skysight-inc/HackerNews huggingface dataset:
This is like anything other large installation process. You provide a sensible default and an option to just go with defaults vs. being presented with options. This keeps people who want an express process happy while allowing others more customization. Win-win.
https://github.com/NVIDIA/cccl
Because a security software shouldn't be able to cause a kernel panic, but if it can, then the kernel component should be rock solid.
Security patches, assuming it has some network access.
I think the Linux market is far too fragmented for this kind of thing. I usually wait a few days before applying any updates, and definitely don't do them when I have something important coming up.
The same cosmic radiation that flips the bits to make some specific political party win.
Another department in the corporation is probably accessing PII, so corporate IT installed the security software on every Windows PC. Special cases cost money to manage, so centrally managed PCs are all treated the same.
For me, not using a debugger is kind of like not using valgrind. If you stop operating on memory directly, you forget you ever needed valgrind. Likewise, if you write functions instead of methods, then you can just take the problematic input, and evaluate your function on it, and inspect the output - without needing to get the whole program into the right state for stepping through.

I kind of gave up on step-through right around the same time I started writing multithreaded code as well.
Nearly all of Bangladesh is offline
This thread has multiple anecdotes of the same happening on their Linux version earlier.
Microsoft has routinely changed the display driver model, breaking backward compatibility. They've also barred print drivers.
If you check the issue[1] he reported the crash on November 7th and reported the issue is related to gcc and the kernel on November 8th. At least he was very quick going through the rabbit hole.

[1]: https://github.com/prometheus/node_exporter/issues/730
"Never Update Anything"

Author proceeds to add to two updates to the article, epic troll.
"Weird thing is cut the hot water during the summer."

That's probably for the pipe maintenance. Even now in Russia the hot water gets cut off for a couple of weeks.
We really don’t need innovation in every corner of our lives. It could have just stayed as normal landlines phones with a fix cost paid by the prisons.

I don’t think the free market has a ton to offer for basic services that should be guaranteed.

Look at American internet, plenty of supposed options but terrible rates and performances compared to Europe. Yes we’re more spread out but that doesn’t begin to explain service sucking in a city with limited options.
Now things are serious: I can't place a mobile order at Starbucks.
Yeah, I'd need to figure it out properly, but for unicode text files it should be OK. Good point about the binaries though, thank you!
Segue: What the heck is about Windows files and null characters? I've been almost exclusively dealing with POSIX file systems for the last 30 years, but I'm currently shipping a cross-platform app and a lot of my Windows users are encountering corrupted files which exhibit a bunch of NULs in random places in the file. I've added ugly hacks to deal with them but it'd be nice to get down to root causes. Is there a handy list of things that are safe on POSIX but not on Windows so I can figure out what I'm doing wrong?

I'm at the stage where I'm thinking "%$#@ this, I'm never going to write to the Windows file system again, I'm just going to create an SQLite DB and write to that instead". Will that fix my problems?
This might be true for low-cost airlines, but is it for the traditional ones?

I recall times where checked luggage was included in the air fare, but people would still fill up the overhead space, as it was simply more convenient (and quicker) to have your luggage with you, instead of having to wait for your checked luggage to show up 10-40 Minutes after leaving the plane.

Oh the good old days of flying in to Tegel (Berlin), time from the Gate to the Taxi? Approximately 3 Minutes.

Nowadays, it seems everything goes extra, as that allows airlines to list first on any of the travel portals where people buy their flights nowadays.
I imagine the flight planning software they use was affected (so their ability to coordinate with other airport's ATC), but not their radio systems or aircraft radar (nearly all radar systems I've worked with are run on Linux, and are hardened to the Nth degree). Been out of the game for 12 years though, so things have likely changed.
Don't forget, the telecom operators usually send large amounts of money in kickbacks to the prison in exchange for the 'privilege' to run these systems.

While Prisoners have no expectations of privacy, most do not know that all of their calls are listened to, transcribed, and shared with prison officials. There is some speech-to-text sentiment analysis that will prioritize a call that has certain phrases spoken.

It's just...a mess.

When I was a public defender, I had prosecutors and jail staff hint to me about things that were said during the calls. A few years later, they had to drop the charges in a few cases because it was discovered and reported that the calls between attorneys and clients were being monitored and recorded.
It's still crazy that a security tool does not validate content files it loads from disk that get regularly updated. Clearly fuzzing was not a priority either.
There's a claim over on Mastodon from Kevin Beaumont that the file is different on every customer he´s received the file from.

https://cyberplace.social/@GossiTheDog/112812454405913406

(scroll down a little)
It's not really up to the companies. In this day and age, everyone is a target for ransomware, so every company with common sense holds insurance against a ransomware attack. One of the requirements of the insurance is that you have to have monitoring software like Crowdstrike installed on all company machines. The company I work for fortunately doesn't use Crowdstrike, but we use something similar called SentinelOne. It's very difficult to remove, and it's a fireable offense if you manage to.
I've got a Sony Xperia phone from last year. It's got a headphone jack and sdcard slot, waterproof, latest chipset etc. Plus a very close to vanilla Android. Yet they sold so few that Sony are pulling out of the US phone market. It seems to me that folks who say they want those things don't actually want them that much.
Don’t mess with Quebec :D
> 3. The government is surprised with the outcome.

