skysight-inc/HackerNews huggingface dataset:
"What Happened to Digital Resilience?"

Was there ever such a time? If so then tell me when it was.

"The latest chaos wasn’t caused by an adversary, but it provided a road map of American vulnerabilities at a critical moment."

I've no doubt that road maps of American vulnerabilities are currently being planned, roadmaped and stockpiled for future use by those who aren't on the best terms with the US.

In one way I'm amazed at how laxadasical the US and others are towards these threats and that they have not done more to harden the vulnerabilities. On the other hand, it's obvious: cost is one factor but I reckon another bigger one is 'convenience'. Hardening systems against vulnerabilities means making them less convenient/easy to use and people instantly balk against that.

Remember, this happened big-time when Microsoft introduced Windows especially Windows 95. To capture the market Microsoft made everything as easy as possible for nontechnical users—just click on something and it'd happen, things would happen with ease. And all this happened without due consideration to security.

When viruses, vulnerabilities, breaches got out of hand restrictions were introduced which meant users had less freedom to do what they'd gotten used to doing. What Microsoft did was to get the world used to slack operating procedures and efforts reign this in has met with user resistance ever since.

We're now stuck with a major problem that was easily foreseeable even before Microsoft launched Windows 95. Fixing it will be extremely difficult.
I see a distinction between economics and politics messaging. If the economics agenda is exactly the same that's all that matters to this discussion.

When every gov before him did the exact same pattern of going repeatedly goes into huge debt and uses gov social/economics projects to fix things, then the variations in their populists messaging is not really relevant.
A nurse was unable to give my wife medication while in labor because the barcode on the bag of drugs wouldn’t scan. Fortunately we just had to wait another 20 minutes to get a new bag from the pharmacy but I can easily imagine a world where doctors are unable to perform procedures they are physically capable of doing because of liability surrounding not using the computer systems as intended. Epic particularly has really done a number on the healthcare system.
Not of this kind
A researcher should not have to “try different emails”. Period. There should be a clearly disclosed email provided by the company to report such issues. Very obviously plastered. Or just use the standard abuse@, security@, infosec@, etc.

It is by far in the company’s best interests for this to happen because the alternative is public disclosure or disclosure to black hats instead.

Anything more is jumping through hoops. It should not be the researcher’s responsibility or burden to go out of their way to help a company that hasn’t done the bare minimum to welcome white hats helping them secure their own systems.
Until I saw your comment, I was imagining something like htop from the title. I guess the name makes more sense knowing it's that kind of task manager. Like a to-do list.
I'm specifically talking about security updates here. Vehicles have the same requirement with forced OTA updates. Remember, every compromised computer is just one more computer spreading malware and being used for DDOS.
Windows does do that. Crowdstrike sticks it back in at the UEFI level by the looks, because you know, "security".
I think it'll be easier to keep specifications of inputs and methods to rebuild models if need be.
Thank you, that is very useful.

In fact, the author of the website "I mapped almost every.." might want to add references to the data sources for credibility and less of a "spam" look. How about an About page.

The splash photos on that website says it all.
I’m surprised there is almost no discussion about the severity of reputational damage caused by an extremely amateur bug not expected of a prominent VC firm
The thing that gets saturated first for most at-home or cheap-VPS hosting is the low-throughput network uplink.
Which programming languages run faster in the browser?
Rust can't compile DLLs? AFAIK it can?
Just told my family yesterday that if we are ever in a real war expect everything to stop working within 8 hours. We will go back to cash and paperwork but it will be painful and slow.
> So you’d rather researchers reach out to black hats with this information instead?

That is pretty much what they did. Posting publicly about the vulnerability most certainly meant that every hacker in the world tried (and probably succeeded) at reproducing it, all before the company had enough time to act.
How can that be possible? Are drivers not binary files?
Is this a good moment to relitigate the Tanenbaum-Torvalds debate?
I’m on windows 10. Vanguard always complains about some driver that it prevents from running. (Might be fan control I think? Hard to figure out) And in addition to that it’s caused several blue screens for me. (Kernel access violations I think?) The blue screens say the error was in vgk.sys which is vanguard.
It’s not at all consistent, but when it happens it’s as I’m getting into a game, so I miss part of a match for it every time.
Just a heads up, another comment was posted here that shows right on their website's contact page a list of e-mails for contacting them.
Microsoft makes much better sense, right? Or an Apple I cant even eat.
How about references to the data sources (NHTSA as mentioned by others) for credibility and less of a "spam" look? How about an About page?

The splash photos on that website says it all.
First author here. I agree with your points, we were constrained by the format and (especially) writing style expected by the journal we're submitting to. The Methods sections contain more explicit explanations as well as other analyses.
I'm probably not the only person that hoped this was a digital archiving tool.

