skysight-inc/HackerNews huggingface dataset:
> I have worked at places which controlled the roll-out of new security updates (and windows updates)

But did they also control the roll-out of virus/threat definition files? Because if not their goose would have been still cooked this time.
What you mean is 18th century Britain (1700s)
The failure mode here was a page fault due to an invalid definition file. That (likely) means the definition file was being used as-is without any validation, and pointers were being dereferenced based on that non-validated definition file. That means this software is likely vulnerable to some kind of kernel-level RCE through its definition files, and is (clearly) 100% vulnerable to DoS attacks through invalid definition files. Who knows how long this has been the case.

This isn’t a matter of “either your system is protected all the time, even if that means it’s down, or your system will remain up but might be unprotected.” It’s “your system is vulnerable to kernel-level exploits because of your AV software’s inability to validate definition files.”

The failure mode here should absolutely not be to soft-brick the machine. You can have either of your choices configurable by the sysadmin; definition file fails to validate? No problem, the endpoint has its network access blocked until the problem can be resolved. Or, it can revert to a known-good definition, if that’s within the organization’s risk tolerance.

But that would require competent engineering, which clearly was not going on here.
And Enceladus doesn't have a no trespassing sign.
Eh, it's not too broad... I think we should ask how Ron feels about the characterization though.
If you search for the keywords “program understanding” and “program visualization” in Google Scholar, you’ll see a lot of research on how to visualize and comprehend systems. Around 2007, one visualization that caught the internet’s attention was CodeCities by M. Lanza, and there is also Moose[1], which is based on Pharo and provides abstractions to query and visualize code bases.

But, for some reason, none of these tools catch the attention of the most popular IDEs. I hypothesize that there are major roadblocks to implementing this in a generic and useful way.

The first one is the variety of languages, frameworks, and build tools. For example, analyzing a TypeScript+React code base is not the same as analyzing a TypeScript+Vue code base, even when both use TypeScript and the TSC API is very easy to use.

The second roadblock is that useful visualizations also depend on the characteristics of your system, and creating them is not easy.

Maybe things will change with the addition of AI to analyze code bases, but so far, all the tools I’ve seen are either very niche or very short-lived.

[1]: https://moosetechnology.org/
In a sense, it looks like these insurance company's policies work a little bit like regulation. Except that it's not monopolistic (different companies are free to have different rules), and when shit hits the fan, they actually have to put their money where their mouth is.

Despite this horrific outage, in the end it sounds like a much better and anti-fragile system than a government telling people how to do things.
Huh? Of course life goes on, but it will be a more resource constrained life, and that will make political negotiations more difficult. If those aren't implications worth worrying about, what would be?
Correct but respectfully I think you didn't read the post fully. I mentioned within I'd hedge by buying an equal dollar amount of NDX futures which makes it a bit more beta neutral. If those stocks rise, so does the NDX, and my losses on the shorts are offset. But the whole thing won't work anyways due to high trading costs. Unless somehow you can make markets very well at huge scale.
Applying rigorous engineering principles is not something I see developers doing often. Whether or not it's incompetence on their part, or pressure from 'imbecile MBAs and marketers', it doesn't matter. They are software developers, not engineers. Engineers in most countries have to belong to a professional body and meet specific standards before they can practice as professionals. Any asshat can call themselves a 'software engineer', the current situation being a prime example, or was this a marketing decision?
Does publish mean something else in this context? I thought publishing means that anyone can have access to your research.
"If only we asked harder problems for our leetcode interview!"
On what does a tangerine wait
Each morning below the winters sun as it awakes?

Do twisted dreams linger, of what it might mean to be a taste on the memory of a forgotten alien tongue?

Is its sacred role seen -- illuminated amongst the greens and unique chaotic chrominance bouncing ancient wisdom between the neighboring leaves?

