skysight-inc/HackerNews huggingface dataset:
> I still have no first clue what they're finding interesting about all this.

Did you ask them? I'm primarily a casual contester and POTA hunter. Most non-amateurs (and quite a few amateurs) find that boring.

> CW sounds cool, but I don't have a peer group it would impress, so: boring.

Maybe I'm misunderstanding, but does an activity have to impress a peer (or any) group to not be boring? Amateur radio as a whole is unimpressive to many (most?) people, but why should that stop you?
Sadly, if you avoid the extra steps and say "I think this will require 10 working days", some manager will reply "are you absolutely 100% sure that it couldn't be done in 9 working days?".

For some reason, calling it "10 story points" does not provoke the same instinctive response.
It seems monocultures are not only bad for resilience in agriculture, but also in IT.
Not possible in this situation, the "driver" is fine, it's a file the driver loads during startup that is bad, causing the otherwise "good" driver to crash.

Going back to an earlier version—since the driver is "good—would just re-load the same driver, loading the updated file, and then crashing again.
I once had a buddy who was sort of a generalist pro photographer. His absolute favorite type of job was the big company executive headshot day. He'd spend a bit of time setting up his setting or background, light everything well, and then just essentially have them come in like an assembly line and get their pictures taken. He'd typically get around $100 per delivered shot. Which is to say that these pictures aren't accidental; a lot of care goes into them. I'm sure that's somewhat apparent, but it might be more work than you realize.
I feel like we tried to do something similar to this and it didn't go very well.

https://www.cnn.com/americas/live-news/titanic-missing-sub-o...
I spend a fair amount of time fending off requests from our marketing team to add every tracker they can think of into our site. It's as if they don't even think about the possibility that our customers might not like that.
TFA:

> The primary factors driving the FCC’s lower rate caps is the exclusion of security and surveillance costs as well as the exclusion of commissions. [...] With today’s new rules, prison telecoms will be barred from recovering the cost of the majority of such services from ratepayers.
I think Chevron is a little different and one level higher. Courts would now rule on if price is a question of justice and reasonability.
If thats really such an issue, you can just get the browser to translate them for you?
Looks amazing! <3
Factorio – Fusion Reactor
https://infosec.exchange/@littlealex/112813425122476301

> Too funny: In 2010 McAffe caused a global IT meltdown due to a faulty update. CTO at this time was George Kurtz. Now he is CEO of #crowdstrike
> https://www.zdnet.com/article/defective-mcafee-update-causes...
Show HN: Chacha20 on Coroutines on PicoLisp
My understanding is that in Florida, even if you are found not guilty or charges are dropped etc., you are still liable for the fees. Their argument is that you were still using a bed.
Had it on my Mac a few years back and my long-lasting memory of it was how it:

a) slowed down the performance of my machine to a crawl in a NodeJS project

b) had my laptop fans spinning at full blast 24/7, even waking up the laptop overnight to do it

It was purely for compliance, but I also got the impression that it was a bloated enterprise solution for the problem.
I've had to install server antivirus onto my Linux laptop at 4 different companies. Every time it's been a pain in the ass because the the only antivirus solutions I've found for Linux assume that "this must be a file server used by Windows clients". None of them are actually useful, so I've installed them and disabled them. There, box-checking exercise done.
The ex part there is a rather important distinction :-) and there is no "general area" called Russia.
You have dozens and dozens of translation tools at your disposal that take <10 seconds to solve that problem.
I wasn’t a new grad, but was a newish industry hire (couple years experience) and experienced that several times. Before and after the dot-com crash. It wasn’t atypical before the talent competition situation we had for 5-6 years pre-Covid.

It’s a confluence of several factors now:

- lots of stories of candidate fraud floating around (either bait and switch, lying about qualifications, “over employment”, etc.)

- much higher supply of talent due to layoffs and hiring slowdowns, and hence better negotiating position for employers. Previously the FAANGs were sucking up such a huge amount of talent, it left everyone else pretty desperate.