No, they are not.

We keep giving officials a pass by making their malicious behavior out to be incompetence. The entire goal of the prison system in the USA is to extract as much money out of each prisoner from the tax payers, the prisoners, and the prisoner's families.
Which suggests the question: What's the current state of "fuzz testing" within the Crowdstrike dev org?
Oh boy. We technically got rid of slavery after the Civil War but in actual practice the line is quite blurry. Joseph Stiglitz made a really good point about freedom when analyzed through an economic lens. You can't just talk about political freedom but also the opportunity set as afforded to you by your economic status. Even if you have political freedom but only one choice, that freedom isn't much use.
But my attention span! Nooo!
There's also fapolicyd as well, but the problem is these rule sets are often updated automatically by the package installation manager such as RPM. So while this can stop rogue binaries from running in unapproved locations anyone who has access to the box to install a rogue binary and have it run at elevated permissions would be able to install a package with the package manager. Most of the default rule sets trust things that are installed with the package manager in order to make the operating system usable.
> If crowdsource QA department is all that stands between you and days of no operations ...

For companies of a certain large size, I guess. For all but the largest companies, though, there's no choice but to outsource software risks to software manufacturers. The idea that every company is going to shoulder the burden of maintaining their own software is ridiculous. Companies use off-the-shelf software because it makes good financial sense.

> And if you cannot actually abandon someone like microsoft that consistantly screws up their QA then it's basically dishonest for you to claim that reliability is even a concern for your desktop platform.

When a company has significant software assets tied to a Microsoft platform there's no alternative. A company is going to use the software that best-suits their needs. Platform is a consideration, however I've never seen it be the dominant consideration.

Today's issue isn't a Microsoft problem. The blame rests squarely on Crowdstrike and their inability to do QA. The culture of allowing "security software" to automatically update is bad, but Crowdstrike threw the lit match into that tinderbox by pushing out this update globally.

As another comment points out, Microsoft has good tools for rolling update releases for corporate environments. They're not perfect but they're not terrible either.

> It's might not be as easy as just deploying the same old platform ...

When a company doesn't control their software platform they don't have this choice. Off-the-shelf software is going to dictate this.

In some fantasy world where every application is web-based and legacy code is all gone maybe that's a possibility. I have yet to work in that environment. Companies aren't maintaining the "wintel desktop" because they want to.
Yes, this fits in with what I heard on the grapevine about this bug from a friend who knows someone working for Crowdstrike. The bug had been sitting there in the kernel driver for years before being triggered by this flawed data, which actually was added in a post-processing step of the configuration update - after it had been tested but before being copied to their update servers for clients to obtain.

Apparently, Crowdstrike's test setup was fine for this configuration data itself, but they didn't catch it before it was sent out in production, as they were testing the wrong thing. Hopefully they own up to this, and explain what they're going to do to prevent another global-impact process failure, in whatever post-mortem writeup they may release.
I am sorry but I don't really understand what you are arguing for.

I can see what you are arguing against: it's the unchecked autoupdate policy for updating critical software. The problem here is that almost nobody does that anymore, specially because of the overhead this caused across the industry. To replace the overhead, there are contracts in place that if a supplier messes up they will be held financially accountable. It's called SLA.

Now, as for virus protection: AFAIK nobody ever gated AV updates. OS updates, yes, OS upgrades, even more so. But AV? Not to my knowledge.

What you seem to be arguing for is unrealistic. Consider a 0-day exploit, being frantically pushed by AV vendors to fight against, but the IT fails to gate the update in time. Time and time again the autoupdate saved our collective a*es.

The IT managers are definitely held accountable, so they will definitely insist on NOT gating updates.

The Crowdstrike should be held accountable for this fiasco and not the individuals, that manage each and every company's IT infrastructure. If the said company survives this, that is then a failure of our companies' leadership.
It's crazy if they weren't signing and verifying downloads
'No education, just liberation ' – Béla Tarr on film and politics in Hungary
It's not unnecessary, it's harder (no stable kernel ABI, and servers won't touch DKMS with a ten foot pole).

On the other hand you might say that lack of stable kernel ABI is what begot ebpf, and that Microsoft is paying for the legacy of allowing whatever (from random drivers to font rendering) to run in kernel mode.
HN has pagination plus it could be just a bug...
Agree. The monoculture simply accelerates the infection because there are no sizable natural barriers to stop it.