The tangerine -- victim, pawn, and, ultimately, master ; its search for self in an infinitely growing pile of mixed up words truly complete. There is much to learn.
Ok, but weren't 2019 levels really bad? These are nice developments but really tiny in comparison to what needs to be done to stop progression.
Likely because staggered updates would harm their overall security services. I'm guessing these software offer telemetry that gets shared across their clientele, so that gets hampered if you have a thousand different software versions.
You apply the same process, but your hypotheses are "bug is before/after this bisection point". Your "probability of evidence given hypothesis before/after" are where you incorporate your guess about the tests flakiness. Still works even if you don't have "true" numbers for the tests flakiness, just won't converge as quickly
I have neither used Rocksmith nor my links, but I have found these on my guitar
quest (not opensource).

https://tonelib.net/jam-overview.html
https://yousician.com/guitar

But I have been interested in something like
https://github.com/PolyMeilex/Neothesia
for guitar.
The CEO says it isn't and we believe them apparently
It does. CrowdStrike forced itself into boot process. Normal windows drivers will be disable automatically if they caused a crash
"Cool Reader GL" is good. Has a lovely page curl animation, etc. It's old though, and hasn't been updated in many years now but it still works fine. I like it because it's very customizable and has fine control of font rendering such as being able to turn off anti-aliasing. It takes time to set-up the way you like, but once you do, it's great and just works.
Ukraine is a sovereign nation, with the right to make its own decisions.

Neither you nor Russia have any say in this whatsoever.

If you still vehemently disagree, the best recourse is to get Ukrainian citizenship, enter politics, and make your case. That's how this works.
Instead of a fine, Nigeria government should have just invoiced them. It (sort of) worked for one Lithuanian man between 2013-2015 [1]

[1] https://www.nytimes.com/2019/03/25/business/facebook-google-...
Thanks, I'll check these out. I have some hope that something like this could take off because of the popularity of Mastodon. I think the problem is that there has to be a major impetus for lots of people to switch, and it has to be completely brain dead stupid simple to set up, and to have it work fairly transparently so they don't feel like they're doing something completely new and different. Unfortunately decentralized services tend to add overhead, and user's expectations have been primed with centralized tech. We might see people care about stuff like this if we get more online censorship with government taking a closer look at tech lately.
Leave them alone, jerks.
AlphaGo learned to play Go by playing with itself. Why couldn't LLM do the same? They got plenty of information to be used as a starting point, so surely they can figure out some novel information eventually.
What load of horseshit.

1. Nobody auto updates my linux machines. They have no malware.
2. It's my job to change the oil in my car. When Ford starts sending a tech to my house to tamper with my machines "because they need maintenance" will be the day I am no longer a Ford customer.
> and that's ignoring the fact they do all of our manufacturing.

Any estimate of how much that constitutes? Like if US and EU had to produce themselves all the stuff they now get from China, how would their CO2 emissions change?
Rising sea levels, temperature change, and extreme weather are not the only problems. There is also crop failure, ocean acidification, and ecosystem collapse, the latter which is the most worrying to me, as it implies both our food and our oxygen will be impacted. Furthermore, high CO2 levels in the atmosphere have measurable impact on cognitive abilities, so we will all be dumber with the changes, making it even harder to solve the problem. A negative feedback loop it seems.
Last time I flew, in sweden, the guy was angry at me for having to do his job so he slipped my passport away from the tray, so that I'd lose it. Lucky for me I saw him doing that.
Crowdstrike pushed a configuration change that was a malformed file, which was picked up by every computer running a the agent (millions of computers across the globe). It's not like hospitals and IT systems are manually running this update and can roll it back.