Apparently, a one-off record costs about $99:

https://vinylify.com/how-to-make-vinyl-online/

Using modern LDPC (or whatever error correction is most appropriate), and assuming a midrange stylus (budget ~ $99), and 100 year retention, I wonder how much data can you jam onto a 10", 2-sided record.
Smaller. No one has heard of us :)
It would be great if there were pin colors for the different types of fatalities (pedestrian, cyclist, motorcyclists, etc)
There's lot of blame to pass around, and a lot of systems to reconsider, but at least initially, the blame lies with people who had a kill switch to critical infrastructure in multiple countries, were fully aware of that fact, and yet were so careless they accidentally pulled it.
I use Thunderbird for exactly that: a local backup of webmail. But it is very, very slow if you have lots of mail (more than 800,000 messages from 25+ years).
Not GP, but the decision and reasoning is at https://public-inspection.federalregister.gov/2024-13532.pdf (I am not claiming any specific “other fears”, just linking to the source)
Stuff like this is what gives the entire security and white hat community a bad name.

1. "Surprise pentests" are illegal in the US and pretty much every jurisdiction in the world. If you are actively breaking into websites without a prior agreement, you are not doing anyone a favor. Save your efforts for companies that actually want you.

2. If the company doesn't have a published bug bounty program, they don't owe you anything. Yes they can still be nice and pay you, but they definitely won't if you disclose the vulnerability to the rest of the world without giving them a heads up and enough time to fix it.

3. "Oh I couldn't find an email address" is the worst excuse in the world. I found one after exactly 5 seconds of Googling (at the bottom of https://a16z.com/connect). And even otherwise there's Twitter, Instagram, LinkedIn and a hundred other ways to reach someone at the company if you really want to.

This is classic case of clout chasing over responsible disclosure.
> You could just as easily say "why should the onus be on the researcher to find vulnerabilities when it's A16Z's job to secure their own site". The researcher is in this to find holes and make a few bucks (which is fine!). The job is complete when you get in touch.

Presumably, the company wants to be as secure as possible. It’s in their best interest to make this process as painless as possible. A security researcher has many options for what to do with a found exploit, some far less moral than others. The company has very few, relatively. They are the ones that are limited and therefore should be doing everything in their power to ensure the best outcome, a responsible disclosure that is fixed as quickly as possible.

The best way to ensure they do this is to provide an obvious, easy to find avenue for these things. This includes reasonable, well-displayed emails (or using something like a standard abuse@, etc) and a bug bounty.

Simply put, the company is the one that should be going out of their way or else they will just have researchers either disclosing it publicly or selling the exploit for likely far more money than a bug bounty.
> I too, as the good samaritan that I am, like to stroll through my neighborhood and give all the cars and bikes I encounter a quick pentest, purely for the benefits of the owners of course.

In my neighborhood, "security researchers" can often be seen checking houses for vulnerabilities. During the day, it's usually a woman or a kid with a clipboard who knocks on front doors, checks for cameras, tests if the front door is locked, etc. I'm told they work with crews of men who will come back later to do a more thorough investigation when everyone is gone so as not to bother the homeowner.

Every night, there are other "security researchers" who test all the doors of all the cars parked on the street and in driveways. If you leave your car door unlocked just once, you'll be informed about it the next morning!

It's really something to live in these times!
How long before our evident incompetence as a profession comes back to bite us in the form of more draconian regulation about who and what is allowed to run in kernel space, or other privileged contexts, on critical infrastructure?
It is customary to add a short disclaimer when you're promoting your own product or project.
I really, sincerely don't understand that. How does an unscannable barcode prevent a doctor/nurse from administering medicine they are holding in their hands?
Windows does have that and does do that. Crowdstrike does stuff at UEFI level to install itself again.
in under 50 lines of code, no less. amazingly svelte.

https://github.com/ApexProgrammer/farm-manager-test/blob/mai...
Reverse snobbery: Signal failure? The economics of understatement (2003)
https://archive.is/mc5rb

https://host.kelley.iu.edu/riharbau/cs/index.html
It's not uncommon to give subsidies for folks that can't afford modern conveniences (free phones, food, housing). I could imagine one could give out tokens, or pay cards that are only usable for bathrooms to those who can't afford to pay for it themselves.

Not to mention a lot of us "pay it forward". I used to pay for the people behind me when crossing the Bay Bridge, or for the next person that was buying a coffee.
I got to use susestudio only for a few months and I was in love. Not sure why they killed it. There is simply nothing like that out there that I know of. Docker et al are great but susestudio did much more. I used it to create an installer for a summer course with the required tool and it just worked.
Not when you find it on first "inspect element". That really is the equivalent of looking through someone's window and seeing their bank information and credits cards just lying in full view of anyone who'd look in.
So you’d rather this happen? That is the question I asked.