- strategic uncertainty around future market/financial/hiring situations, so companies are being a lot more conservative with what they commit to, and wanting a more ‘secure’ fit before they pull the trigger.

Same is happening in the dating market in some ways.
Crowdstrike on Linux is only useful for appeasing corporate auditors, and making Crowdstrike money.
Technically, there are rings -1 through -3; hypervisor/-1 actually seems widely used and maybe could be used here.

https://en.wikipedia.org/wiki/Protection_ring#Miscellaneous
This regulation implements a law that was passed in direct response to a court ruling striking down the FCC’s ability to regulate in-state prison calls because there was no clear wording in the law granting them that authority. Now there is, as the law was explicitly written to grant the FCC the power a court ruled they lacked.

https://www.prisonpolicy.org/blog/2023/01/19/martha-wright-r...
It looks like a configuration file update is the culprit. The software presumably picks up the update, then BSODs.
The typical left response, if it doesn’t align with their beliefs they must be republican. If Biden’s campaign is still curious why Trump is gaining in the polls, here one reason, people are tired of the bullshit from the left.
No, I'm not surprised either. But if you're operating at this kind of scale and with this level of immediate roll-out, what I would expect are:

* A staggered process for the roll-out, so that machines that are updated check-in with some metrics that say "this new version is OK" (aka "canary deployment") and that the update is paused/rolled back if not.

* Basic smoke testing of the files before they're pushed to any customers

* Validation that the file is OK before accepting an update (via a checksum or whatever, matched against the "this update works" automated test checksums)

* Fuzz tests that broken files don't brick the machine

Literally any of the above would have saved millions and millions of dollars today.
There’s a non-trivial element behind all of this class of software, which is that humans are gonna human. Whether that’s a constant cat and mouse game in which your X number of employees are fodder who will inevitably click the wrong thing at the wrong time, or a zero-day laden worm that might be stoppable with enough eyeballs and some manner of heuristics that can automatically roll out some countermeasure.

Here on HN we generally understand technology well enough that most of us probably don’t need all these safeguards. James in accounting absolutely does, though.

There are a lot of “James in accounting”s out there, and a lot of them run or manage the companies that make the line of business software that everyone else relies on.

I’ve been studying the news coverage outside the tech sphere and the way people talk about this outage betrays exactly why software like this exists in the first place.
[dupe]

Actual article: https://news.ycombinator.com/item?id=40989276
To be honest, that might just be SeaTac on a Thursday. Everything's under construction and the late night arrivals has been crowded for a while now.
Also corporate manslaughter, in some countries: https://en.wikipedia.org/wiki/Corporate_manslaughter

This more or less originated with the unfortunately named MS Herald of Free Enterprise sinking (https://en.wikipedia.org/wiki/MS_Herald_of_Free_Enterprise) - after that incident, regulators decided that maybe they didn't want enterprise quite as free as all that, and cracked down significantly on shipping operators (though the attempt to prosecute its execs for corporate manslaughter did fail).
Playing for survival: the blind Japanese woman keeping a music tradition alive
But that is my point - you can make it unviable to go after _everybody_. But if the state is targeting one person in particular, and has a super strong motivation to break the wall, like specifically in this case of domestic terrorism/attempted political assassination, there is no technology that is gonna stop them.

In those cases that people get way with crimes, it is much more likely that there is no political motivation to go after them for whatever reason du jour. I don't think it's because the technology is so strong that they can't.
Prisons need to be run by the government and aim for rehabilitation. For-profit prisons shouldn't exist. What's the incentive for a company to rehabilitate prisoners? It'd ruin repeat business and eat into profits. :/
That page would read better if it played the tune from the Lemmings.
The great clownstrike.
> and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols.

