skysight-inc/HackerNews huggingface dataset:
Remote update is a nice way of saying remote code execution. It is really really hard to ensure that only the entity that you want to update your system, can update your system, when facing a state-funded adversary. Sometimes that state adversary might even work in concert with your OS vendor.

That's before even addressing mistakes.
I can only answer for Garage and not others. Garage is the result of the desired organization of the collective behind it: deuxfleurs. The model is that of people willing to establish a horizontal governance, with none being forced to do anything because it all works by consensus. The idea is to have an infrastructure serving the collective, not a self hosted thing that everyone has to maintain, not something in a data center because it has clear ecological impacts, but something in-between. Something that can be hosted on secon-hand machines, at home, but taking the low reliability of machines/electricity/residential internet into account. Some kind of cluster, but not the kind you find in the cloud where machines are supposed to be kind of always on, linked with high-bandwidth, low-latency network: quite the opposite actually.

deuxfleurs thought long and hard about the kind of infra this would translate to. The base came fast enough: some kind of storage, based on a standard (even de-facto only is good because it means it is proven), that would tolerate some nodes go down. The decision of doing a Dynamo-like thing to be accessed through S3 with eventual consistency made sense

So Garage is not "simply" a S3 storage system: it is a system to store blobs in an unreliable but still trusted coonsumer-grade network of passable machines.
As a solo developer of a small app its hard to find 20 unique testers who are willing to test it for 14 days. its going to cost me several times more than the cost of developing the app. just doesn’t make sense.
I'm trying to find a calculus book that goes incredibly deep into integration techniques

Still searching, so if anyone has any tips I'd love to hear
The Romans had advanced public health infrastructure, it was inadequate in preventing the spread of parasites still.
the lack of privacy at a business isn't a problem baked into cash. cash helps solve that problem because I don't need to go to a place of business to use it. It can be exchanged anywhere in reasonable amounts, and I don't have to deposit it I can just keep it and use it.

my wife and I always keep some cash on hand in case of some sort of problem with the card, or tap device etc. never had my cash declined because a computer thought some other purchases that afternoon looked suspicious.
>What gets me is that much of the OSS/Linux ecosystem consists of thousandas of lashed together piles of code written by independent and only very loosely coordinated groups, much of it code and lashed together by amateurs for free, and it is still more robust than software created by multi-billion dollar corporations.

I mostly agree, but I think that there's a delayed effect for OSS projects falling apart. Most of these projects are literally just 1 or 2 people coding in their spare time with maybe a few causal contributors. The lack of contributors working on extremely important software makes them vulnerable to bad actors (e.g. the XZ backdoor) or to the maintainers going AWOL. The upside is that it's easy for anybody to just go in and fix the issue once it's found, but the problem needs to happen first before anybody does that.
It's up to the customersthat were affected, they could sue for damages, but doubt many will do
I have mixed feelings here. On one hand, I am kinda glad marketing companies got targeted, because they deserve some taste of their own medicine. On the other hand, if being creepy is what it takes to get a job here, it's that literally selecting for creepy? That means only people with a particular mindset get to work there - which kinda makes the problem even worse?
Good timing: Study unravels how our brains track time
Recently I’ve converted some code to make an app from python to Swift.
I’ve tried using Gemini and ChatGPT.
The time I’ve spent afterwards debugging it in order to fix introduced bugs made it not worth it.

IMHO, the way this could work is only if you have very good test coverage so you can run them. But without it this can easily go off the tracks.
The author says that he can now write an article in 1/3rd of the time he used to. (as soon as he stops endlessly rephrasing the output of ChatGPT, that is.)

This is an EPOCHAL increase in productivity. We should be as excited for the future as a kid waiting for Christmas. Why aren't we?

Well, for one thing, the author is under no delusions that--since he is now 3x more productive, he will be getting 3x the income. Quite the opposite. If he is one of the lucky ones left standing, his customers will be getting 3x the value from him and paying him even less than they do now. The benefits from the extra productivity accrue to the 1%.

