skysight-inc/HackerNews huggingface dataset:
> This kind of logic only works if you ignore any kind of possible nuances in the problem and just insist on throwing the baby out with the bathwater. Just because someone let you do automatic updates (or let's be real, you probably didn't give them much or an option) that doesn't mean you should do use for everything.

Oh, I agree - automatic updates are nuanced in many cases. Generally speaking, automatic updates are a good thing, but they offer trade-offs; the main trade-off is rapidly receiving security updates, at the risk of encountering new features, which can include new bugs. This is kind of a big reason why folks who buy systems should be requiring that updates offer a distinction between Security/Long Term Support, and Feature updates. It allows the person who buys the product to make an effective decision about the level of risk they want to assume from those updates.

> Automatic update of data (like virus definitions) != automatic update of code (like kernel driver)

Yep, absolutely, except for the case where the virus definitions (or security checks) are written in a language that gets interpreted in a kernel driver, presumably in languages that don't necessarily have memory safety guarantees. It really depends on how the security technology implements it's checks, and the facilities that the operating system provides for instrumentation and monitoring.
I think Americans hear that Canada has a single-payer health insurance system, and just make assumptions based upon the kinds of people that advocate single-payer here in the US. But the truth is that the US has had single-payer system my entire life, it's just that it only covers the elderly and the disabled.
words are often used precisely and correctly within their corresponding fields. often the same words are used across fields to mean different things.

"error" in observations isn't a mistake, for example.

real-time means different things in games and physical simulations.
This might be the best place to start:

https://nvidia.custhelp.com/app/answers/detail/a_id/5490/~/s...
I had a very similar experience, I was leading the selection process for our new endpoint security vendor, Crowdstrike people:
- verbally attacked/abused a selection team member
- were ranting constantly about golf with our execs
- were dismissive and just annoying throughout
- raised hell with our execs when they learned they were not going to POC, basically went through everyone of them simultaneously
- I had to get a rep kicked out of the rfp as he was constantly disrespectful

We did not pick them, and cancelled any other relashionship we had with them, in IR space by example.
Microsoft totally lets them. If you use any Enterprise version of Windows, the company can disable updates, but not the user.
CrowdStrike is an endpoint detection and response (EDR) system. It is deeply integrated into the operating system. This type of security software is very common on company-owned computers, and often have essentially root privileges.
Maybe that is relevant to home users but there's no relevance to today's outage. And if you're in a business setting I'm not sure why you wouldn't be using a domain controller and/or Entra ID and Intune to manage your Windows endpoints.
They live and die on the whims of the CIA and military industrial complex. They are a platform for delivering spy satellites that's allowed to do a bit of science as a treat.

The public, for the most part, stopped caring about NASA after the US stopped going to the moon. Most of the rest believe NASA is hiding aliens or controlling the weather or some such nonsense.
No, the companies are absolutely at fault, just like pay day lenders. Absolute leech’s on society.
I'd like to add that your company doesn't need a hero. The road to widespread catastrophic failure is long and no single person walks it in its entirety. Every employee should be able to individually take routine actions and make routine mistakes without mission failure or loss of life/limb. Preventing these things requires a mindset where your entire company is a system, and if failure isn't an option, the entire system needs to reflect that. Do your part in making a robust company, but don't tear yourself up when your company finds out that stupid is as stupid does.
Nowhere in there did I say people are judging based on how pleasant an idea sounds. Try again.
I Buy NVDA Puts
In all seriousness. I have set up several HPCs running on NVIDIA chips. They're running in my garage right now, making me about $4/hr. That is good but at the end of the day, they are commodity hardware chips like any other. Let’s look at AMD (worth 300B) for example. AMD also makes GPUs whose pure number-crunching capabilities rival those of NVIDIA. What does NVIDIA have that AMD lacks that justifies a ten times higher valuation? As of now, a proprietary software layer called CUDA. And just because most of the models driving the current AI hype cycle tend to rely on CUDA, doesn’t mean they always will.