Because this is explicitly what happens when a company doesn’t have a good process for accepting and responding to exploits.

The onus should entirely be on the company to invite researchers to find and report exploits in a responsible way. They are the ones at risk of losing millions of dollars over an exploit.
The XEROX Star had one in 1981. For the most part, I think you're ascribing a modern tech-focused mindset to a much different age. People played follow-the-leader once Apple had a proper HIG and successful product lines. On the heels of the Macintosh, not only did nobody care about Apple but most manufacturers were trying to sell completely different products. The idea of an improved or unified software interface was relegated to the world of third-parties up until Windows was released in-proper.
Is that a "bite"? I have wished for this for a long time.
Use about half the amount of table salt to kosher salt for a salt and rinse step. Then shoot for 2% by weight. Generally I avoid salting ferments by volume. I saw a recipe in the sibling comments.
Because they’re accepting the liability of it going wrong if they make an unusual choice to disregard the error
One thing is true about what you said: you're definitely not an expert.
Someone who can afford to pay $20/day for a bathroom pass is probably presentable enough that they can walk in and get permission to use the bathroom for free.
Basic training could've taught him how not to do YOLO global rollouts, and while the stress of this mistake will make him remember a lot, given the lack of basic knowledge that would've prevented this, this lesson will not be very valuable
The argument was that heavy metal rock bands tend to avoid names like "Sweet Strawberry Puddings for Cozy Cabins".
Yes of course company's should do that, but in the real world a lot of companies don't think to do that, especially a marketing site for a VC firm.

Any dev knows what it's like having a million responsibilities, a lot of things get put on TODO lists that never get completed. Them being owned by a wealthy company doesnt mean they have a huge dev team running 247 to handle this stuff. Which is probably why such a obvious failure even happened...

Security researchers get high and mighty extremely quickly, which is immature IMO.
If you go into a business that doesn’t have a “public” restroom leave immediately and never go back.

I don’t want to live in a world where I have to hold it, so I vote with my feet. And I assure you, that is the one thing that business owners pay attention to. If you want to make it clear you can post your reasoning on their yelp page.

I would prefer a model like Germany has where instead of paying $50M for a public toilet and then service contracts, the government pays businesses to keep their bathrooms open. $50M goes a long way at $15/hr. Businesses add slightly more staff and bathroom maintenance is just part of the job.

Sadly I am not in a position to make this policy dream a reality so I must push the upkeep cost onto the business owner.
> Rollback is hard I guess once your OS can't boot.

This is why the client needs have enough error handling to realise it's latest update has now caused unsuccessful boot and roll that update back locally to the last known good configuration (or completely back to factory and pull all updates again).
Thanks. Yeah, i, ii, and iii all talk about malicious events, not accidental.
All of the code and data will be released with the peer-reviewed published version. If I remember, I'll come back to this thread and post the link.
My understanding is this was not a case of null pointer access that could be caught by a compiler really... but of a corrupt data file making a mess all over the place... running in kernel space, where no segfault is safe.

The root issue is giving privileged access to a business entity you think you can trust, but clearly can't.

I'm a fulltime Rust developer, but I don't think Rust saves you here.
> What makes the lower number better?

~20 000 fewer people dying per year.

> I wouldn’t want the difference between 12.9 and 7.4 if it means I need to give up on driving cars

You don't need to give up driving cars. People do drive cars outside USA.

> slow inconvenient public transit

When it's done right it's more convenient than cars. I own a car and I drive under 3000 km per year because I just barely need it.

> I would also argue the US is more successful

The only metric I can think of where this is true is military, which does not seem relevant :)
If it requires a computer, why was that operationally critical computer not restored from a backup within hours after the problem started? This has nothing to do with CrowdStrike or other bugs - it could've simply failed hardware wise and the hospital should have been able to replace it immediately.
AI Is Smaller, Cheaper, and Faster. (But Not Smarter)
It doesn't. We do this all this time in rapid responses and cardiac arrest scenarios, when we can't wait for an order in the EHR; someone keeps track of the medications, doses and rough times of administration, and it's entered into the EHR later.
The use of Kimchi as a method of cultural outreach and cultural expression is really interesting (and ofc kimchi is delicious). My favorite detail is that South Korea funded development of a version of Kimchi that was appropriate for space[1].

P.s. another very Korean detail in that story is that Yi So-yeon, the first Korean astronaut, later left the program to pursue an MBA.

[1] https://www.npr.org/sections/thesalt/2016/08/22/489805398/ho...
If the panel setting was specifically for API keys, then yes, that's on apostrophecms.

If it's just some kind of generic settings with name/value pairs, then it might make sense to expose those to the browser, and make that very clear up front.
What's the finesse? How is this better than Math.random?
> accept all its adversaries already have backdoors

This is actually a really useful hypothetical standpoint to work out
security from.