As to why they didn't catch this during tests or why they don't use perform gradual change rollouts to hosts, your guess is as good as mine. I hope we get a public postmortem for this.
Except for the few open access journals out there, this is pretty much how all academic journals work.
Quoting James Mickens is always the winning move. I recommend the entire collection of his wisdom, https://mickens.seas.harvard.edu/wisdom-james-mickens
If you are a meth addict, you don't say "I'll be fine" to deal with the problem. You've got to make changes, or else you are fucked.
They collectively still emit substantially more than the US and Western Europe, and much more importantly, GHG emissions have been declining in the US and Western Europe for over two decades. In that same time period, they have done nothing but grow rapidly in China and India. All the information we have so far suggests that India will continue to grow rapidly in this regard even after China plateaus on carbon emissions.

We can play semantic games with per-capita consumption, but the fact of the matter remains that even if the entirety of the planet, except China and India, went 100% carbon neutral overnight, it would still be impossible to avoid hitting catastrophic climate change thresholds due to GHG emissions from those two countries alone.

They are both countries home to a rapidly rising broad middle class, and that middle class is going to want to enjoy the spoils of materialistic consumerism (the true root cause of human-induced climate change) just as much as our grandparents did, our parents did, and we do.
I'll bite - What's the extension?
Anybody willing to pay for it, yes. Typically tens of dollars per article or thousands/year for a subscription. It's not like scientists get any of that money though, it's just one more case of publishers squeezing scientists.
So a couple of days' worth?
Do you have some more details?
Information should be free. We subsidize scientific research to the tune of trillions of dollars—not to support to livelihood of grad students; not to create jobs in the publishing industry; but on the theory the fruit of that research has planet-wide benefits. We throw money hand-over-fist at scientific research because we view that as investing in civilization. If we believe that, and we believe research progress builds on top of other research, then the conclusion is we ought to minimize the friction of discovering other groups' research results, and maximize their availability. Make the act of research as easy and painless as possible.

Scientific research output should be free, universally, without hindrance.

It's myopic to try extract wealth from this public good by siloing it, by toll-gating access to it. Like barricading a public highway with toll-booths every 500 meters: it's a myopia that's blind to the public-good value of infrastructure—a myopia of greed that's a universal drain on public wealth, for some petty local optimization.

If you obstruct ML models on some financial profit theory, you're obstructing not only the ML entities; you're obstructing the thousand researchers downstream who stand to benefit from them. You're standing the in road blocking traffic, collecting tolls; you've not only stopped the vehicle in front of you, you've stopped a thousand more stranded behind it. It is a public nuisance.
I vaguely recall a poker tournament where a player employed this exact strategy and it worked out for him. I think it was the circumstances and just a bit of luck that allowed him to advance to later stages.
Requires state level social engineering.

Might by why north Koreans are trying to get work from home jobs.

https://www.businessinsider.com/woman-helped-north-korea-fin...
Short haul flights use proportionally more fuel per mile flown because taking off is very fuel intensive. That said, no idea what average value the GP comment is basing their numbers off of.
2023 is 37.4, which is a fair increase on 2019. More importantly the chart that matters is total CO2 in atmosphere. You can't even see 2020 on here. That was a one off 5% decrease.

Imagine if you had $1,000,0000 in your bank account and were spending $100,000 per year, except one year you spent $95,000. That's 2020.

This methane news is on top of CO2 as it has its own added impact. Proper optimism that we can do it first requires taking stock of where we actually are. So far we haven't actually displaced any carbon energy and we are at the all time highest levels of both annually emissions and also CO2 in the atmosphere.

Chart of total CO2 concentration over time: https://gml.noaa.gov/ccgg/trends/
Tell HN: I've Submitted a NYC Worker Protection Complaint Against DoorDash
I have a fulltime job but deliver in my free time to help pay living expenses. It was an act of clear aggression against delivery drivers to remove the ability to tip using a web-browser. Case closed.

What other possible motivation would there for Door Dash to remove that capability from customers other than malice against already busted out delivery drivers?

I also can't see what the benefit is! The option to tip is available after the order has already been placed on the app. So it's not like customers are going to be turned away by seeing a tip inflate the price pre-order. I really can't think of any other reason to do this but punish drivers.

