skysight-inc/HackerNews huggingface dataset:
Not disagreeing, however:

1) the prevailing majority of laptop and desktop PC installations (home, business and enterprise) are not Windows Server;

2) kiosk style installs (POS terminals, airport check-in stands etc) are fully managed, unsupervised installations (the ones that ground to a complete halt today) and do not offer any sort of user interaction by design;

3) most Windows Server installations are also unsupervised.
Can you propose an example of a compensating control for an "antivirus" that had a chance to pass? Would you propose something like custom SELinux/Apparmor setup + maybe auditd with alerting? Or some Windows equivalent of those.
> Instead of presenting users with a pre-customized environment and default wallpaper, we introduced a new step in the installation process. Users can now select their preferred desktop layout before the first boot, easing the transition for newcomers and showcasing Linux's customization capabilities early on.

When installing a new OS, I want the OS to be up and running as soon as possible, so I can then install everything else I'll need, connect all my accounts, perhaps restore an old backup or sync with some source of settings.

As such, installation should never include unnecessary steps like this. There's a good chance that the image I want is in some remote drive that I first need to connect/login to. Making me choose some arbitrary image before I can get to the actual running OS is very unlikely to be helpful.
Your artist friend has deluded themselves with wishful thinking.
Prague has even better beer than Vienna’s decent beer. But the wine here is very good :)
“To err is human, but to really fuck things up requires a computer.” ~ Len Beattie
Yeah, I see a lot of noise on social media blaming this on Microsoft/Windows... but AFAIK if you install a bad kernel driver into any major OS the result would be the same.

The specific of this CrowdStrike kernel driver (which AFAIK is intended to intercept and log/deny syscalls depending on threat assessment?) means that this is badnewsbears no matter which platform you're on.

Like sure, if an OS is vulnerable to kernel panics from code in userland, that's on the OS vendor, but this level of danger is intrinsic to kernel drivers!
Purchasing decisions are made by purchasing managers. Purchasing managers spend their time torturing numbers in spreadsheets, writing reports, and getting free lunches from channel sales reps. Microsoft is just a sales organization with some technical prowess, and their channel reps are very effective.

Technical arguments, logic, and sense do not contribute much to purchasing decisions in the corporate world.
The entire point of not accepting surveillance and advertising is to help them develop to be independent, have a strong internal sense of self-worth, and derive happiness from within. The surveillance/ad industry has exactly the opposite goal: make them feel judged at all times, base their self-worth on the perceived opinion of others (including people they've never even met), and have that perceived opinion be that if they buy X they will reacquire their stolen happiness.

The beautiful thing about being a contrarian is you can only win: either they agree with you, so you must've gotten through to them, or they don't, so you must've gotten through to them.
interesting how it works under the hood
This is a pretty empty article that just seems like spin on the current issues going on.
Oddly enough, this is the same packaging as bulk kitty litter: https://www.petsmart.com/cat/litter-and-waste-disposal/litte...

The CostCo photos show the same tear-off plastic seal and have the hole for the handle, though that's not installed: https://www.costco.com/readywise-150-serving-emergency-food-...
Far from baseless speculation, there are many things that Linux does just _right_ compared to anything else, unfortunately my time is limited to list all of them here.

I will just say that one big advantage of Linux compared to other kernels is the fact that the same Linux kernel that your average Joe is running on their own machine, is the same kernel that CERN is running in their experiments.

Improvements to any area of the kernel get upstreamed and sometimes those affect (and benefit) various setups other than the intended machine, this is mainly due to the nature of open source and shared codebase, Linus himself explains it here:

https://youtu.be/MShbP3OpASA?t=1335

https://youtu.be/MShbP3OpASA?t=2280

I think this is more than what any company could ever dream of achieving, they might just lack the resources to do it.
A little yes, a little no.

Was this problem caused by Microsoft? No.

Why does this tool exist and must be installed on servers? Well, Windows OS design definitely plays a role here.