I can, considering that you can do that from user space using strace. Or ebpf which is probably the actual right way to do this kind of thing.
Important advice since normally I'd resort to percussive maintenance way before getting to 15.
You say that, but if you're in a 10-day survival situation you'd happily have olive oil by day 3.

Maybe if you're planning for 3+ months off the grid it becomes a bad idea, but I don't think there are many scenarios where we're off the grid for 3+ months and then society comes back in any meaningful way (e.g. more than 1% of population alive, electricity again).
Fast(er)API: Optimizing Processing Time
I honestly had no idea this was the case! I assumed it was just space that "had no gravity" what you're saying makes sense though. Mind blown!
Yeah I mean when I read "for us, that meant actually putting an understanding of the codebase down in a document" I assume that's a person. For me, current AI's don't have any understanding as such.

But yeah, upon closer inspection I see in the sidebar it says "Create your own wiki - AI-generated instantly". So that clears up my confusion.
Can someone with experience explain how integration tests did not detect that?
The courts themselves have also changed. In particular, the Supreme Court has been overwhelmingly captured by one political party, and a Circuit Court that is extremely disposed towards business interests. There is every reason to think that the courts will hear cases "just because industry does not like being regulated in clear compliance with Congressional mandate".

The suit won't happen instantly, but an injunction can be granted extremely fast. That restores the status quo ante, and gives time to shop for a jurisdiction that will find in their favor. It may take years for that to work its way up to the Supreme Court, but that's to their advantage.
One prick and it's gone. Just saying...
I took a Native American studies class from my local community college. Was really, really interesting how we basically have a ton of (what I'd consider) small shadow states everywhere, each with their own rich culture and history, but with only limited sovereignty and very little visibility today. It was kinda like learning that we actually have 100 states, not 50. Like states, many tribes have their own laws and governments and economies, and run the gamut from extreme poverty to filthy rich, from no land to huge reservations (but which they rarely own outright).

It was mostly a story about US betrayals and broken treaties and genocide and forced migrations over the centuries, combined with enduring resilience that eventually turned into dual citizenship and also some of the highest rates of US Armed Forces participation. It's a part of US history that was never really discussed much in school for me, and I wish it were.
What a Friday for sys admins.
Having to pay if you're released sounds like just an accident of bad law drafting, but I'm stunned that I have watched so many prisoner TikToks, read so many undercover guard articles, and never heard of pay-to-stay laws before. It's like every prison sentence comes with a crippling fine.
TAD, Total Advertiser Death.
That's somewhat of an unenforceable policy. Encrypted content is pretty much indistinguishable from noise or interference.

And there's a ton of perfectly allowable obfuscation techniques that are good enough to secure most comms while still following the letter of the regulation. It's true, this isn't going to replace internet applications, but that's not why hams are doing this to begin with.
I don't want to buy government records, I want to pay no more than a reasonable data copying fee. I've already paid my share as a tax paying citizen.
There's no part where he apologises
Of course it’s still going to happen. Lawyers will find the most Fox News brain rotted free market conservative judge they can find and get them to take the case, just like what happened with mifepristone, and tie up every single piece of regulation because it’s cheap for them to do.

It’ll just be arbitrary regulation by whoever is least qualified to decide policy. The courts are the new regulators.
StackOverflow runs on SQL Server.
What makes them so good? Better than, say, a typical good or excellent YouTube documentary?
My ex company just moved all IT to India. Good job.
The argument being that there is not very much video footage of people turning their heads, therefore not enough data to train deep fake videos / filters.
> there's a lot of inefficiencies, which might or might not be acceptable

This is exactly what irritates us about these questions. There's no possible answer that will ever be correct "enough".
I guess they'd use a hash of the book contents, not the whole file?
I’m in the AI is very useful but horribly named camp. It is all A and no I.
"post-processing step" aka regex? :)

HN comments from a green username citing a friend who knows someone aren't the greatest source, but this sounds so believeable
The Mysterious Benedict Society
IT managers allowed an external entity to do a massive update on all their devices and servers.

