skysight-inc/HackerNews huggingface dataset:
I don't recall it being especially transformative. I was in high school from 1979 to 1983 and was an early adopter of a Walkman, probably sometime in 1980. It was fun to share it with friends and -- especially -- girls.

I probably wore it more around school off my ears and around my neck as some sort of status symbol more than actually listening to music between classes.

Eventually my high school banned them when someone recorded test answers on a cassette and used their Walkman to cheat on tests.

The TV show "Square Pegs" captured the era somewhat accurately. The character played by Merritt Butrick was one of those wearing a Walkman around everywhere and sort of reflected the way it felt. To me anyway. YMMV. :)
Lol if they can't do staging to mitigate balls ups on the high availability infrastructure side (optus in aus earlier this year pushed a router config that took down 000 emergency for a good chunk of the nation) we got bugger all hope of big companies getting it further up the stack in software.
It's baffling how fast and wide the blast radius was for this Crowdstrike update. Quite impressive actually, if you think about it - updating billions of systems that quickly.
> crowdstrike is caused by over-regulation, not under-regulation.

This is laughably wrong. Tech is notoriously under-regulated.

Crowdstrike is caused by bad regulation. Somewhat common, as regulatory bodies are typically not well versed in tech to properly regulate it.
> Why did they update everything all at once?

This is beyond hospital IT control. Clownstrike (sorry, Crowdstrike) unconditionally force-updates the hosts.
Is this any different than the LTS approach Canonical and others take?
> Of course the OS matters! Windows is a nasty ball of patches in order to maintain backward compatibility with the 80s. Linux and OSX don't have to maintain all the nasty hacks to keep this backward compatibility.

Just don't tell that to Linus Torvalds :) Because Linux absolutely does maintain compatibility with old ABI from 90-s.
Check out Hyundai's new $23K Casper EV spotted out in the wild
Until the malware bring their own compromised signed anti cheat driver on their own, like what happened with Genshin Impact anti cheat mhyprot2
I think we do have enough info to judge e.g. :This should not have passed a competent C/I pipeline for a system in the critical path."

Thay info includes that the faulty file consisted entirely of zeros.
It seems that an unexplored weirdness here is the prevalence of virtual Windows in the medical world. It seems that this has approach has become commonplace for HIPAA reasons (though it's unclear that it makes the world better versus using secure applications to handle HIPAA data). In the case of this Crowdstrike outage, one would think that virtual machines would simplify getting things up and running again, but instead there seems to be just the opposite going on, where lack of hardware access is limiting restoring them.

Any insight from those affected?
they are $900, used, on ebay
And who/what is going to curate data? AI or that company in Kenya https://time.com/6247678/openai-chatgpt-kenya-workers/ ? Because neither have a clue what is good data and what is not.
no money for that

there are backup paper processes, but they start fresh when the systems go down

If it was printing paper in case of downtime 24/7, it would be massive wasteage for the 99% of time system is up
>... and when the people who should be paying get to duck out because ...

See here you're confused. You built the cage, you hired the staff to watch the cage, you are by proxy forcibly caging people in it who ought not be there, YOU pay for the damned cage! When selling coke gets you a box simply because a plurality of nitwit voters think someone selling coke should get the box, it's not about morality anymore and it's just a war... err a case of "you pay me to go beat him up because you think he stinky, but hey I found that burglar last week and stopped Russia last month so it's tots cool! *peace sign*"
I don't understand why you wouldn't do staged roll outs at this scale. even a few hours delay might have been enough to stop the release from going global.
until no things grow no more, that our farm animals could eat
IBM’s z/OS maintains compatibility with the 60’s, and machines running it continued to process billions of transactions every second without taking a break.

The OS matters, as well as the ecosystem and, and this is most important, the developer and operations culture around it.
We build our "cyber fortress" out of the Turing Complete analog of Crates of C4... and wonder why things go wrong all the time.

As I say every time this happens (and it will keep happening for the next decade or so)... Ambient Authority systems can't be secured, we need to switch to Operating Systems designed around Capability Based Security.

We need at least 2 of them, from competing projects.
Correct.

But in context: It simply can't take very much grunt to provide a modern take on a ridiculously-limited portable computer from 1983.

The TRS-80 Model 100 that is the context here had an 80C85 processor running at a scalding 2.4MHz, and featured as much as 24 kilobytes of SRAM.

And that's a pretty excellent spec for a portable computer in 1983, but it's a complete snoozefest compared to a RP2040 dev kit like the Pi Pico (at a cost of around three US dollars).
Basically, lack of IP protection = no patent or copyright. Now our patent length is OK, but copyright is far too long.
In old Rome, if you made a new process, you locked up the shop and kept it secret. Anyone steal the secret and you could do nothing. There are stories of Roman senators killing inventors to maintain a controlled market.
In addition, Rome had zero electronics, and no document tradition via printed books = all hand copies(printing in old China) There some relics that hint at plating cells for silver and perhaps gold, but no firm data
This can be said of so many things. Like a cycling race, or NASCAR, or golf, or chess.