Why does this software run in a critical path that can cause the machine to BSOD? This is where the OS is a problem. If it is fragile enough that a bad service like this can cause it to crash in an unfixable state (without manual intervention), that’s on Windows.
I spent some time on STIG website out of curiosity. There seem to be down-to-earth practical requirements but only for Windows, cf. https://public.cyber.mil/stigs/gpo/

Why does it justify running antiviri on Linux is beyond my understanding.

Weak, impotent, speechless IT personnel that can not face off incompetence?
Do you have a citation for this? It sounds like a violation of multiple constitutional protections just waiting for a Supreme Court challenge.
Post: Car strikes, kills pedestrian at crosswalk

Top post: Title is clickbait, driver didn't kill pedestrian on purpose.

Pedestrian: <is dead>
That's a good idea, thanks for the suggestion.

It seems to be quite picky about which books it accepts sometimes, will have to look into that :)
more accurately, you dont feel falling because the magnitude is so low.
Custom operators of any kind are definitely a problem for learners. I think people just fixate on overloading because that's the only kind of operator customization available in the most popular languages.

The particular problem is that search engines tend to have terrible support for searching for arbitrary sequences of non-alphabetic characters.
No numbers on how much O is needed and how it has developed the last few years?
lonely?
>These meals also don't seem all that nutritious. A lot of the entrees are high in carbs but low in proteins and fats

Uh, of course? That's the stuff that keeps on the shelf. The point of disaster preparation is to avoid burning cash on throwing your food out every six months or hitting the expiry while you possibly don't even have running water if you forget when rotation day is. It's not a luxury athletics product; it's meant to keep you and your family supplied with calories for a week after an earthquake takes out the interstate your supermarket gets its deliveries on and there is no food to be had at any price. Do you have any actual experience with disaster planning? This comment is wildly off the mark.
I agree but it seems the original PDF is not changed but you are right, if it is edited directly and renamed then it will fail to load the JSON.
I never assumed intent in bullshitting. I don't think I've ever seen someone else assume it either but that might be clouded by my own biases. Do you have any data on how common it is for people to interpret bullshit as intentional vs not?

OTOH, "hallucination" is defined by Cambridge [0] as:

> the experience of seeing, hearing, feeling, or smelling something that does not exist

That can clearly not be the case for an LLM as it lacks the senses to see, hear, feel or smell. Arguably, some systems can see and hear but I don't think they would be able to sense anything that does not exist.

The dictionary follows on by including LLM hallucinations in its definition, but this seems irrelevant since that's exactly what's in dispute in this post.

[0] https://dictionary.cambridge.org/dictionary/english/hallucin...
Any company that inserts itself so heavily into US politics cannot be counted on as a solid engineering organization.
I'd love to see a version of this where each passenger is in a glider, allowing a long distance controlled decent to a new destination. Maybe even use reusable balloons filled with hydrogen, that can be depleted with a fuel cell to create enough ballast, and electricity to do a controlled decent.

It would be an interesting new way to travel.
I don’t see how this is Microsoft’s fault or issue.

MS can’t prevent a software vendor from breaking the machine.
They've already mostly fixed the extra fingers and weird hands in general issue.
Towards AI Governance, Balaji AI-Biden Challenge
Let's start an open-source, non-profit AI government. Create LLM agents to represent every politician, decision-maker, and policymaker. By simulating their decision-making processes, we can measure their performance against actual human decisions. This would involve considering both short-term and long-term consequences. Running this experiment for 5-10 years would generate valuable comparison data, allowing the public to interact with and contribute to the development of the project.

A week ago, Balaji announced a challenge to create an open-source demo of a President Biden deepfake that would outperform the teleprompter-reading Biden. This isn't new; we've seen such videos before. However, there hasn't been a project that combines all the open-source models and allows us to talk and interact with the deepfake.

This is the initial release. Responses will stream live. To make this real-time on consumer GPUs and indistinguishable, a lot of work needs to be done, such as aligning LLMs, training text-to-speech, and optimizing the LipSync video generation model.