Software engineers, developers, founders and the like. You're all wonderful people who build interesting products and technology for the masses, but please do something to stop the dark patterns we already see on the consumer end from spreading to the labor end. This stuff just increases the general publics hostility towards Big Tech.
Not sure if your answer is intended to be serious or sarcastic. But there is a justifiable argument for it -- you have new humans to take care of, who have needs, and the same moral claim as anyone else in the world nto address those needs using fossil fuels.

On the other hand, there's no reason to think that an increase in the number of countries is a valid excuse to increase emissions.
Bach probably brings in more money for classical musicians than most classical composers (I assume he's in the top 10-20 behind the major symphony orchestra composers), and that music definitely is "good" according to many people. He is also the inspiration for a lot of subsequent musicians. There just aren't good economics in writing more music that is Bach-like.
Has anyone built their own authentication system?
I'm building out a website (never did full stack before) and am implementing authentication. It's turning out to be more work than I expected. Is it unreasonable to implement auth yourself with JWTs? You also need to setup email sending for verification which takes more time.
Yeah that's true. Microsoft really needs to push forward with a new architecture at the core of windows. Stuff like what has happened today is inevitable under the current model where so much stuff has kernel level access. I just expected it to happen with something like anti cheat that doesn't have quite the oversight that I would assume CrowdStrike has in comparison.

Root has access to the kernel but the kernel knows everything that happens and that's my point. The kernel won't stop you from compiling a new kernel and setting it to run at the next boot. However, CrowdStrike running on Linux with eBPF for example would be able to identify and prevent such tampering without truly being in the kernel itself.

The most common way to install software on Linux is from your trusted distro repositories and from Flathub or the Snap store. Grabbing a script from the internet and piping it to a root shell is bad and something I'm sure we've all done. But take the most installed program on Windows which is likely Chrome, it really doesn't do anything differently. You download a small executable which requests admin, then it proceeds to download Chrome and install it. I'd argue grabbing a script might be the safer option because unlike installer executables from the internet, you at least have the option to read the script before running it if you choose.
> Why does anyone do them,

It's part of the culture. I write a paper. I want to get it published. Journals need someone to review it. If I refuse to peer review others' papers, then in principle people may refuse to review mine and we both lose.

Sure, it'd be nice if publishers passed some of the profits to both authors and reviewers, but that would create other perverse incentives.

> and what real care do they take when they are doing it for free?

Not much. They sometimes sit on it for months before reviewing it.
True, but if we look at GDP ratios instead of population, it looks different.

Nigeria's GDP in 2022 was $472B, compared to US's at $25.2T, so Nigeria's total economy is roughly 2% the size of the US.

Meta / Facebook made $134B in revenue and $39B in net income (profit) last year. Assuming 1/3 of their business is in the US, that's roughly $43B revenue & $13B profit in the US last year.

If we assume their business is proportionate to GDP, they made $860M revenue & $260M profit in Nigeria last year.

So this fine is basically the company's entire profit in the country in a year.
You nearly managed a perfect comment: (t)he(y)

Fair enough but if you are going to take over the world you don't crash everything, indiscriminately unless you are a really sad old school nihilist.

This is not subtle. It is so stupid that the only explanation is stupidity or a silly experiment.

The first thing I did is start to analyze my logs, just in case. I don't use CS but therefore by the Grace of God, go I!

If you have a particular target, you don't fuck up the entire world.
This looks great - I've been looking for a sustainable, cross-platform-and-vendor GPU compute solution, and the alternatives are not really great. CUDA is nvidia only, Metal is apple only, etc etc. OpenCL has been the closest match but it seems like it's on the way out.

Does anyone have real world experience using Vulkan compute shaders versus, say, OpenCL? Does Kompute make things as straightforward as it seems?
Show HN: Gothem stack – An Htmx and templ template
Hey all! I extracted out the stack of libraries I found myself using over and over for my projects in case anyone else would find them useful.