In fact, I see stuff on Hacker News about how someone's hacked CUDA to run, with bugs, on AMD chips. So CUDA is not a true moat - it's a temporary moat. Does a temporary moat from a single proprietary driver justify a 10x valuation?

Now let’s compare NVIDIA to Apple. Is NVIDIA truly worth the NPV of all future Apple's cash flows? Think all future iPhone sales, their 30% app store tax, unbelievable balance sheet goodwill. The 20B check they receive from google every year in exchange for one line of the iOS Safari source code. Billions of high-income users in developed countries. An entire subculture of girls who will simply not reply to green texts.

What about Microsoft? Microsoft has an anticompetitive chokehold over B2B the likes of which the world has never seen. Our company, for example, couldn't leave Microsoft if we tried. The MSR team alone spends $50k monthly on cloud compute. We're paying Microsoft $600/mo for a machine I could build for $90. The entire financial ecosystem is built on the back of MSSQL and Excel. We're talking tens of trillions of USD flowing through Microsoft software every single day. European regulators look down upon anything non-Microsoft (with the occasional pity regulation favoring SAP).

And what has NVIDIA given us? The commodity hardware to train a bunch of chatbots that offer a 1.5x productivity boost to a few very specific sectors of the economy. Are they going to change anyone's life? No. Self-driving cars? At least a decade out. NVIDIA chips are nothing but super fast pocket calculators. They are not the step function for human computation that the market wants them to be.

And finally why am I right? Because I have experience working with NVIDIA hardware and software with my own two hands, unlike 99% of the institutional investor base who probably bases their opinions off of analyst drivel not unlike what you’re reading right now.

So I buy NVIDIA puts on a regular schedule because I think there's some serious tail bubble risk of NVIDIA bringing down the entire SPX. It's like health insurance premium without a deductible. And that's financial advice.
I've definitely experienced the floor dropping out from under me feeling in the half minute of realization that I just blew something up, but really it's mostly just the first drop of a rollercoaster feeling then the anxiety is gone and it's time to fix things.
The Vajra theme is cool—love the cosmic vibe and the dark blue. It really fits the deep discussion vibe of the site. Should definitely be the default.
Sounds great for data consistency.
They should change their name to "IT CrowdStrike"
I pushed a one-character fix and broke it a second time
I used to work in healthcare IT. Running a code is not always only CPR.

Different medications may be pushed (injected into the patient) to help stabilize them. These medications are recorded via a bar code and added to the patients chart in Epic. Epic is the source of truth for the current state of the patient. So if that is suddenly unavailable that is a big problem.
Several groups doubted the results such as Threat Connect and Ukraine's military:

https://threatconnect.com/resource/webinar-guccifer-2-0-the-...

https://www.voanews.com/a/crowdstrike-comey-russia-hack-dnc-...
> (3) hopefully project something interesting back down to the problem you actually care about.

Indeed, and this is the step that standard mathematicians tend to balk at.
Fwiw this is not typical, we don’t have alexa/siri type smart devices in any OR I work in, and suction is turned on off with a button and a dial.
Wait, does this mean if all your machines had Windows and Crowdstike installed, and you had no backups off site, all your data would essentially be wiped out?
Wife is a nurse. They eventually go 2 computers working for her unit. I don't think it impacted patients already being treated, but they couldn't get surgeries scheduled and no charting was being done. Some of the other floors were in complete shambles.
> Again, you’re making a strong claim based on limited evidence which is the hallmark of bad reasoning

I read back through my posts to find the claim I made that you’re talking about and I can’t find it. Please let me know what you’re talking about, maybe quote it. I’m gathering this has mostly become a troll at this point, and I’m sorry I kept responding.
There's a workaround: reboot 10-15 times. I've seen two people say it independently, so maybe it's for real.
You're depressed.

You pulled a 'geographical' and it did what those do, and you're back where you started.