Please check out this project on Github.
This is the first time I'm hearing about crowdstrike, what is it and why is this such a big deal?
Funny anecdote: a week after getting out of prison I was hired to listen to these calls and transcribe them. The State's Attorney's office would send me the ones they suspected of talking about illegal activities and were being investigated. None of the calls I listened to had anything illegal going on. Usually the opposite. Securus (the main operator) has a system for detecting certain words, so if you mention "drugs" it gets flagged.

I remember one call from a girl to her wife and the entire call was about how she badly wanted to get clean, the drug classes she was taking, the rehab they were setting up for her after she got out. It was literally as wholesome as you could get, and yet it was flagged for drug crime.
It looks quite normal so far: https://radar.cloudflare.com/traffic

DE-CIX traffic is also often a good indicator during global events, looks normal: https://www.de-cix.net/en/locations/frankfurt/statistics
How is it lazy and herd-like to _not_ run the latest and greatest? Sounds like Etherium's design is promoting a robustly diverse ecosystem rather than a monoculture.
The CEO actually did apologize: "We're deeply sorry for the impact that we've caused to customers, to travelers, to anyone affected by this..."

https://www.reuters.com/technology/crowdstrike-ceo-apologize...
I predict that the people who were actually responsible (the "deadline above all else" crowd) will not be the ones who are actually blamed.
The scientific paper underlying the article is here: https://www.nature.com/articles/s41559-024-02448-y

There's a different article, and to my mind a more readable one, here: https://www.sciencedaily.com/releases/2024/07/240715135713.h...

> "Lakes and reservoirs have experienced oxygen losses of 5.5% and 18.6% respectively since 1980. The oceans have experienced oxygen losses of around 2% since 1960 and, although that number is smaller, it represents a more geographically and volumetrically extensive mass. Marine ecosystems have also experienced substantial variability in oxygen depletion. For example, the midwaters off of Central California have lost 40% of their oxygen in the last few decades."

If that holds true worldwide, and not just at a selection of measuring sites, it's a rapid and very concerning shift. It'll be interesting to see if their measurements are corroborated.
I'm not saying it's a good thing, just that it's a reality NASA has to deal with. so yea... :/
They've bumped this support info to a blog post that's linked from their home page: https://www.crowdstrike.com/blog/statement-on-falcon-content...

It includes PDFs of some relevant support pages that someone printed with their browser 5 hours ago. That's probably the right thing to do in such a situation to get this kind of info publicly available ASAP, but still, oof. Looks like lots of people in the Reddit thread had trouble accessing the support info behind the login screen.
Even once in a boot loop, it can download the fix and recover?
Also, water! The different colors of dirt (containing copper, iron etc) near here are all exposed by water erosion.
I think the Utah War comes into play as well. Mormons should score pretty high on a spectrum of how much people consider themselves to be independent of the federal government.
Hmm, makes me wonder what percentage weight you would feel at, say, the height of the ISS if you were fixed in a relative location to the Earth (not orbiting at all).

Considering the same question for geostationary orbits had me confused for a moment and then I realised we are not in a fixed location relative to the Earth, thanks to the Earth's spin. I wonder what extra percentage weight we would feel if it weren't spinning.
Yep. Monorepos and fully vendored third-party deps, the two things I wish other people were doing... because the way the bulk of the industry is doing it is a stupid productivity killing, security, and reliability nightmare.

I was always a square peg in the round hole there, and I have no idea how I lasted 10 years. I was at L4 the whole time and never made the move to even try for L5 because the perf process seemed like such stressful garbage to me and I was perfectly fine with my already generous compensation.

I miss that kind of $$, but oh well. It got to the point I couldn't stand it anymore, and after watching the insane growth in hiring... I knew layoffs would be coming.
The parenthetical remark about the other user "berate"-ing me I find really a bit at odds with reality - it remains to be seen what that user intended, the whole comment was quite neutrally put I thought. I've responded at length attempting to answer their question(s), and am looking forward to seeing if a fruitful discussion develops.