This is a classic example of where UBI would be so useful. Nobody would have to fear innovations which made us all more productive. It would go from the worst news possible to the best news possible.

In the early 1980's, my father was installing minicomputers into businesses all over southern indiana. Everywhere he went, about 3/4th of the clerical staff were laid off. The ones who were left told tales about how hard the transition was--everybody suddenly had to do 4x the amount of work they did before---they just had to learn how to let the computer enable them to do it.

It doesn't just sound like what programers and creators are going through now--it is exactly what programmers and creators are going through now. Thousands of well paid, white-collar jobs just nuked. And yet, 40 years later, Southern Indiana is far more prosperous than it ever was. Increases in productivity are only bad news if you don't see the benefits of that increased productivity.
I wonder what the genre of your own 'life movie' says about you? For a while I was a James Bond-type character in a spy movie, but then I became a protagonist in a Kafkaesque fantasy like The 5000 Fingers of Dr. T.
> I've seen photos of BSODs on airport monitors that show flight lists

The kiosk display terminal is not something I care about that much.

> We now have an entire industry dedicated to trying to layer security onto Windows

Too bad we have no such layering in our networks, our internet connections, or in our authentication systems.

Thinking about it another way there's actually no specific system in place to ensure your pilot does not show up drunk. We don't give them breathalyzers before the flight. We absolutely could do this even without significant disruption to current operations.

We have no need to actually do this because we've layered so many other systems on top of your pilot that they all serve as redundant checks on their state of mind and current capabilities to safely conduct the flight. These checks are broader and tend to identify a wider range of issues anyways.

This type of thinking is entirely missing at the computer network and human usability layer.
Shortened for Url
In the 20 years I've been in IT, in a variety of industries, with all the legacy manufacturing systems I've dealt with, I've never seen a software patch that blue screens all computers. Firmware, yes, rare, but never software. This is way outside of the norm.
> you'll lose most good developers if you don't allow them to evolve and have some fun along the way

That's actually something I really like about tools like GH Copilot! It gives me an excuse to try out something using a new language, but with less of the productivity dip that comes from chasing syntax or stdlib calls. It doesn't produce code that is as good as an expert in that language, but it's a really convenient set of training wheels

So it becomes easier justify, at least with my current organization
Damn it!

Shotgun it is then

Thank you for the heads up
Study shows how waste Styrofoam can be transformed into polymers for electronics
Agree, facilities such as latrines and baths likely contributed to the spread of parasites rather than mitigating it
>It's interlocked with their other services infrastructure.

then they could fucking disinterlock it from the other services and leave it in read-only mode instead of killing it.

>You can judge Google however you want, but they're not stupid or amateurs.

they are not amateurs, because an amateur would have no problem maintaining a basic bitch KV store that probably fits in RAM on a single machine
You only need to know where the person was or when crime was committed,
Pigment – colorize JSON as you wanted
Hey gophers!

I'am glad to share with you my little experiment of writing lexers, it's was such funny so i decided share the result with community :)

Meet Pigment! It may be useful for writing internal/personal scripts require showing the JSON data, when you faced with lack of flexibility of existing libs (not all support custom color themes, styling - bold, underline etc) or no need all their features (e.g. huge lib which can be colorize 20+ different data format, but you need only the one - json).

Demo: https://imgur.com/ojdMg7W
Project home: https://github.com/1buran/pigment
From this I learned about Landlock, thanks!
62 years ago.
CrowdStrike IT outage affected 8.5M Windows devices, Microsoft says
with larger corp users there is often an MSA that overrides the TOS; no idea if that's the case here, but give hospital GC benefit of the doubt re due diligence

also would be interesting if crowdstrike was installed by a reseller who specializes in healthcare / airlines, not the hospital or airline itself

waivers not always enforced, per [1]

> Courts will hold overbroad liability waivers unenforceable on public policy grounds. ... injurers routinely ignore these holdings and persist in requiring would-be plaintiffs to sign such unenforceable waivers anyway

at least one federal case in florida[2] saying advertising a product as safe doesn't defeat the EULA, but it's florida

1. https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/site...