I'm not saying to don't install AV or not update it, just first update system-test envs and then roll out patches gradually, not all together.
That would require effort and a change in your lifestyle. Now you can indulge your paranoid fantasies just by throwing money at it.

Mind you, I've got the same paranoid fantasies -- just because you're paranoid doesn't mean that they're not out to get you. I just don't think that I can fix them by throwing money at it. Or even by homesteading with permaculture.
Gnumeric, Libreoffice, Google Sheets, Zoho...

There are plenty of sufficient replacements for Excel if organizations are willing to work with other tools
So then your argument isn't that GraphQL is better than REST. It's that you need something specifically designed for graph based data access to handle graph based data access.

Which a REST API can do.

This argument is quite a goalpost shift from your original point: that it is easier to implement authz/access control in GraphQL than for a REST API.

An API to generate PDFs is not comparable to GraphQL, because it's not a Graph based data access API...

You're so disingenuous and unserious it's insane. This is why people hate GraphQL and it's devs: 100% of your talking points are non-sequitur copy paste arguments. It doesn't matter how much context is provided to prove what you're saying is nonsense — you'll just bulldoze right along with said nonsense anyways. It's like I'm talking with a zombie.

For the purpose of accountability I'm pointing out that so far you've:

- made an invalid comparison

- tried to elaborate on that comparison only to make several other logical errors

- goal post shifted to a totally different point than your original point after being called out

you've already pointed out that you have zero experience with JSON:API and that you can't come up with anything good to compare GraphQL with sort of demonstrates that your reasoning behind using it is not based on anything other than marketing as you have never actually used an alternative to GraphQL... Everything you've said I've only ever seen in GraphQL promo material.

So basically you got shilled and turned into a shiller.
They do develop some Windows software, so I’m sure some do.
They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553

See also: https://www.youtube.com/watch?list=PLQMQQsKgvLntZiKoELFs22Mt...
I've been working on Webwright[1] for a month after having prototyped a few different terminal solutions for a coding agents. Webwright manifests in a psuedo terminal in Powershell or terminal on MacOS.

Using Claude.AI, I determined the `ast` package would be suitable (for Python scanning), so had Webwright author a new function module to scan the project and assemble a list of functions, function calls, imports, and decorators. I then installed the function module and relaunched the app.

It produced the following as a request to explain how the system works for y'all:

WebWright uses modular function calls to handle various tasks such as user input processing, file operations, git management, and AI interactions. The main application routes commands to specific functions, which in turn perform discrete tasks like reading files, managing containers, and querying AI APIs. This architecture ensures clear separation of concerns, maintainability, and scalability while efficiently handling complex operations asynchronously.

The heavy lifting in WebWright is primarily done in the AI handlers and utility modules:

1. AI Handlers (`lib.aifunc`):

- The core AI functionality, like processing user queries and interacting with AI APIs (OpenAI, Anthropic), performs the most computationally intensive tasks.

- Managing asynchronous API calls, error handling, and processing large datasets.

2. Utility Modules:

- Modules like lib.functions.filesystem, lib.functions.git_*, and lib.functions.manage_app_container handle substantial operations such as file I/O, version control, and Docker container management.

These components shoulder the bulk of the computational and I/O work, ensuring efficient task execution and resource management.

[1] https://github.com/MittaAI/webwright
Why was there no gradual rollout of the update?
These people were talking about this 4 years ago:

https://www.reddit.com/r/crowdstrike/comments/ie8wos/sensors...

...but honestly these types of bugs have been inherent in software since day 1. We have had canary deployment models also for ages - so for this to happen tells us some things about the IT administrators of these companies that were impacted.

I don't think CrowdStrike bears much of the fault here. I recall this similar thing happening with Norton in the early 2000's and many others since then.
The entire bootcamp team is an empty chair with a note tacked on that says "brb in 15; lunch"
Global Microsoft Meltdown Tied to Bad Crowstrike Update
> Yeah I don't get where this "Linux is more secure" thing comes from.

