) public repositories.
your loss. fwiw, It's not run by Google any more
So true! It seems like all of these were invented to create another market for b2b saas security, audit, monitoring, etc. companies. Nobody cares about actual security or infrastructure anymore. Everything is just buying some subscription for random saas companies, not checking their permissions and grant policies and ticking boxes because... compliance.
You’re basically asking for a virtue signalling disclaimer. I think you’d prefer a different social network.
They definitely don’t store excess shots for later. Even their brewed coffee had timers and workers were required to dump and rebrew after ~20 minutes.
> And I would argue they haven't produced much usable stuff in the research realm at all

I would disagree. C# and F# have been good. Advances in Haskell. AR advances. Those are all interesting, just off the top of my head.
You're right that it exists, but it's complete crap outside a quiet environment. Try to use it while walking around outside or in any semi-noisy area and it fails horribly (iPhone 13, so YMMV if you have a newer one).

You cannot use an iPhone as a dictation device without reviewing the transcribed text, which IMO defeats the purpose of dictation.

Meanwhile, i've gotten excellent results on the iPhone from a Whipser->LLM pipeline.
I’m using this app’s EPUB engine for my iOS/macOS app, Manabi Reader, which is for learning Japanese through reading (but I want to expand to more languages and general purpose use soon)

https://reader.manabi.io
Also Silicon Valley: AI will replace doctors and nurses.
You use multiple anti-virus products. Let's assume you use 3. Do you have multiple clusters of machines, each running their own AV product, so in case one has this problem the other two are unaffected?

How much overhead are we talking about here? Because if you're just using multiple AV software installed on one machine, 1) holy shit, the performance penalty, 2) you'd still be impacted by this, as CS would have taken it down.
There's surprisingly one company missing from this list; Hey/37 Signals itself.

As the originators of Ruby on Rails I would expect to see here.

(The list seems to include firms with 0 market cap already so it can't be based on pure size.)
And it should be hosted on neocities.

That's probably not so hard that a 7 year old girl could do it.
> Linux isn't exactly reliable either... I'm sorry but that OS is barely capable of outputting a stable HDMI signal, god help you if you are on a laptop with external monitor.

This is demonstrably false, given the amount of people that game on Linux nowadays.

> System upgrades always make me nervous because there is a very real chance of something getting fucked up and my screen staying black the next time it boots, having to go into a TTY, and manually fixing stuff up or booting the previous version that was still saved in GRUB.

I had this happen to me once. Timeshift was painless to use, and in about 15 minutes I had my machine up and running again, and could apply all updates properly afterwards. If anything it made me bolder lol.
Do we have any estimates how many machines are affected?
I don't mean this to be rude or as an attack, but do you just auto update without validation?

This appears to be a clear fault from the companies where the buck stops - those who _use_ CS and should be validating patches from them and other vendors.
how can billion dollar company push update before testing?
It's an automatic update of the product. Semantic "channel vs. binary" doesn't indicate anything. If your software's definition files can cause a kernel mode driver to crash in a bootloop you have bigger problems, but the outcome is the same as if the driver itself was updated.
Yeah that was also my understanding, and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols. But of course you never know without decompiling the module
Thank you! If ever I get a chance I’ll be coming to a live show for sure!
Ohhh absolutely. And it's not just users, it's also management. "How does this affect us? Are we compromised? What are our options? Why didn't we prevent this? How do you prevent this going forward? How soon can you have it back up? What was affected? Why isn't it everyone? Why are things still down? Why didn't X or Y unrelated vendor schlock prevent this?..."

And on and on and on. Just the amount of time spent unproductively discussing this nightmare is going to cost billions.
That’s easy for you to say, with the benefit of recency bias, and with presumably zero experience in running a hospital.
And then...the company goes bust? Why would anyone do this?
That’s even worse—-they should be fuzz testing with bad definitions files to make sure this is safe. Inevitably the definitions updates will be rushed out to address zero days and the work should be done ahead of time to make them safe.
seems like nasdaq is down for me
You would lose a lot of the benefits of a system like crowdstrike if you waited to slowly roll out malware definitions and rules.
Ask my IT dep. AFAIK it's audit related, safety-critical software
More importantly, why are CS customers not validating? Upstream patches should be treated as faulty/malicious if not tested to show otherwise, especially if they're kernel level.
Looks like ascii colors aren't being filtered correctly.. which is a pretty big issue. White on white isn't very readable... :-)
It's Белоруссия (Byelorussia) in Russian, although Belarusians are not terribly fond of the name.
That makes me even more unsettled! Shouldn't this be closer to metadata than operational/mechanical?

Feels like they made unsafe data for the format they created. Untrustworthy. To your point, they aren't testing.
it's already noon in central europe and yes everythings fucked. except for the linux powered companies