Start by talking to your Doctor.
Also very often software quality is absolute trash... With so many issues developers spend no time on thinking about most basic things... Like applying access control on reading/editing data or what field should a request update and what not...

And these parts are the simple ones. Not even talking about operating systems, networking and so on... If even easy stuff is wrong, what hope is there for complex...
You can accomplish better thermal mass?
So how do you actually cybersecure a company in a compliant and practical way?
So it even has Raspberry-Pi-like availability? They really thought of everything!
> In American criminal law, the term "innocent" is not a verdict that a jury can return. Instead, the only possible verdicts are "guilty" or "not guilty". No one can declare you innocent because new evidence may come up later finding you guilty.

As the person to whom you responded said, there is such a thing as a determination of factual innocence. See, for example, the relevant section of Utah's legal code: https://le.utah.gov/xcode/Title78B/Chapter9/78B-9-P4.html . I can't see at a glance whether a jury or only a judge can grant such a petition, but, even if a jury can't return such a verdict, that's different from saying "no one can declare you innocent."
Many systems are fault tolerant, and many systems can be made fault tolerant. But once you drift into a level of complexity spawned by many levels of dependencies, it definitely becomes more difficult for system A to understand the threats from system B and so on.
true, got some insights why this happened https://medium.com/@confusedcyberwarrior/when-security-becom..., but how they didn't had an update process like testing or QA?
I blame Microsoft in the larger sense; they still allow kernel extensions for use cases that Apple has shown could be moved outside the kernel.
You mean … the same court and judge that imposed the fee in the first place?
No rolling updates? How could a 100% repro BSOD pass QC? I'm more concerned about the deployment process than the crash itself. Everyone experiences a bad build from time to time. How did this possibly go live?
HaaS – Heavenbanning as a Service
> Why did they feel that they needed kernel level interventions on Windows devices specifically?

Maybe because everyone else in "security" and DRM does it, so they figured this is how it's done and they should do it too?

My prior on competence of "cybersecurity" companies is very, very low.
On the plus side this will help us develop an immune system against cyber attacks in any future war. Businesses will start thinking of contingencies.
At ring 0 I assume. Not that it would matter, I imagine privesc would be fairly trivial.
That’s exactly how macOS works (except it’s not a physical switch). You can disable SIP if you have hardware access to a machine.
I thought SpaceX took over that role.
> I like to view artists as mediums that can channel and manifest art, but that art stands on its own. Bach just happened to be the one in our lifetime to do that with what he discovered. — The strongest evidence to me for this is that art can outlast the artist every single time.

> I like to think music exists beyond humans and humanity. Maybe far out there in the galaxy or in some other dimension not yet seen. Not exclusive to us, not an anthropological view, maybe spiritual.

I write about this very frequently. I have a strong interest in Art and aesthetics, and play guitar, and write poetry. I'm going to try to not post an essay, which is hard, but
I could talk about this for days and am open to any others that want to talk about music and art.

I think I mostly agree with these quotes.

I specifically think that Art is so transcended from humanity it escapes it, it escapes the emotions, it
escapes the day to day. One might be emotional about it, but emotional intent isn't a part of it
since Art is beyond emotion, and thus also the communication of emotion.

If you want a good definition for what I think of as Art, read Zarathustra. My thoughts on overcoming
are similar as to do with Art. Which is, is it something we can really achieve? Or is the intention
enough to make it? And if so, how much intention is needed?

However I will leave you with something else about Art, something that I think is more closely to how
we most of the time experience music.

John Dewey describes Art as the relationship between the artist, the medium, and the audience. All
three are needed for it to be Art.

When you go see a live show, one with skilled musicians which are able to improv (playing with modal changes,
and knowing how to build and release tension without thought), you get something new, an experience, that only
exists in that moment. That experience cannot be captured, the audio can, even video of the audience and
performers can, but that experience only exists during that improv, it will never happen again. And in my
opinion that is the closest thing to Art, not only for music, but for other traditional art forms as well.