It comes from the 1990s and early 2000s. Back then, Windows was a laughingstock from a security point of view (for instance, at one point connecting a newly installed Windows computer to the network was enough for it to be automatically invaded). Both Windows and Linux have become more secure since then.

> Basically any userspace program can read your .aws, .ssh, .kube, etc... The user based security model desktops have is the real issue. Compare that with Android and iOS for instance. No one needs anti-virus bloatware, just because apps are curated and isolated by default.

Things are getting better now, with things like flatpak getting more popular. For instance, the closed-source games running within the Steam flatpak won't have any access to my ~/.aws or ~/.ssh or ~/.kube or etc.
....how can this possibly be legal? It's not like you wanted to be there. I have a hard time seeing how it can be justified for someone who is guilty, but I absolutely can't comprehend how you could charge fees from someone who is found innocent.
> That one app doesn’t determine an entire Corporate IT strategy

It actually does in some industries, but it is dumb that it does.
I read this story many years ago where researchers were able to re-identify people using open travel datasets.

https://www.unimelb.edu.au/newsroom/news/2019/august/myki-pr...
Very sharp and to the point, this comment. I would like to add that in large companies the audit will, in my experience, very often examine documents only -- not actual configuration or code.
I’m all for government-run rehabilitation focus. I had an entire message about a capitalist stopgap, but every idea I have creates some perverse incentives.
I often wish for a way to communicate to other drivers via something that's a bit more clear than horn or blinking lights. Like one of those LED text things to say "oi mate your lights are off" or something like that.
> Reading progress, bookmarks, and annotations are stored in plain JSON files

The file is not modified.
Yeah, sure. But the marginal cost is zero, whereas a Slack subscription for every person in our org will cost about 1 million dollars a year. And it doesn’t integrate as well with every other piece of functional but mediocre software.

The person approving the $1 million dollar budget item doesn’t really care that Teams isn’t “free” in the sense that there is no free lunch, and while they perhaps have moral qualms of antitrust, that’s outside their purview. We’re locked into Office suite and right now there is no extra charge for Teams.
This was my first thought too lol "I've mind a million of those yellow veins of sulfur in NMS"
Air resistance means you only feel weightless for a few seconds on a long fall.

Indoor skydiving lets you ‘fall’ for hours, but you don’t accelerate so you don’t feel weightless.
If that can break a kernel driver and lead to a blue screen then the code in the kernel driver is shit and that means the product is shit and a liability.
* SMB encryption or signing not enforced

* NTLM/NTLMv1 enabled

* mDNS/llmnr/nbt-ns enabled

* dhcpv6 not controlled

* Privileged account doing plain LDAP (not LDAPS) binds or unencrypted FTP connections

* WPAD not controlled

* lights out interfaces not segregated from business network. Bonus points if its a supermicro which discloses the password hash to unauthenticated users as a design features.

* operational technology not segregated from information technology

* Not a windows bug, but popular on windows: 3rd party services with unquoted exe and uninstall strings, or service executable in a user-writable directory.

I remediate pentests as well as realworld intrusion events and we ALWAYS find one of these as the culprit. An oopsie happening on the public website leading to an intrusion is actually an extreme rarity. It's pretty much always email > standard user > administrator.

I understand not liking EDR or AV but the alternative seems to be just not detecting when this happens. The difference between EDR clients and non-EDR clients is that the non-EDR clients got compromised 2 years ago and only found it today.
Japan asks young people why they are not marrying amid population crisis
> Central Asia (where I actually live) does not have much to see, esp. Kazakhstan

I think this is the "I live here" bias. I've hit most stans, each is unique and worth a visit in their own ways, but I give you that a random snapshot from Almaty could have been taken anywhere in the USSR.