2. https://casetext.com/case/justtech-llc-v-kaseya-us-llc
Yeah. I've (rarely) been able to pay for an item without a price sticker in cash when credit card transactions were down.
Indeed. Company should go close to bankrupty in incident like this. But CrowdStrike pays fractions.
At first glance it's authoritative, comprehensive and very readable. But then what else would you expect from John Baez?

I look foreward to reading in detail. And I don't expect to find errors (if only I were that bright). :-)
I have a kernel here https://megous.com/git/linux/log/?h=luckfox-6.10

Bootloader will be at https://xnux.eu/log/ when I get to releasing it.
Those sorts of things just need to boot to a web browser in full screen with some watchdog software in the background, launching from a read only disk (or network image). Get a problem, just unplug it and plug it back in. Make it POE based so you can easily do it automatically, stick them on a couple of distros (maybe even half on bsd, half on linux, half using chrome, half on firefox)
> According to Tenstorrent, each Tensix core features "five RISC-V baby cores," which allows scalability along with multi-chip development much more effectively.

A neat feather in RISC-V's cap. Though to be fair, RISC-V microcontrollers on PCI boards is nothing new; Nvidia's shipped their RISC-V Falcon GSP for years, and a lot of recent storage mediums rely on RISC-V microcontrollers.
You’re right but I don’t think we’re solving for the same thing.
Anything operating that low in the stack is going to be a risk if shit goes wrong. It’s essentially a untrusted third party kernel update. Any sysadmin worth a dime knows not to blindly upgrade something like a kernel without staging it first - this is no different.

But honestly windows admins don’t understand the systems they’re maintaining.. so this was inevitable.
Use whatever static site generator you like (*kyll, hugo, etc) and host it on a free static web hosting (netlify, github pages and others).
This paradox of possessing a remarkable gift while simultaneously loathing its use seems like a cosmic jest, reminding us that the universe operates with a wry smile
An automated attack would struggle to reach the level of destruction that this failure had due the scale of Crowdstrike deployment and the direct update vector and kernel mode failure. Even with the most critical type of remote vulnerability it would be difficult to achieve anything approaching this level of damage, and for all we know (and by all probabilities) this update was addressing a much less severe vulnerability.
We already have beach cleaning machines that sift the sand which are far more effective and cheaper than this.

So not sure why this is some sort of innovation…
Have you seen it actually stop anything? (I'm sure the company that made the tool used it too, right?)

If I make a WWW-wide question of "has anybody seen it?", somebody will appear. But the number of people that got a security flaw caused by those tools is huge, and the people that got stability and availability problems because of them is basically the number of people that use them.
The essence of his personality and the impact he had on you
Can you build a quantum computer for $100?
I anal so I don't really know what I am talking about but I am hoping for criminal liability as opposed to civil liability. For example, I am thinking if I kill someone with no next of kin, I still have criminal liability even if nobody from the victim's family is there to sue me.
Hundreds of years and Mediterranean you say...

It boggles my mind that Indus valley civilization had flush toilets. That would be roughly 3000~2600 B.C. Its both sad and ironic in the context of some of the poorly serviced parts of India (sanitarily speaking).

https://en.wikipedia.org/wiki/Flush_toilet#History
The Kingdom of Lydia minted gold, silver coins (2022)
Really want to get into it when reading these posts. Feels like rust killed my casual programming taste in last years.
Thomas Garrity discussing mathematical maturity [0]

Author of All the Math You Missed: But Need to Know for Graduate
School

[0] https://inv.tux.pizza/watch?v=zHU1xH6Ogs4
Putting it dispassionately, the bulk of voters have been non-plussed since Mr. Obama's Jan2009 assertion that we were "...five days from fundamentally transforming the United States of America."