> The fact we channel it to express our emotions is incredible...

This conflicts with my first definition of Art (Platonic) but sits nicely with the second definition (John Dewey).
There is something inescapable communicated listening to Pavarotti, but there's also something inescapable being
communicated listening to Grant Green. Two completely different forms of music, communicating different things,
but it's still very human and powerful.
Hello, IT, have you tried turning it on and off again 15 times?

Seriously though - this entire outage is the poster child for why you NEVER have software that updates without explicit permission from a sysadmin. If I were in congress, I would make it illegal, it's an obvious national security issue.
Except the overhead bins only got cluttered in the first place because capitalists took something that was usually included, a checked bag, and charged $50 for it, so now passenger planes fly with pretty underfilled cargo areas and overstuffed overhead compartments that make it take 2x as long to board and deboard the plane.

So yeah, inventing a problem where there wasn't one and selling a solution IS actually the capitalist playbook.

FYI, the low cost airlines in the US are actually in a business crisis right now, because their cost per seat mile has doubled and none of them are really making a profit, while the legacy carriers are making reasonable profit. So expect some truly offensive bullshit from "low cost" carriers to offset their bad business decisions.

They doubled their fleet size but now each plane is flying fewer hours per day, and wouldn't you know that's bad for an airline, from an economics perspective.
That's probably only the part they had the hard proof for.

Also, the press release[1] says:

> between 2018 and 2022, Senator Menendez and his wife engaged in a corrupt relationship with Wael Hana, Jose Uribe, and Fred Daibes – three New Jersey businessmen who collectively paid hundreds of thousands of dollars of bribes, including cash, gold, a Mercedes Benz, and other things of value

and later:

> Over $480,000 in cash — much of it stuffed into envelopes and hidden in clothing, closets, and a safe — was discovered in the home, as well as over $70,000 in cash in NADINE MENENDEZ’s safe deposit box, which was also searched pursuant to a separate search warrant

This seems to be more than $120K over 4 years. Of course, not all of the cash found may be result of those bribes, but likely at least some of it is.

[1] https://www.justice.gov/usao-sdny/pr/us-senator-robert-menen...
Sure, I just answered on the question if the person visited Crimea will be jailed in Ukraine.
is there an ELI5 on how can this happen? Like i get its a boot loop, but what did crowdstrike do that cause it? How can non malicious code trigger boot loop?
Evolve Your Software Architecture
Was that investment outside fundamental investment theory?
You can use MJML - https://mjml.io/ - which abstracts away a lot of the ugliness and Outlook hacks.
What does the cooling look like on this? Guessing it's not suitable for full passive?
I mean, this is every antivirus software. "Let's run some antivirus vendor's code on your system that opens literally every file on your system, regardless of how it got there."

Yeah, that's a great idea and not at all a huge attack vector.
Prolog was never good at the things they thought it would be at, like AI, which is better done by ML today, specifically often like you said, with NNs. But it turned out to be good for other things, and those use cases are still alive today, even though there are many competitors. Look at Tiobe index, Prolog's usage is constant just under 1 percent, and has been for decades. So it's good for something.
So whats the alternative? Have no endpoint protection? Have nothing in place to warn you when malware ends up in your system?

(Just playing devils advocate. I hate Crowdstrike as much as anyone here :)
“The best way to predict the future is to create it.”
When you say "sips power", what exactly do you mean?

I've been watching for an SBC you could use to make something like a TRS-80 Model 100. They ran off 4-AA batteries and would get you 20 hours of continuous use. That translated to at least a week of real world use (you wouldn't want to be typing on one for 4 hours a day...)

That was in 1983. Today, it seems like you should be able to make something similar that will run for weeks or months on AA batteries.
how come does anyone still use crowdstrike?
ALEXA, TURN OFF THE SUCTION! ALEXA!!

