skysight-inc/HackerNews huggingface dataset:
It's super exciting. c2nim is one of the things that makes using Nim in _super_ odd places (like professional embedded firmware development) feasible, and translate-c brings Zig that much closer to what I'd love from it! Embedded Zig is going to be rad, once we get there.
> I doubt any CTO will be fired for choosing Widnows+CrowdStrike (instead of Linux/BSD)

I was personally involved in a meeting where my firm's leadership advised a client who did fire their CTO and a bunch of other people for what was ultimately putting what they thought were smart career moves over their actual responsibilities.

Unfortunately, as you did just point out, the CEO, other execs, and board are often just as incompetent as the CTO/CISO who have such shit-brained mindset.
They're low paying because (often illegal) immigrants from other countries either

A) are happy to put up with what is a luxurious salary for back home, but barely liveable locally

Or B) don't have a choice once they're in, since they practically become indentured servants

In the Netherlands, no dutchie wants to work construction for example, because immigrants from Eastern Europe often take under-the-table deals where they get paid drastically less than what a Dutchie would command, though still much higher than any job they'd get back home. The same happens everywhere.

The answer is NOT to bring the country down by mass-importing low skilled workers, but by forcing these hugely profitable companies to actually invest in the country and its citizens by paying all employees as it should.
Do you have any evidence to back that up? Everything I've seen says that they statistically commit less crime.
Monocultures die fast and without survivors.
Yea, and use of highly privileged software with the ability to update itself that the organization has no oversight of should be the most suspect. Software is used by nearly every organization for drastically different needs, and I think there will never be adequate security or reliability for any of them if software providers continue to consolidate, generalize, and retain ever more control of their offerings. Personally, I think the solution is local-first software, either open-source or grown within the organizations using them, which necessitates having that capability within orgs. The whole "buy all our infrastructure from some shady vendor" model is a recipe for disaster
I doubt you have many Mexican locals living next the the border literally walk across the border and then travel to the interior of the country. Most of them are from far away places and endure quite a challenging journey to get here. I live in San Jose in a neighborhood with many older Vietnamese boat people. Columbians have been moving in. There isn't an easy way to get from Columbia to Mexico by walking.

Crossing the Darién Gap: Migrants Risk Death on the Journey to the U.S.

https://www.cfr.org/article/crossing-darien-gap-migrants-ris...
To be clear, you blame CrowdStrike, Windows (??) but not the companies who picked this software, configured it and wrote their own internal risk policies around a kernel level piece of software?
I can see selective enforcement happening a lot. "We don’t allow apps that crash, force close, freeze, or otherwise function abnormally." feels like it might be enforced a lot more strictly for some apps than others.
Very good read, thanks for sharing it.
Side note: All the pictures have the geolocation data embedded into them.
They asked ChatGPT.
Crowdstrike is also used on Linux and MacOS devices. So by your definition, does that means they aren't considered secure either?

Crowdstrike is certainly not required for a device to be considered secure, it is a tool that uses AI and ML to detect and prevent malware, 0-day exploits and other cyber threats in real-time across endpoints.
This is a good place to start:

* https://hamel.dev/blog/posts/evals/#level-1-unit-tests

And more broadly:

* https://applied-llms.org/
Hey HN, anyone here dabbled with those AI headshot generators? My LinkedIn pic is from the Stone Age (okay, 2015) and I'm thinking of trying one of these AI headshot generators. Good idea or am I gonna end up looking like my cousin? Spill the tea on your experiences - the good, the bad, and the ugly!
If you need to have automatic updates then you need to apply risk analyses of what would happen if that system fails.

A typical solution would be to have two machines, one with the automatic updates and a second one without automatic updates that jumps in in case the first one breaks down.
> Great Backlinks

> We know how important a strong link profile is, therefore we find domains that have high quality and trustworthy backlinks.

It seems really scummy to basically steal reputation like this. Your new site doesn't deserve to have a higher Google rank just because it has the same name that some other site used to have.
> Even today, roughly 85% of the increase in human longevity, much due to decreased infant and child mortality, is attributable to general hygiene, municipal sanitation measures (both of wastes such as sewerage, solid rubbish, and of improved air quality; and of vastly improved water and food quality. Other public health measures, including quarantine, epidemiological surveillance, and vaccinations, also played a huge role.

Additionally, humanity gained a broad selection of antibiotics in the same time. Infections that used to be pretty deadly (e.g. syphilis, the plague) or debilitating (meningitis, ear infections, wound infections) are easily treatable. Even extremely deadly viral infections such as HIV or mildly deadly but highly contagious ones such as SARS-CoV-2 have symptomatic and suppression treatments.