I love it. Love cycling as well.
That's a management problem. IT security didn't communicate that to the finance folks. Microsoft didn't communicate that to IT security. And if they're on Azure, it's more money for Microsoft.
In an infinitely large world with an infinitely large number of monkeys typing an infinite number of words on an infinite number of keyboards, "just index everything and threat it as fact" isn't a viable strategy any more.

We are now much closer to that world than we ever were before.
Linus Torvals best programmer of his generation, change my mind.
These are valid concerns, and I can absolutely see situations where I would want to do both of those things that KeyPassXC is doing (skipping user verification and exporting private keys). But security isn't a one-stop shop.

Doing user presence verification gets in the way of the user doing what they want to do. Not doing user verification lets an assertion be made in the background - possibly by a malicious script. Is that tradeoff worth it?

Letting the user export private keys is absolutely important for backup, and transferring between devices and services. But if you can easily export a private key then cloning it becomes significantly easier. Are trivially cloned keys a risk we're willing to take?

The answers to these depend on the user, the provider the application and their combined threat model. Sometimes those risks are totally fine. Other times, they're totally not. The standards could open up more options and let the user or sites negotiate what they can and can't do. And the cost in that direction is that now the overall concept is more complicated, and we requires both site operators and users to learn what those tradeoffs involve - with an almost certainty that security will be weaker as a result.

This isn't a cut and dried issue, with clear 'right answers' and villains. Tradeoffs exist in every direction, and there just aren't any security free lunches to be had here.
Do you work in SecOps? Do you manage the security of thousands and thousands of end user devices with actual users?

If so you should be grateful for ways to have actual visibility (and possibly blocking) of dangerous activity on the machine. Before EDRs we were blind.

EDRs could be better, cheaper, more integrated (that part is not too bad) but saying that PCI-DSS is the only reason for them is disinformation (or lack of actual experience with SecOps)
100% agree with that. The thing that baffles me a bit, then, is that if you are writing software that is so critical and can have such a catastrophic impact when things go wrong, that you double and triple check everything you do - what you DON'T do is use the same level of care you may use with some social media CRUD app (move fast and break things and all that...)

To emphasize, I'm really just thinking about the bad practices that were reported after the SolarWinds hack (password of "solarwinds123" and a bunch of other insider reports), so I can't say that totally applies to CrowdStrike, but in general I don't feel like these companies that can have such a catastrophic impact take appropriate care of their responsibilities.
> why the fuck is our critical infrastructure running on WINDOWS.

That hits the nail on the head.

But it is a rhetorical question. We know why, generally, software sacks, and specifically why Windows is the worst and is the most popular

Good software is developed by pointy headed needs (like us) and successful software is marketed to business executives are have serious pathologies

There are exceptions (I am struggling to think of one) where a serious piece of good software has survived being mass marketed, but the constraints (basically business and science) conflict
Boom boxes were more of the thing in my scene. Music was still social and people loved listening to mix tapes.
I guess you’ve just invented an Xbox/PlayStation.
The difference is that lots of different companies can share the burden of implementing all that in Linux (or BSD, or anything else) while only Microsoft can implement that functionality in Windows and even their resources are limited.
Also lack of visibility. The two pilots couldn't see each other through the fog.
I mean... installing what is essentially a 3rd party enterprise rootkit that not only has root access to all files and network activity but also a self-update mechanism ... who could have seen this coming?
The assumption is that for a given test program, the call stack used at the specific moment where the failure begins is the same each run. If that's not true, there will be problems.

If there are two different call stacks that get to the function in question, but only one of them is where the failure begins, you absolutely want to distinguish those.

In practice we do cut off the stacks, using just 16 frames, but that's to avoid O(stack depth) overhead, not to coalesce different things.
I'm a Kubuntu user that, seemingly due to Canonical's decision to ship untested software regularly, has been repeatedly hit by problems with snaps. What were initially basic, obvious, and widespread issues with major software.

Yes, distribute your eggs, but check the handles on the baskets being sold to you by the guy pointing out bad handles.
> the "hacker types" who are most likely to want to start security software companies are also the least likely to want to implement the "boring" pieces of a process-oriented culture

I disagree, security companies suffer from "too big to fail" syndrome where the money comes easy because they have customers who want to check a box. Security is NOT a product you pay for, it's a culture that takes active effort and hard work to embed from day one. There's no product on the market that can provide security, only products to point a finger at when things go wrong.
That was probably because the NSA and other critical government agencies use Microsoft Exchange and it was a bug found in the wild.