I certainly don't see any scolding or criticism in their comment, and think it's quite possible that it's a misunderstanding.
Oh! I wasn’t expecting this. I’ll be here a couple of hours to answer any questions.
> “It shouldn’t be there.”

What hubris. “We didn’t expect it to be there,” or similar would be more appropriate. I really would like to see more uncertainty and humility from scientists that base their work on theory.
You can go do the rabbit hole of risk scenarios, but you still end up with a list that will look something like (made-up) 100 days of supplies will get me through 80% of the list, and 250 days will get me through 95% of it.

If you want to go down that rabbit hole, start with studying Katrina. Has almost every variation played out within one extensively documented event. Hunker vs leave, severe acute damage (MS) vs persistent 'lessor' flooding (NOLA), figuring out how long you need to evac, and when evac turns into short/medium term relocation or even permanent move.

Yea it's local and not Armageddon, but it provides the framework for how to think about these things, and how relying on faulty assumptions gets you in trouble.

But the real answer to your Q is that you'll start by prepping for 10-day events, then 100-day events, then maybe 250-day events, and you'll start to be able to fill in the gaps of your knowledge yourself. No matter what the risks.

Along the lines of: What good is 250 days of food without X? Where x might be water, fuel, meds, or 'lessor' needs like internet, work/job, social events, etc.

Or what good is 250 days of food if I have to abandon 210 days of that supply to evac?

Those are the types of questions that people answer differently, and you won't start filling in the gaps for yourself until you start small and build from there.
One problem with tying the fee to net worth is that wealthier individuals may be more likely to have their wealth in trusts so they may actually have "fewer assets" than a poorer person.
Does Apple have a better method for preventing something like that?

I love my Mac, but I've had crashes that I suspect were caused by an application.
> we're a civic tech lab

Obviously not the point of your post, but say more? This sounds like it could be pretty cool!
Isn't Crowdstrike the same company the heavily lobbied to get make all their features a requirement for government computers?
https://www.opensecrets.org/federal-lobbying/clients/summary...
They have plenty of money for congress, but it seem little for any kind of reasonable software development practices. This isn't the first time crowdstrike has pushed system breaking changes.
A wrapper for Git to sanctify your version control workflow
Japanese gymnastics star Shoko Miyata sent home from Olympics for smoking
https://en.wikipedia.org/wiki/Pay-to-stay_(imprisonment)

https://www.brennancenter.org/our-work/analysis-opinion/amer...

https://www.npr.org/2022/03/04/1084452251/the-vast-majority-...

https://www.abcactionnews.com/news/local-news/i-team-investi...

Etc.
The answer is Cloud based Windows OS which MS is working towards for many years.
Thank you for your appreciation.
Why are you assuming there were tests?
I'd be curious whether people would want the cost effective fix for this, which is basically to eliminate vendors for anything important.

Near complete vertical integration of security, like with Apple.
> Dynamic dispatch is the defining feature of object-oriented programming.

Message passing is the defining feature of object-oriented programming. Dynamic dispatch can be achieved using message passing, but message passing is more than dynamic dispatch.

Ultimately, static typing is incongruent with object-oriented programming. Messages are able to be invented at runtime, so it is impossible to apply types statically. At best you can have an Objective-C-like situation where you can statically type the non-OO parts of the language, while still allowing the messages to evade the type system.
Re: developed over the last few years, I clicked through 2 layers of referenced articles to get to the actual paper which says oxygen is down 2% on the last 50 years [1]. The rapid falling of oxygen seems to be (as far as I can tell from the various linked articles) is somewhat localized to the Gulf of St. Lawrence [2].

[1] https://www.nature.com/articles/s41558-018-0263-1

[2] https://www.sciencealert.com/this-stretch-of-water-is-losing...
I remember a fed speaker in the 90s at Alexis hotel Defcon trying to rationalize their weirdly over-aggressive approach to enforcement by mentioning how hackers would potentially kill people in hospitals, fast forward to today and it's literally the "security" software vendor that's causing it.
Not sure what questions Microsoft have to answer. A third-party vendor shipped defective software.