The challenge is that bacteria evolved over the last 100-ish years just as well and a wide class of antibiotics are useless against some strains (e.g. e-coli) nowadays... and what used to be "reserve antibiotics" to be used only if a human's life was in danger is routinely fed to livestock to make it grow better, with the predictable result of resistance genes evolving in the livestock and mixing said resistance genes with bacteria prevalent in humans.
Starting your own business has always been and will always be risky, but W2 jobs aren't as safe as they once were.

How about starting a "lifestyle" business that doesn't need to grow but is sustainable, and that lets you solve a real need for real people while providing stable income?
That’s why it has to stop. It must be just that much worse for the countries losing their talent
What option would you pick if Crowdstrike found a vulnerability that could affect everyone involved?
There are far more servers running linux/bsd than there are Windows.
No idea, but housing and jobs in many sectors are getting extremely scarce in Canada's cities due to their insane immigration policies aiming to bring in """skilled workers"""
Why are some societies worse off than others, to the point where someone would need to move countries take their entitlements? Might it have something to do with what the entitled countries did to the ones that are worse off?
As someone who cleans public toilets i had to think what my expert opinion is. The deposit should be around 500 usd and it should be entirely refunded. Before engagement you should do an inspection on camera, report the issue so that the previous user can be billed excessively. If you can restore functionality, even if it is only partial you should be rewarded for it.
What do you mean? Svelte isn’t a language
You can meaningfully recreate this world today for a personal, non-work environment. For a PC, what do you really need a persistent internet connection for? If you have a Mac, create a couple of network locations, one "Offline" (all internet-connected network adaptors disabled) and another "Online." Keep a habit of leaving it at the "Offline" unless you really need to go online for something. This is what we did thirty years ago with dial-up.
Hopefully those are the first to go.

They won't be though, they make Google money from the IAP.
Yes, you should be using a separate computer for personal stuff, but you should still be calling out that spyware for what it is too.
You're absolutely right that 'skilled' is merely a relative term and ultimately a social construct. But nonetheless, the fact remains that those skills are so much more abundant and are not soaked up by existing demand (which would drive wage increases at the margin).
Not just Debian and Rocky, but RHEL too. https://access.redhat.com/solutions/7068083

I ran into this doing CentOS7 to Alma9 upgrades. The bug was in RHEL, Alma and Rocky and any other distro derived from RHEL. I had a VM go into an endless reboot cycle and the only way to get back in was to boot to an emergency rescue console and disable falcon-sensor.

The problem was something to do with eBPF, and one of the workarounds was to tell falcon sensor to use kernel mode and not auto or user (bpf) mode.

We don't allow automatic updates on hosts, however, so thankfully this was contained, but it certainly begs the question of just what testing Crowdstrike are doing.
His post does seem self-promotional I admit but Walter usually shows up in any threads about compilers and usually shares interesting comparisons and contrasts to how his language and compiler handled the issue.

For me, I appreciate the perspective and opinions of someone else in the industry with proven results. D is a major language, you can't deny that.

Maybe this post he should have went into a little more detail but I do not think he posted this with ill intent.

If anything I'm sure he would love to continue a dialog about the design decisions that led him to implement the same feature - and maybe this was his way of starting the conversation.

Given that he is a 15 year member of our community, and has earned 70k karma, we should give him the benefit of the doubt.
As someone who straddles the Austrian and Swabian ways of doing things, if I had to pinpoint the true underlying German fetish, it's one of avoiding risk. The bureaucracy and obsession with paper-based processes really do stem from that.
This is definitely their sales pitch, and most orgs (evidently) don't follow the guidance of doing EDR rollouts in staging environments first. That being said, if your security posture is at the point where not getting the latest updates from CrowdStrike quick enough is why you're getting breached, you are frankly screwed already.
Except Mexican government has a relationship with the US government and if US says 'don't do this' to Mexico there's not much upside to them going through with it.

Also maybe consider this? A substantial amount of news/rhetoric in the US revolves around US/Mexico border problems. Do you think Cuban expats want Cuba to be associated with Mexico in any way?
I don't understand why people keep bringing Microsoft into this.

This testing is the responsibility of the company whose computer fleet it is. They have many upstream software vendors - often 10s or 100s - and should be doing this testing every time. You should never rely on the vendor to test (evidently). I'd go so far as to assume all vendor updates are hostile and build your test model against that.

Automated testing of new software in companies with 10k+ desktops (which covers most affected companies here) should be as common as password policies or email attachment policies.

If the vendor implements things in a way that doesn't allow this style of testing, they don't meet security requirements and another should be found.
> Airport staff need to be able to support them.

I know of a very small airport where what is displayed over the HDMI part is essentially Firefox at fullscreen with powersaving disabled so the screen does not blank. Some of them are Intel NUC, some of them are Raspberry Pi with HSM in a box. These devices basically "boot to Firefox" with relevant credentials read off internal TPM/HSM.

Those among airport staff who do not know how to use a computer at all can get them working by just plugging them in.