Designing systems that start from the assumption of insecurity helps
us build more robust protocols and management. Qubes OS starts from
the position that all VMs are or soon will be compromised. Zero-trust
in network design assumes the bad guys already have the whole
network. Plenty out there would like to shrug and say "the endpoints
are all rotten too" (especially with phones which are a veritable hell
to secure) and move trust into the application via trusted execution
methods.

> and nothing can be done about it?

No, That doesn't follow. It's prudent to be realistic about threats.
but there's always a way out, at a cost. The cost, in a complexity
crisis, is throwing away a lot of what we've done.
What's the relevant difference?
> vs. commercial distros (in the context of RHEL/CentOS/Fedora) and they made the comment that a lot of people thought OpenSUSE was too closely aligned with the commercial product.

That's odd. Compared to Fedora I could see, but CentOS Stream is straight up RHEL beta.
Irrespective of copyright, the moral right to attribution is central in all kinds of academic research. I agree that research information should be free of paywalls but that doesn't remove concerns about proper attribution.

You can think that researchers shouldn't expect attribution either. I'd disagree, but in any case, removing that would significantly change the implicit social contract of academic research. Journal publishers and tech companies shouldn't be able to do that unilaterally.
I don't remember that. I do remember that with 2.12 and 2.15 I occasionally had to use a hex editor on disk drive-related files to make the drives work with certain hardware.

I also recall having to key-in hard drive defect tables as part of the install.
It's probably been raised before, but the CrowdStrike terms of use (https://www.crowdstrike.com/software-terms-of-use/), section 6.1, have the usual blurb on them (emphasis mine):

> Neither the software or any other Crowdstrike offerings are for use in the operation or aircraft navigation, nuclear facilities, communication systems, weapons systems, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, air traffic control, or any application OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY, or property damage. SOFTWARE USER agrees that it is SOFTWARE USER’S RESPONSIBILITY TO ENSURE SAFE USE OF SOFTWARE AND ANY OTHER CROWDSTRIKE OFFERING IN SUCH APPLICATIONS AND INSTALLATIONS.

We don't really think long and hard enough about isolation of systems, and what levels of access they actually need to be able to do their tasks. It's entirely practical to build completely isolated networks. US Government (and most major governments) operate classified networks with air gaps, network diodes and the like. We don't have to make everything actually internet accessible, while still retaining the ability to get data in to such isolated networks.
If what you say is true -- OK. Then would you say that the tweet posted earlier that showed the NULL pointer access was incorrect or misleading?
Because the law doesn't want to do its job anymore, so it created useless bureaucracy to make their lives easier and human life hell
So the problem really isn't CrowdStrike or any computer at all, but dumb policy or regulation?
The Amiga was never intended to be a business machine, it was intended to be a playstation not a PC.

Or perhaps it was more successful as a gaming machine than a business machine.
Alright then: you go to Andreessen Horowitz's website[1] and see if you can find a SINGLE email address in any of the normal places a business would list the (not-social-media) contact information. Because they did their damnedest to make sure you won't find any.

[1] https://a16z.com/
To 1% volume, like rotary meters, but not 1% mass. At least not at reasonable cost.

But you are right that regulation is the answer, although personally I think direct leak detection is more realistic than measuring gas flows accurately in a system that's already built around low accuracy metering.
I don’t think the confraternities in Nigeria are the same. At least they don’t share hostel bed spaces to students and aren’t recognized by school administrations. In most Nigerian schools, you’d actually be expelled if evidence of your membership of any of these secret organizations surface.
Yep, Netware ran entirely in Ring 0. In linux terminology it was a kernel with no user space, and NLMs were kernel modules. Very fast for file serving, but any application could crash the system. Stability was largely a result of lots of updates. NT had userspace, protected memory, etc, and a GUI for setting up TCP/IP.
Under "Key scenarios" they include "SETI@home output recorder". Ouch.
the hospital better function.

what you're saying is, if the less important service fails, of course the more important one will fail too.
Am I blind? I don't seem to find the email address at all on that page
You're approaching HN discussions in a clear, linear fashion. You can't do that. You gotta be more autistic.
> EU (Europe in general) has an enormous bureaucracy, that wants to know everything about its citizens e.g. you have to register after every move.

You are painfully uninformed. In the most charitable interpretarion of what you're mindlessly saying, at best you're talking about things like in which town you pay municipal taxes and where you vote. Neither have anything whatsoever to do with privacy.

And you are still yet to provide any substance to your personal assertion.

> Then on top of requiring the state knows, you have an expectation of privacy.

You are throwing wild unsubstantiated claims. Either you add specifics or you're just spewing disinformation.
Crowdstrike has released the detail that the bad files were configuration data.

It is their fault, not Microsoft's. The driver was fine.
CrowdStrike fail and next global IT meltdown