And the media cheerleaders for Mr. Obama who have assured us that Mr. Trump is the #WorstEver while Mr. Biden is the GOAT stand revealed as...biased.

Stein's Law "If something cannot go on forever, it will stop."[0]

The hope is that we can get past having the decisions made by unaccountable people ensconced in unlected, Administrative State offices.

[0] https://en.m.wikipedia.org/wiki/Herbert_Stein
Do you own anything of value? What about your family?

Now let's try practicing some empathy: How would you feel if I just took that from you?
A fascinating piece of history
He’d much rather the USA just invaded it, subjugated all its people while proclaiming that it is a long held part of the post-Kennedy American empire.

Fits his narrative better.
I would assume it's legal, considering they're about to make it illegal.
The tech world has this absurd imagination that Rome is built in a day, that if we build it right they will come. Success has to be instant & exponential or it's not worthwhile.

I could not be more disgusted by this change. This attitude rules so much of what happens now. Web specs are like, oh, only 0.1% of websites use this feature after 2 years: we can ignore it. That's a huge number, and the timeframe, the expectation that either tech is adopted & loved within months or its not worthwhile is horrendous, so greatly demeans human effort & the nature of how meaning builds.

We have to get back to expecting sometimes the larger changes being slow & tectonic.
LastPass, Okta, Atlassian and SolarWinds show you can keep getting hacked repeatedly before you suffer any critical reputation damage in the market.
Douglas Adams' Starship Titanic game website (1998)
It also seems to have problems with accessibility, based on this thread - https://github.com/typst/typst/issues/133

But then again, apparently so does LaTeX
Kinda both I think, with an addition of principal agent problem. If you found a formula that provides the client with an acceptable CYA picture it is very scalable. And the model of "IT person knowledgeable in both security, modern threats and company's business" is not very scalable. The former, as we now know, is prone to catastrophic failures, but those are rare enough for a particular decision-maker to not be bothered by it.
Global CrowdStrike Outage Proves How Fragile IT Systems Have Become
I agree - and in that case I'd bet a lot of Linux and open source etc is written by professionals to some degree that's likely significant.
That stopped being true 70 years ago, and it was the withdrawal of American aid that brought Castro to power (he still pretended to care about human rights then).
Yep, at least we Android users have this option. This makes it much easier to say "eh, it's their store", when I can install anything I want on my phone.

As someone who just wrote an app so my users can use my service (https://www.deadmansswitch.net) more easily, though, I'm a bit miffed at the fact that it might be removed.
It has also has an extremely low fertility rate.
The general "not paying attention" is hard to prove.
what is the reason for this change? zig less than newbie here. I've only just recently started reading the zig overview, although I have been reading hn posts about zig with interest for some time.
The tradition of writing tests in OSS projects plays a huge role here.
Delta epsilon is just an annoying unenlightening technicality, not the essence of real analysis. Surreal numbers (infinitesimals)solve the problem more elegantly.
That just outputs a single number. I'm running a hundred dice rolls, one by one. Because you need to wait for the results, you often start rooting for/against one of the choices. And that gives you more insight and clarity than any coin toss can.
But if you're truly undecided, my app won't spit out a result that's basically 50:50 (or very very close to it), even though that's statistically most likely. Instead, the winner of those 100 rounds gets a big boost in 30 more, rigged, rounds - the winner automatically wins every other round (plus around half of the remaining rounds), giving it a considerable edge. And a choice that leads by 6-8% is more convincing than a choice that barely avoided a tie.
Let me generalize on your behalf: Cyclists are maniacs. They want to be given the equal respect of cars in traffic but absolutely don't follow the same rules.
...unfortunately.