“Loive from NPR news in Washington“
Me too) Already bought $200, $400 and $800 puts, all expired worthless :)
Ukrainians should pray to USSR because of active Stalin times ukrainization.
My suspicion is, the same would work with Gödel, Escher, Bach in Silicon Valley circles.

"It's such a profound book with incredibly deep, life-changing insights about the hidden connections and symmetries of the universe. I really should read it some time."
I can't imagine why any critical system is connected to the internet at all. It never made sense to me. Wifi should not be present on any critical system board and ethernet plugged in only when needed for maintenance.

This should be the standard for any life sustaining or surgical systems, and any critical weapons systems.
I’m curious which direction the etymology goes. Often what starts out as an innocuous descriptive word gets negatively charged over time, for example “retard”.

Were the plants really named after a word for nonbelievers? Or is there a common root for both. For example if it started as a regional term it could have evolved into a slur.

I’m not opposed to the change, I just find it interesting/amusing from a cultural perspective if the euphemism treadmill is now extending to plants.
Not entirely, I don't think.
Playing guitar tablatures in Rust
Ask my engineers...Dell and Lenovo laptops crashing due to thermal issues while using CAD...graphics driver updates causing crashes. I think we've worked those out but those are some recent examples. For vanilla office users I agree it's comparatively uncommon.

But we're not talking about isolated Windows crashes. We're talking about the impact of a single update to low-level software rolled out to thousands of critical systems as a security compliance checkbox-filling measure. No regulation, no oversight. I'm not calling for Joey Highschooler to need a government-issued license to hack on his SaaS, I'm saying that all components of critical infrastructure should be subject to engineering best practices, including software engineering and software management.
> Available MicroLED screens (TVs) are in fact brighter than normal screens.

Does that in any way contradict the claim that there are large variations in brightness between microLED pixels on the same screen?
Highly recommend Julian's whole blog, The Egg and the Rock, which others have linked to on this page.

It's mostly about a theory of the cosmos which I think he calls "evolved-physics holism". This post is a good place to start:

https://theeggandtherock.com/p/in-which-i-tell-you-about-my-...

It will change the way you think about the universe (and not every blog does that :). He is great at weaving compelling visions of strange phenomena occurring at vastly different scales from our human one, eons before the present time, in galaxies far, far away. Which is something science desperately needs!
> shows the data/code update separation does not prevent problems.

Sure they do? This is like saying seatbelts don't prevent injuries because people still die even while wearing them.

I never said that one weird trick would solve every problem, or even this particular one for that matter. What I was saying was that if you look for ways to add nuance... you can find better solutions than if you throw the baby out with the bathwater. I just gave two examples of how you could do that in this problem space. That doesn't mean those are the only two things you can do, or that either would've single handedly solved this problem.

The problem in your scenario is that kernel mode behavior is being auto updated globally (via data or code is irrelevant), and that should require a damn high bar. You don't do it just because you can. There's got to be a lower bar for user mode updates than kernel, etc.
Most corporate places I've encountered over the last N years mandate one kind of antivirus/spyware combo or another on every corporate computer. So it'd be pretty much every major workplace.
> /// BAD: This mutates `input`, which may be unexpected by the caller.

> [...]

> /// GOOD: `input` is preserved and a new object is created for the output.

Neither of these are good or bad without knowing their context and understanding their tradeoffs. In particular, sometimes you want to mutate an existing object instead of duplicating it, especially if it's a big object that takes awhile to duplicate.
I've been trialling application allowlisting, but wow is it ever frustrating. So much stuff isn't signed, and when it is the accompanying DLLs aren't. or the signature is invalid. or some of Windows' own executables/dlls aren't signed (why?? you make applocker??) or the installer is, but none of the actual resultant end files

Is it just me?
No, after the fact. Where's the prompt at boot-time which asks you if you want to load yesterday's known-good state, or today's recently-updated state?

It's missing because users are not to be trusted with such things, and that's a philosophy with harmful consequences.
Does this mean a computer without internet access and with CrowdStrike would be unable to start up?