This template uses go, templ, HTMX, echo, and mage and has worked pretty well for several projects. It isn't really a framework, more a jumping off point with all the boilerplate done for a server side rendered go app.

It is still a work in progress and I would love feedback on it!
There is also another type of update: security updates that don't actually matter in the environment that the software is used in. The question of whether the "new features" are for or against the user is another point to ponder.
I got around BitLocker and booted into safe mode by setting automatic boot to safe mode via bcdedit https://blog.vladovince.com/mitigating-the-crowdstrike-outag...
In modern terms, you mean they simply weren't willing to babysit longer install frames.
Weren't they just getting better mostly because they were being scaled up? There's no way to do that once you've exhausted all of the data. Besides progress has slowed down at this point anyway.
IMO the primary responsibility should go to the hospitals & banks that crashed. I wouldn't want to live in a world where the hospitals can say "Well, we talked to McKinsey and they said CS was great" and just wash their hands of this.
Scaling Diffusion Transformers to 16B Parameters
Interesting.

At the moment it's very very slow.

I was able to eventually load and click through to see broad details about a crash.

Pretty impressive collection of data.
Finally! We've solved the problem of having to pay $30/article to get access. We'll just query the LLM!
What you're refuting isn't what I said. I'm making the point that nobody is encoding all of the individual features of the human form and reality into their models through code or model design. You build a model by making it capable of observing details and then letting it observe the details of your training data. Nobody is spending time getting the reflections in the eyeballs working well, that comes as an emergent property of a model that's able to identify and replicate that. That doesn't mean it's a black box, it means that it's built in a general way so the researchers don't need to care about every facet of reality.
Or families of those who die.
This is the result of vendor lock-in and the lesson for all businesses not to use Microsoft servers. Linux/*BSD are rock-solid and open source.
DNABERT-S came out half a year ago: seems like xBERT is still useful in genomics/DNA? https://arxiv.org/abs/2402.08777
Sure I’ll pass your email along to her and see if she wants to do that.
See here for context and explanation:

https://www.instagram.com/reel/C9kJ8o-ukLM
538 without Nate Silver is like Apple without Steve Jobs. Probably worse.
If the law rewarded people for being total jerks I would absolutely hate the law for that.

The issue isn't tolerating behavior, the issue is incentivizing it
If you want to get really scared about methane leaks, sinkholes are forming across the tundra as global warming melts the permafrost, creating gigantic methane bubbles as the previously frozen organic material now rots. Those bubbles explode once big enough, creating massive pockmarks which fill in with water.

The amount of methane they leak is estimated to be gigantic, but without full coverage we'll never know.
We have definitely experienced "boom bust cycles" since the creation of the Federal Reserve. The very first such bust was called the Great Depression.
"They've also normalized the idea of 3rd party software (even games) requiring Admin access to run..." They have? Like what?
Take off, climb and circles before landng time use considerably more fuel than that of cruising time, so that needs to be considered. Also, as short haul fights generally don't climb as high, they lose the benefits of high altitude cruising.
I've seen several merchants stop using amex because of restrictions. Admittedly those restrictions were very much in the form of excessive fees and nobody would have cared about their customer's stolen money.

Anyway, there isn't total solidarity within the credit card cartel.
The problem is too much industry consolidation into Crowdstrike as forced and regulated by the government onto numerous sectors. The answer is more diversification and self-hosting, also fewer centrally managed global services.
It's all about the game and how you play it.
-Motörhead
Disgruntled employee trying to use Crowd Strike to start a General Strike?
> Should we trade telcos?
> Nope, BGP is a great protocol used in the Internet; it would be so difficult for a single name stock to take down the global Internet.

hahaha
hahahahahaha
hahahaha
hahahahahahahahahah

this is a joke, right?

https://www.kentik.com/blog/a-brief-history-of-the-internets...