> Most people know how to use a windows computer.

They know enough to open a browser.

> Most IT desktop support knows how to use and manage windows.

They know how to cope with Windows, at best.

> Finding someone who knows a BSD is not easy.

BSD is everywhere and in far more places than Windows, like almost every car sold after 2014. But you never ever see BSD because it's already-working with nothing for the end customer to do.
The norm in Germany has been to pay cash since I remember, and their acceptance of cards was always low. Did that change recently?
As this article rightly points out, people don't tend to care for why your lossy abstraction is making them out to be dead.
I tend to believe you, but it's not something that's about a lot. I would be curious to know the facts of expats coming back after a while, or a least investing in their home countries
> Nadella is a 1st gen immigrant; he brought Microsoft out of it's malaise.

I agree with most of what you posted, but not enough credit is given to Ballmer here. He set Microsoft on the trajectory that Nedella followed and got the fuck out of the way. There were a lot of cringe Ballmer moments but he had a profound impact on Microsoft, probably much more so than Nadella so far. And none of this is meant to take anything away from Nadella's competency. Just that Ballmer gets blamed for a whole lot despite setting MSFT up for the success Nadella (and shareholders) enjoy.
>> Because only Crowdstrike's Windows release was broken by them and they didn't fuck it up on the other OS. How is this Window's fault?

>First of all, whether it is actually Window's fault or not isn't the point. What matters is the perception by the general public and policy makers

Way to move the goalposts from "How is this Window's fault" to "the perception by the general public and policy makers". I don't think anyone is disputing that some people are blaming Microsoft for this. In fact the whole impetus for this comment chain is me pointing out how the public perception of microsoft being at fault doesn't match up with logic.
Efficient LaTeX Editing with Emacs
ClownStrike
From your linked piece:

"CrowdStrike has helped us develop a scalable solution that will help Microsoft’s Azure infrastructure accelerate a fix"

What if I told you that such Mag7 speak is not to be trusted, at all, even?
You’re missing the issue being resolved. This does not impact anything in code that has no errors, because that’s not the point.

The goal of annotations like this is to 1: make it harder to make the mistakes in the first place (by making it possible for the compiler to detect failures to update, etc) and 2: make it possible for the compiler to actually prevent errors even at runtime.

Again the issue is not what happens when everything is perfect, it’s what happens when everything is not.

[edit: I don’t even think you can reasonably call this syntactic sugar as it does not do any of the actual work of updating things for you, it’s literally just telling the compiler what the semantics of the object is, you still have to do everything yourself with the only exception being guaranteed bounds checks which looks to be a compiler mode dependent behavior]
Your argument is the 0.01% of cases should dictate the other 99.99%s actions?

I would pick automated testing and spread fleet deploys. There's no reason in any enterprise this should take more than 1-2 hours, which is a perfectly acceptable window of risk.
> The amount of non-LaTeX TeX users is larger than the CPython user fraction.

No way, I found no good statistic about it but I would be surprised if Cpython was under 80% of user share among python implementations.

The comments don’t have to be exactly what the article is talking about, it was just mentioning another direction typesetting could evolve. The article is about improving TeX, and someone made a comment about typst, which claims to be a LaTeX successor. Do you not see how that is relevant to the article?
Because it’s functionally impossible to deport all “illegals” without massively disrupting legal immigrant communities? How exactly do you propose the illegal immigrant gestapo determine someone is here legally? Race? Accent? Stop every brown person on the street and ask for papers…? What don’t republicans understand by this
I hear a little fantasy conversation in my head:

ooenSUSE responding to SUSE: "You know you're right, people shouldn't be capitalizing on other people's stuff. We should make up our own name instead of using SUSE's and SUSE should write their own software to sell instead of using all the gpl software developed and maintained by openSUSE contributors."

Ok not really. That is my gut reaction because I'm just like that, but in reality it seems pretty simple and reasonable to me. It's not really SUSE demanding anything.

If openSUSE want to change from being a SUSE project to having ultimate ownership of themselves, then they can't still have some other entities name, SUSE's or anyone else's.

I don't know what else anyone could ever expect. Stay under SUSEs umbrella, or don't.
Device that was sending telemetry data with Crowdstrike installed and is no longer sending telemetry data after the event time frame can be considered to be affected.

Another possible source is Crowdstike itself who definitely has the data.
There’s a very interesting question to be answered as to whether more high-quality immigrants come through legal immigration or illegal immigration.

Legal immigration is more likely to bring those you actively desire via quotas. Still illegal immigration has the advantage of raw numbers.