But if it wasn't a bug found in the wild, can you imagine the fights between the NSA red and blue teams on whether to alert Microsoft about it?
> This isn't how it works. As the models are improved, they learn more about reality largely on their own.

AI models aren't complete blackboxes to the people who develop them: there is careful thought behind the architecture, dataset selection and model evaluation. Assuming that you can take an existing model and simply throw more compute at it will automatically result in higher fidelity illumination modeling takes almost religious levels of faith. If moar hardware is all you need, Nvidia would have the best models in every category right now. Perhaps someone ought to write the sequel to Fred Brooks' book amd name it "The Mythical GPU-Cluster-Month".

FWIW, Google has AI-based illumination adjustment in Google Photos where one can add virtual lights - so specialized models for lighting already exist. However, I'm very cynical about a generic mixed model incidentally gaining those capabilities without specific training for it. When dealing with exponential requirements (training data, training time, GPUs, model weight size), you'll run out of resources in short order.
al2023 uses "releasever" which is basically a dated snapshot of the packages. You can choose to install last-1 instead of the latest.
Engineers are mostly complicit because they get that 200k$ salary when they chase next shiny thing.

No one is paying such salaries for mundane clerical job.
Maybe if all the profit seeking entities were removed from healthcare that money could instead go to the development of useful offline systems.

Maybe a handheld device for scanning in drugs or entering procedure information that stores the data locally which can then be synced with a larger device with more storage somewhere that is also 100% local and immutable which then can sync to online systems if that is needed.
Of these four:

The first ('''So this "one weird trick" will disappear without any special measures''' etc.) does not seem so to me, I do not read that as a claim of perfection, merely a projection of the trends already seen.

The second ('''If the computer can see it we have a discriminator than we can use in a GAN-like fashion to train the network not to make that mistake again.''') I agree with you, that's overstating what GANs can do. They're good, they're not that good.

The third ('''Once you highlight any inconsistency in AI-generated content, IMHO, it will take a nothingth of a second to "fix" that.''') I'd lean towards agreeing with you, that seems to understate the challenges involved.

The fourth ('''Well, nice find, but now all the fakes have to do is add a new layer of AI that knows how to fix the eyes.''') is technically correct, but contrary to the meme this is not the best kind of correct, and again it's downplaying the challenge same as the previous (but it is unclear to me if this is because nuance is hard to write and to read or the genuine position). Also, once you're primed to look for people who underestimate the difficulties I can easily see why you would see it as such an example as it's close enough to be ambiguous.
When did they get rid of this? I didn't even notice.
As so often, Daedalus (David E H Jones) got there first with one of his semi-humorous articles in New Scientist in 1969 - one of those collected in "The Inventions of Daedalus" in 1982.
Sure, but for me there isn't anything fundamentally different between a LLM reply and a spammers reply / SEO-vomit. Both are low quality useless junk that gives the masquerade of resembling something worth engaging with.

In fact the really bad spammers were already re-using prompts/templates, think of how many of those recipe novellas shared the same beats. "It was my favorite childhood comfort food", "Cooked with my grandma", blah blah blah
A big problem is that the Windows platform has normalized the idea of 3rd party software running at the kernel level, and end users allow it because it's so normal. They've also normalized the idea of 3rd party software (even games) requiring Admin access to run, which is not as bad but a similar threat. Software that routinely requires elevated privileges seems to be a bad idea.
so now we're vouching for more restrictive operating systems? the last thing I want is an operating system that can only install vetted apps, and that these apps are restricted even if I provide my root password.
>a flood of crap content

so, status quo? this sort of content only has value because google links to it when people search, and because google runs an ad network that allows monetizing it. google is also working furiously to provide these same AI-generated answers in their SERP, so they can eliminate this and monetize the answers directly instead of paying out to random third parties.

i'm pretty skeptical that this ai-generated content will ever be monetizable in the way the article suggests, simply because google is better at it. if you're a human making your living by writing articles that are indistinguishable from ai-generated content, then you might be harmed by this but for most people this inflection point is not going to be a noticeable change.
> arguing that we should instead give that control to Apple is just swapping out who's holding the gun.

apple wrote the OS, in this scenario they're already holding a nuke, and getting the gun out of crowdstrike's hands is in fact a win.

it is self-evident that 300 countries having nukes is less safe than 5 countries having them. Getting nukes (kernel modules) out of the hands of randos is a good thing even if the OS vendor still has kernel access (which they couldn't possibly not have) and might have problems of their own. IDK why that's even worthy of having to be stated.

don't let the perfect be the enemy of the good, incremental improvements in the state of things is still improvement. there is a silly amount of black-and-white thinking around "popular" targets like apple and nvidia (see: anything to do with the open-firmware-driver) etc.