I guess the only question they could answer is why they don't provide a framework like Apple do with Endpoint Security for third-party vendors to use.
Wow, this hits close to home. Doing a page fault where you can't in the kernel is exactly what I did with my very first patch I submitted after I joined the Microsoft BitLocker team in 2009. I added a check on the driver initialization path and didn't annotate the code as non-paged because frankly I didn't know at the time that the Windows kernel was paged. All my kernel development experience up to that point was with Linux, which isn't paged.

BitLocker is a storage driver, so that code turned into a circular dependency. The attempt to page in the code resulted a call to that not-yet-paged-in code.

The reason I didn't catch it with local testing was because I never tried rebooting with BitLocker enabled on my dev box when I was working on that code. For everyone on the team that did have BitLocker enabled they got the BSOD when they rebooted. Even then the "blast radius" was only the BitLocker team with about 8 devs, since local changes were qualified at the team level before they were merged up the chain.

The controls in place not only protected Windows more generally, but they even protected the majority of the Windows development group. It blows my mind that a kernel driver with the level of proliferation in industry could make it out the door apparently without even the most basic level of qualification.
They need the right type of public engagement. That hypothetical person who sees the picture of sulphur crystals then leaves 5 seconds later is unlikely to support NASA. If they have enough negative interactions, I would suggest that it would achieve the opposite.

There is also a difference between a clickbait headline and a headline that genuinely engages someone. Something like "Unexpected discovery of sulphur crystals provides hints about Martian past" provides vastly more useful information and will probably be more appealing to people who have at least some interest in science. (Or at least rock collecting!)

At least in my case, I decided to read the comments here before even considering a look at the article. Not only did the idea of a "surprise" leave me thoroughly disinterested, but I have been bitten by NASA's hyperbole often enough to be hesitant about pursuing a clickbait link. Which is sad, because planetary science is interesting and the article itself wasn't that bad for something directed towards a general audience.
True; except here's what's baffling:

CloudStrike only uses a kernel level driver on Windows. It's not necessary for Mac, it's not necessary for Linux.

Why did they feel that they needed kernel level interventions on Windows devices specifically? Windows may have some blame there.
A Million Microscopic Trojan Horses – Using small proteins for drug and delivery
> (Repeating my comment because other story is duped)

Please don't do this! It makes merging threads a pain. It's better to let us know at hn@ycombinator.com and then we'll merge the threads so your comment shows up in the main one.
Lack of gradual, health mediated rollout is absolutely the core issue here. False positive signatures, crash inducing blocks, etc will always slip through testing at some % no matter how good testing is. The necessary defense in depth here is to roll out ALL changes (binaries, policies, etc) in a staggered fashion with some kind of health checks in between (did > 10% of endpoints the change went to go down and stay down right after the change was pushed?).

Crowdstrike bit my company with a false positive that severely broke the entire production fleet because they pushed the change everywhere all at once instead of staggering it out. We pushed them hard in the RCA to implement staggered deployments of their changes. They sent back a 50 page document explaining why they couldn't which basically came down to "that would slow down blocks of true positives" - which is technically true but from followup conversations quite clear that is was not the real reason. The real reason is that they weren't ready to invest the engineering effort into doing this.

You can stagger changes out within a reasonable timeframe - the blocks already take hours/days/weeks to come up with, taking an extra hour or two to trickle the change out gradually with some basic sanity checks between staggers is a tradeoff everyone would embrace in order to avoid the disaster we're living through today.

Need a reset on their balance point of security:uptime.
Isn’t that what office safes are for? I don’t know the location, but all the old guard at my company knew that room xyz at Company Office A held a safe with printed out recovery keys and the root account credentials. No idea where the key to the safe is or if it’s a keypad lock instead. Almost had to use it one time.