Windows and even Intel must take some blame, because in this day and age of vPro on the board and rollbacks built into the OS it's incredible that there is no "last known good" procedure to boot into the most recent successfully booted environment (didnt NT have this 30 years ago?), or remotely recover the system. I pity the IT staff that are going to have to talk Bob in Accounting through bitlocker and some sys file, times 1000s.

IT get some blame, because this notion that an update from a third party can reach past the logical gatekeeping function that IT provides, directly into their estate, and change things, is unconscionable. Why dont the PCs update from a local mirror that IT has that has been through canary testing? Do we trust vendors that much now?

Poor Crowdstrike. This might be the end for them.
A lot of assumptions here that probably aren't worth making without more info -- For example it could certainly be the case that there was a "real" file that worked and the bug was in the "upload verified artifact to CDN code" or something, at which point it passes a lot of things before the failure.

We don't have the answers, but I'm not in a rush to assume that they don't test anything they put out at all on Windows.
Not to mention the radical cost of living adjustment, renting some hole in the wall just to squeak by.
Explain joke please
> legitimate marketing emails

I don't think there is such a thing.
And, another problem, if I may: This, too will be soon forgotten. Our "attention cycle" is too short.-

(Look all the recent, severe supply chain attacks by state actors, and how soon they have been displaced off-focus ...)
Awesome work! I hope more design happens for Linux ;) designing the user experience and integrations seems like a key part of making it feel like a consumer desktop!
Is there a way to estimate number of affected devices? 10 million? 100 million?
I have dealt with an apple upgrade that ignored free disk space and let users continue to upgrade eventually filling up the drive. This will happen with any company with humans that can make mistakes. And apple suffers from horrible ui issues also. Most users just tend to ignore them. On Macos, activate mission control and try to lock the screen with the keyboard shortcut.
> a little scripting language built-in to the OS

MacOS has something like this: https://en.wikipedia.org/wiki/AppleScript#Basic_concepts You can send around events and macro/script GUI stuff.
That is how all of these tools are. I have always told people that third-party virus scanners are just viruses that we are ok with having. They slow down our computers, reduce our security, many of them have keyloggers in them (to detect other keyloggers). We just trust them more than we trust unknown ones so we give it over to them.

CloudStrike is a little broader of course. But yeah, its a rootkit that we trust to protect us from other rootkits. Its like fighting fire with fire.
That’s my experience as an unfortunate user of a PC as a software engineer in an org where every PC was mandated to install crowdstrike. Fortune 1000.

It ran amok of every PC it was installed to. Nobody could tell exactly what it did, or why.

Engineering management attempted to argue against it. This resulted in quite public discourse which made the incompetence of the relevant parties in it-management related to it’s implementation obvious.

Not _negligently_ incompetent. Just incompetent enough that it was obvious they did not understand the system they administered from any set of core principles.

It was also obvious it was implemented only because ”it was a product you could buy to implement cybersecurity”. What this actually meant from systems architecture point of view was apparently irrelevant.

One could argue the only task of IT management is to act as a dumb middleman between the budget and service providers. So if it’s acceptable it managers don’t actually need to know anything of computers, then the claim of incompetence can of course be dropped.
Sony Xperia phones have this combination, including the just released version. Just nobody buys them.
Not that it changes your point, and I could be wrong, but I'm pretty sure eBPF bytecode is typically compiled to native code by the kernel and runs in kernel mode with full privileges. Its safety properties entirely depend on the verifier not having bugs.
Check out this search tool: https://www.gsmarena.com/search.php3

It's a great resource to find a new phone by feature set.
Crowdstrike can run on Linux and some companies mandate it, with similar issues...
So if we want our technology to be more reliable, we need to make its current unreliability into an existential threat to certain people?

I mean, it already is to some people, as shown elsewhere in this thread. Seems like it's the wrong people though.
Poll: The first Crowdstrike disaster of 2024 - Ignorance or Malice?
Given that the CrowdStrike file that broke everything was full of null characters (https://news.ycombinator.com/item?id=41009740) is this an accident or a maligned actor with some sort of financial incentives?
You're not thinking big enough. Why do we even need so many people in prison?

The staff in prisons are never motivated to run any kind of real rehabilitation programs, and worthwhile ones are incredibly rare. They get the press when you see a prisoner learning AutoCAD or something, but there are so few slots for something like that, while everyone else does bullshit classes where they ask you what you should do when you find a wallet in the street and then make you color some pages with crayons (really).
For most part, you completely understood my situation. As far as product is concerned, I spoke with those people who would be actually using it not the decision makers. Implementing the product is in the hands of management. I had an idea before reaching out to the customers but I took a pivot considering their needs as they are the ones using it. The management would take the product if it gives them business.