"sure google is taking all your personal data and using it to target ads to your web searches, but apple also has sponsored/promoted apps in the app store!" is a similarly trite level of discourse that is nonetheless tolerated when it's targeted at the right brand.
Most printers in these facilities run standalone on an embedded Linux variant.They actually can host whole folders of.data for reproduction "offline". Actually all scan/print/fax multi function machines can generally do that these days. If the IT onsite is good though the usb ports an storage on devices should be locked down.
Maybe, but Canonical didn't learn and are back to pushing advertising and forcing unwanted changes.
I think Canonical do something similar, but as to other LTSs -- some do tip & tail and some don't. The key is that tails get only security patches and fixes to major bugs and rarely anything else. This is what offers stability and keeps maintaining multiple tails cheap (which means you can have more of them).

Even some JDK vendors can't resist offering those who want the comforting illusion of stability (while actually taking on more real risk) "tail patches" that include enhancements.
how much lathe-ing have you done recently? did you load files onto your CNC lathe with an SD card, and thus there is a computer, which needs updates, or are you thinking of a lathe that is a motor and a rubber band, and nothing else, from, like, high school woodshop?
> Just don't tell that to Linus Torvalds :) Because Linux absolutely does maintain compatibility with old ABI from 90-s.

That’s nothing. IBM’s z/OS maintains compatibility with systems dating all the way back to the 60’s. If they want to think they are reading a stack of punch cards, the OS is happy to fool them.
Microsoft can prevent this and they should have prevented this, that they did not prevent this in the past does not make it any better.
I would frame it differently: stack hash bisect is only suitable where your code is linked into some other large program that you don't understand, and when your changes can be toggled on a per-invocation basis. Then you can use it to identify the exact stack through the larger program that leads to your code and works with the old behavior but breaks with the new behavior.

(saagarjha seems to be talking about 'git bisect', which is not really what the post is about.)
I just want one that says "STOP CAMPING THE PASSING LANE"
"And ofc, you pay me a shitload of money for this, I don't have to tell you why, am I?"
> why is critical infrastructure getting OTA updates from third parties automatically deployed directly to PROD without any testing.

I am missing some details, perhaps

From what I see this was an update from Crowdstrike. They are a first party, no?

Was another party involved?
That looks absolutely normal
The differece is it no longer means the vendor's QA is poorer /than average/.
A kernel driver can, definitely, take down a Linux machine.

The question is whether someone should implement something like this as a kernel module when there are better ways.
You must be incredibly blind to basic modern history to not see exactly how it does ring true for Europe. It was specifically the U.S. and its support for other western countries in Europe that eventually freed them from the grip of the Nazis and later from being counter-occupied by the USSR crushing its way westward. This potential invasion was stopped mainly by a U.S. supported presence in the west.

Whatever Hitler's inspirations for the management of his genocide, it was uniquely his in a way that nobody could sanely blame on the United States.

Finally, your picking a specific, Bush-era rendition programs as an example of recent barbarism in Europe, vs an entire, full-scale fucking war started by the Putin government in the east is laughable as an example of barbarism being more the fault of the Americans and their domination in Europe.
> The service provider has every right in the world to demand the user prove that they are securely storing the credential in a way that can't be extracted.

I'm so glad people never crammed that into the TOTP protocol. You have recovery codes you can save (which are arguably just as sensitive as the TOTP secret) and a lot of apps let you export the secret entirely.

I used an app on iOS that doesn't let you export them, and it took hours to migrate each entry one-by-one to my new Android device. Even with recovery codes, it was a pain to log in to each site and drill through their menus to disable and set up 2FA again. I should have been wary of that.
If you're so close to death that you're depending on a few seconds give or take, you're in God's hands. I would not blame or credit anyone or any system for the outcome, either way.
That's basically what ssb or dat are
It's actually not that hard from a conceptual implementation standpoint, it's a matter of scale, network effects, and regulatory capture
Most LTS strategies are like this, enterprises run the LTS version on the server while the consumers run the latest version. In a way, it is beta testing, but the consumer isn't really mad about it since he gets new features or performance boosts. LTS users usually update once every 3-6 months or if a serious CVE comes out, while normal users update daily or weekly. To be honest, I know servers running whatever the latest version of nodejs is, instead of LTS, mostly because they don't know that node has a LTS policy.
That's how alcohol works. It's how cigarettes work. It's even how prescription medicine works.
AI Tools Directory
> "concern of reoffending is rarely if ever given much actual consideration"

Complete bullshit. Concern for somebody reoffending is a major factor in sentencing and in the public's support for the continued existence of the prison system. Examples of sentencing that follow from other principles do not contradict this.
Ever heard of a LAN? You don't need internet access for every single machine.
Why doesn't postgres automatically (or with one-click confirmation) update all databases on startup when it discovers databases from a previous major version?