There’s also the question of how many 2nd/3rd generation immigrants go on to become high-quality from each group.
It's a dumb movie but that scene has stuck with me over the years.
Palliative care and interstellar journeys.
Lol. It is because many of those old "cold war" systems are still in use today.
No, cash is still very common and smaller stores still often don’t accept cards. I was just saying that it would be legal to only accept cards if you wanted to.
I wonder about the weight details and its fundamentals:

"The device weighs about 100 lbs (~45.3 kg) and can be carried by two people. The device is not operational while it is moved from one location to the next. It might be moved on and off vehicles and might be subject to rougher treatment than in a data center. While the device is running, it might be in an uncontrolled environment subject to more temperature variations and dust than a data center, such as a tent or a repurposed building." [1]

[1] https://cloud.google.com/distributed-cloud/hosted/docs/lates...
Most of the blame here falls on Crowdstrike. Both from a software standpoint that it can cause a BSOD so easily and not be able to handle something like this happening. But also whatever failure happened to let that file get out.

Some, minor, blame falls on Windows due to its ability to BSOD as easily as it does.

As far as the companies, it is a tricky situation. Many of the companies have Crowdstrike enabled and automatic updates turned on to check some audit box. They have to keep the updates going out regularly.

We are well past the point in tech that a company is solely responsible for their systems with external dependencies being the norm. Either with the shared security model with cloud services like AWS or a reliance on external API's and servers. You have to trust the vendor you are working with for whatever critically important system is going to do their job. Could you look back and say that maybe you chose the wrong vendor for a specific piece of software, but this could have happened to other vendors.

Something that I am not entirely sure of is for those audit, compliance, etc requirements can they use an alternative update method. And this is something that would be different based on each compliance, but to the best of my knowledge for security software most want you to have automatic updates.

If this was the case of all of these servers going down because of a major AWS outage would you really be saying the companies are to blame?
Yeah that is also pretty pathetic, agreed.
I suspect more.
I think the parent meant Azure DevOps which is Microsoft's jira and was completely down for the duration of this outage.
I think the major problem with Cuba is their relationship with Russia.
> It appears personal interest and profit supersedes people

The great con VCs pulled is that it was widely believed they ever had other priorities.
Let me tell you a story ... in 1999, Google was a little startup, just like we are. And when they started bringing in chefs and masseuses, we thought, "They're nuts!"

But, they were attracting the best possible people, and they were able to create the best product, and now they're worth over $400 billion.

And ... do you know the name of that company?

"Erm, ... Google"

(gets me every time!)
So my org (a random medium-sized healthcare system), with ~100k seats, was more than 1% of the devices? I don't buy it.
I would really like to explore a workstation with one of these and nothing else.

We need more diversity on the hardware side and see what we can build on it.
>We now have an entire industry dedicated to trying to layer security onto Windows -- but it still doesn't work.

What makes you think so?

How is Linux better in that area?
a lot of people here are wondering if tcl is something they should check out. tcl has some serious flaws, but some real merits as well. the best and most balanced answer to this question is https://yosefk.com/blog/i-cant-believe-im-praising-tcl.html, which explains some of the reasons i used to really enjoy tcl, before i gave it up for more capable languages

maybe the nucleus of kreinin's argument is

> So basically, pop infix languages (and I use the term in the most non-judgmental, factual way), pop infix languages are optimized for programming (duh, they are programming languages). Programming is definitions. Define a variable and it will be easy to use it, and computing hairy expressions from variables is also easy. Tcl is optimized for usage. Most of the time, users give simple commands. Command names and literal parameters are easy. If you are a sophisticated user, and you want to do pmem 0 bkpt [expr [pmem 0 pc] + 1], go ahead and do it. A bit ugly, but on the other hand, simple commands are really, really simple.

> And eventually, simple commands become all that matters for the user, because the sophisticated user grows personal shortcuts, which abstract away variables and expressions, so you end up with pmem 0 bkpt nextpc or something. Apparently, flat function calls with literal arguments is what interactive program usage is all about.

the stallman/ousterhout debate on usenet back in the 90s (from which guile sprang) may be interesting reading, but i think kreinin's post linked above has more deep insights
Yes, this is really hard.

You could get a Solarwinds type situation where the adversary has the signing keys and ability to publish to the website.

You might also find that the vendor ships a library (like libxz) as a part of their invisible or hidden supply chain, that is able to be compromised.

You might find that one of the people working at the company makes a change to the code to enable remote access by the adversary in a targeted collaboration/attack.

The problem isn't that signing key (although I could delve into the lengths you'd need to go to to keep that secret under these threat models) - the problem is what they sign. A signed end release binary or series of packages isn't going to address the software source code itself having something added, or the dependencies of it being compromised.
It's AI-generated, like anything AI-generated you should not assume it's totally accurate. I would support some kind of disclaimer if it's not already there.
Nextjs has a stripe integration template with supabase, easy for quick iterations and prototyping.
Right, which is why reasonable levels of humility and wisdom would keep an organization from expanding their mission from indexing documents to providing automated answers to questions.
Fly with Film