The product I created is a tool for recruiters to speed up their recruitment process by automating all the manual work done by them. The ones I spoke with before making the MVP loved the product and recommended more features that would help them. But selling it to them is hard as they are not the decision makers. May be I suck at sales or the way I am approaching them is not right.
High-end hospital-management software is not simple stuff, to roll your own. And the (very few) specialty companies which produce such software may see no reason to support a variety of OS's.
and a 28 inch 4k screen, and external mouse
Pornhub Pulls Out of Nebraska
Going off of that framework:

Because doing three requires convincing a bunch of people that are currently doing number two, to do number one instead.
Elon needs to sponsor Jonathan Blow to build a Windows competitor
I haven't seen the file, but surely each build artifact should be signed and verified when it's loaded by the client. The failure mode of bit rot / malice in the CDN should be handled.
I lived in Fresno for 15 years. I spent north of $400 bucks a month on AC in the summertime (starts in June and goes till early November). I lived in a new home with modern insulation.

I now live in NY and I have a basement. It's generally about 10 degrees cooler. I would have loved that in Fresno.
https://www.404media.co/leaked-docs-show-what-phones-cellebr...

They have a few charts listed.
There’s still the several other companies with support documents that haven’t leaked.
Which part seems dubious to you?
> extremely niche "CP solver packages and OR-tools" (which one exactly?) significantly reduces project risks such as not being able to find experts, the system not meeting functional or performance requirements, or becoming obsolete down the road. The same cannot be said for some mythical "CP solver packages and OR-tools"

"Mythical CP solver packages and OR-tools"? Lol!

Google's OR-Tools [1] has been winning golds in the MiniZinc Challenge since 2013 [2]. In 2023 it won Gold in most categories and the only Prolog to win, SICStus Prolog, took one Silver back. I'm curious where you're spending time in the community if you can word a comment like this as OR-Tools is the behemoth in this area and Prolog is the weird hacker siren call that appeals to people who certainly aren't about to publish anything novel in the space.

I say this as someone who has tinkered a lot with Prolog over the years and finds Prolog's execution model to work really well with the way I think about programming. Prolog and its hybrid solver model just isn't good enough at any one thing to make it SOTA. It's fun to tinker with, but I just don't think in 2024 it has enough to offer anyone who's not interested in the language or the WAM to make it worth exploring, especially not as an embedded constraint solver.

[1]: https://developers.google.com/optimization/

[2]: https://www.minizinc.org/challenge/
That video probably isn't making the point your trying to make, given that it repeatedly shows people getting beaten by police for things that definitely don't warrant it, and towards the end advises "getting a white friend" as a means of avoiding police brutality.
For me, the microSD slot is the important part, and the Galaxy A54 still has one. No headphone jack, though.
100% agree. I am using my phones headphone jack right now.
Holy smokes. I'm no programmer, but I've built out bazillions of publishing/conversion/analysis systems, and null purge is pretty much the first thing that happens, every time. x00 breaks virtually everything just by existing - like, seriously, markup with one of these damn things will make the rest of the system choke and die as soon as it looks at it. Numpy? Pytorch? XSL? Doesn't matter. cough cough cough GACK

And my systems are all halfass, and I don't really know what I'm doing. I can't imagine actual real professionals letting that moulder its way downstream. Maybe their stuff is just way more complex and amazing than I can possibly imagine.
> how much are GenAI companies willing to invest to get eyeball reflections right?

Willing to? Probably not much. Should? A WHOLE LOT. It is the whole enchilada.

While this might not seem like a big issue and truthfully most people don't notice, getting this right (consistently) requires getting a lot more right. It doesn't require the model knowing physics (because every training sample face will have realistic lighting). But what underlines this issue is the model understanding subtleties. No model to date accomplishes this. From image generators to language generators (LLMs). There is a pareto efficiency issue here too. Remember that it is magnitudes easier to get a model to be "80% correct" than to be "90% correct".

But recall that the devil is in the details. We live in a complex world, and what that means is that the subtleties matter. The world is (mathematically) chaotic, so small things have big effects. You should start solving problems not worrying about these, but eventually you need to move into tackling these problems. If you don't, you'll just generate enshitification. In fact, I'd argue that the difference between an amateur and an expert is knowledge of subtleties and nuance. This is both why amateurs can trick themselves into thinking they're more expert than they are and why experts can recognize when talking to other experts (I remember a thread a while ago where many people were shocked about how most industries don't give tests or whiteboard problems when interviewing candidates and how hiring managers can identify good hires from bad ones).
Perhaps - but if I made a list of all of the things your company should be doing and didn't, or even things that your side project should be doing and didn't, or even things in your personal life that you should be doing and haven't, I'm sure it would be very long.