I guess to be fair if it hadn't been TCL they would have chosen something even worse.
Results from Juukan Gorge show 47,000 years of Aboriginal heritage was destroyed
Besides which the central shelf label server is probably also down.
Oh but there are many other facinating angles.

0) The victims of identity theft didn't know or lose anything.

1) The internet was build, a truly crazy amount of code was written but you still cant conveniently use anything and prove you are you.

2) Each delivery or taxi service had its own failures. Each reinvented the wheel each with their own holes.

3) Taxi and delivery services profited from being unable to id people. The worse they did the more they profited.

4) She got to keep some of the profit.

5) The punishment is pointless as it doesn't convince people to not eat and not live anywhere. Prison is a resort by comparison.

6) And finally the failure to have this wizard do anything useful in a legal way.
Also pretty useless with mainline because it's not straightforward to get embedded ethernet phy working, even after doing pretty much what BSP code does to power it up. Access to it times out.

(That is if you want to run some code that's anywhere close to mainline Linux on this board, and not some non-maintained BSP fork.)
I would 100% be a D user if it had full C++ typesystem fluency.
> synced to the cloud but also stored on the endpoint devices and local servers

That's a recipe for a different kind of disaster. I actually used Google Keep some years ago for medical data at home — counted pills nightly, so mom could either ask me or check on her phone if she forgot to take one. Most of the time it worked fine, but the failure modes were fascinating. When it suddenly showed data from half a year ago, I gave up and switched to paper.
It's an auditor, from insurance or some financial service, with a list of 2 or 3 companies, 1 of them being famously invaded since the turn of the century (once, continually).
> I am sure Walter knows how to compile on one machine, then go to another machine and do the linking or whatever is needed.

Historically, you would or at least could get your compiler and linker from different vendors -- assembler, disassembler and other tools too. So it's normal/common for C compilers like gcc, clang, dmd to not be distributed like Zig is.

But I would dare say that the way Zig is doing it is a great model for others.

> go to another machine and do the linking

BTW - if you use something like debian/ubuntu for development, they have compilers+linkers+binutils for several different architectures available to make cross-building without Zig at least a little bit easier.
> organizations that purchased their product

I wouldn't blame the victim here. Microsoft endorses CrowdStrike's product so why would they not purchase it?

> or, the industry pressures that necessitated it

Those "industry pressures" are under Microsoft's control.

The guy who used to run Windows division at Microsoft now says: "From now, the only strategy that is not negligence is to move critical infrastructure to mobile devices." [1] Why can't Windows be just as safe as those mobile devices? It is Microsoft's fault that it isn't.

[1] https://x.com/stevesi/status/1814711163860754564
I disagree. OSS is only ahead if there is no money in it, like new programming languages. Whenever it is profitable, OSS projects just cannot compete with professionals working full time.

OSS is usually reinventing the wheel free from commercial pressures (Linux, GNU, Apache). Or they are previous commercial products (Firefox, LibreOffice, Kubernetes, Bazel).
Have a look at https://ctan.org/pkg/lwarp and https://math.nist.gov/~BMiller/LaTeXML/ .
Oh, I get it. It’s just not gonna get them anything. That ship sailed decades ago. On a policy level, all this is doing is causing harm.
> This is an area where studying Ukraine's experience will be very useful

Are they unique in any way? Or is it just yet _another_ case of Windows software being deployed in critical roles and basic 0day vulnerabilities and exploits being applied against it?

If so.. the lesson has been known for decades.

> sending teams of cyber security experts from the NSA

It's nice to know our security agencies have time for games of whack a mole.
If you pick up one knowing you can try a different one, putting it down isn't dangerous.
It may not in the short or medium term cause regime change, but sufficiently large sanctions on a country do stop it from growing in influence, wealth and power. Eventually, after some number of generations, Cuba could be so poor in comparison to the rising tide of the rest of the world, that it's not even able to defend itself or maintain government control. At some point, the disparity in power becomes overwhelming and you have super high tech society surrounding stone age cave men.