skysight-inc/HackerNews huggingface dataset:
The only thing I can think of is they were trying to defend from a very severe threat very quickly. But... it seems like if they tested this on one machine they'd have found it.
Thanks for the info. Sibling comment posted the video I was referring to. The video was apparently made in cooperation with Pontzer: https://sites.google.com/view/sources-workoutparadox
I heard/read somewhere from some Stewardesses on those budget airlines that even though people get angry about being charged those additional costs, that they claim they will never fly again, that they actually continue flying repeatedly with the same budget airline. I think the term used was "hate flying", that you hate the extra charges you get but continue to fly because it is the cheapest.
Phenomenal timing: https://old.reddit.com/r/wallstreetbets/comments/1e6ms9z/cro...
Just to clarify, a prison sentence doesn't actually mean you'd be incarcerated, Russia for example routinely sentences foreign nationals to prison without the means to getting them arrested
> President & CEO CrowdStrike, Former CTO of McAfee

Well that's certainly a track record.
CS, S1, Zscaler etc auto updates and they have to. Thats the point of the product. If they dont get definitions they cannot protect.
An IOMMU does solve it, at the cost of some performance. The GPU can only access memory that the IOMMU allows, and the part that programs the IOMMU is open source.

RDMA requires a special network card and is opt-in - an RDMA NIC cannot access any random memory, only specially registered regions. One could argue that a NIC FW bug could cause arbitrary memory accesses, but that's another place where an IOMMU would help.
This comment is idiotic.
Ryanair are what they are. The reason every flight is so cheap in Europe is because of them. They've never pretended to be anything else other than a budget airline where any extras or conveniences will cost you extra. I've literally just checked in with an EasyJet flight and it's exactly the same patterns everywhere. Every other airline copied RyanAir because most passengers are highly price sensitive. The problem is that they're still not as cheap.

The 'not printing a boarding ticket' before you travel and being charged for it at the airport has been around since 2009: https://theguardian.com/money/2009/may/14/ryanair-online-che... so it's hard for people to feign ignorance of it.
I love the satire!
Simple: They are obviously too big to fail now.
We all pay, you find harder to pay in attention instead of money, but either way it's a cost on society
They will always have a safe haven in Germany and Austria.
Maybe they just never had desktop PCs? Mine has a ps/2 port, various different colored USB type A ports, USB type C, DVI, HDMI, RJ-45, 3.5mm audio, and I just bought a M.2 PCIe adapter card because SSDs have two different popular interfaces. I also have a micro-SD to USB adapter and a box full of just as many cables as I had in the 1990's. Graphics cards now have their own special power connector, as do SATA drives. HDMI comes in 2 or 3 different sized connectors, so does SATA. It's no less of a mess than it was then.
The terminal is probably not running Crowdstrike...
I see this all over the place and I've by now learned to always answer "no" if anybody offers currency conversion. It's sometimes difficult, because some terminals will only show you a choice of currencies, and you have to remember to pick the local currency (local to the store you are paying in) and let your bank do the conversion at their (terrible) rates, rather than pay a 10% markup.
Should be, but I don't know that that's appropriate for involuntary manslaughter.

Do it to Boeing, sure.
I find that in today's world it is no longer about one person being "accountable". There is always an interplay of factors, like others have pointed out cyber security has a compliance angle. Other times it is a cost factor, redundancy costs money. Then there is the whole revolving door of employees coming and going, so institutional knowledge about why a decision was made lost with them.

That is hard to do for even a small company. How do you balance all that out for critical infrastructure at a much larger scale?
I'd bet my career CS isn't spending enough on QA. It's always the first thing to be cut, no one cares about QA when everything is going well, but when things go wrong...
Obese != well nourished. You can be obese yet have nutritional deficiencies that show in one way or another.
Don’t take this the wrong way but I don’t think that the average HN poster’s view on lodging/expenses is the correct gauge for what’s an appropriate per diem for your average government worker on a business trip.

And if the government worker wants to travel for work like a consultant or a FAANG employee then they can of course pay out of pocket.
Another rather minor thing is that if you look at the source of their confirmation emails, they include a lot of reservation data in XML tags according to the schema.org specification (https://schema.org/FlightReservation). I was looking for a way to parse flight details out of confirmation emails before, and with Ryanair it is trivially easy to do because of this whereas with most other airlines you have to resort to parsing the plaintext or (awful) HTML.

Again, not a big thing but I was surprised that Ryanair seemed to be the only ones who took a standards-based approach to these emails.
> How hard would it be to craft a malware that has the same signature as an important system file?

Very, otherwise digital signatures wouldn’t be much use. There are no publicly known ways to make an input which hashes to the same value as another known input through the SHA256 hash algorithm any quicker than brute-force trial and error of every possibility.

This is the difficulty that BitCoin mining is based on - the work that all the GPUs were doing, the reason for the massive global energy use people complain about is basically a global brute-force through the SHA256 input space.

See the “find a custom SHA256” challenge on HN last month discussions: https://news.ycombinator.com/item?id=40683564
It likely contains a bug but is an uncorrupted file. Corrupted to me means the file was changed or modified in a way from it's intended state and likely won't run anymore.
Google spending a boatload for Wiz looks smarter now
If a plane is in the air, and can't get permission to land anywhere, well, they only have a finite amount of fuel onboard.
Why Do Prescription Drugs Have Such Crazy Names?
Certainly, but that doesn't make Moldova either Russian or part of Russia, as the parent poster asked, just like the south of Italy is neither Arabic nor part of whatever Arab country you want to take as the successor state of the last Arabic sovereign of Sicilly (Egypt?).

Moldova is still culturally very distinct from Russia and many other former Soviet republics, so the odds of something being true in Moldova just because it's true in Russia are in fact remarkably small. In particular, "vodka" is not a common generic term for alcohol-based drinks in most of Moldova, whether that's true in Russia or not.
> revolutionised travel within the EU.

In which ways? Apart from the low cost part and making flying utterly miserable now. It's not like he invented a new type of airplane

IMO they just forced other airlines to cut product and service to the bone. A tight, business-savvy guy spent all his waking hours figuring out how to further screw passengers (and continues to do so)

I do wonder if EU261 would have been required without low cost airlines.

> expecting flag carrier service from a discount airline.

Flag Carriers are all low-cost for short/mid haul now (and to an extent long-haul), as they've been dragged in to the gutter by Easyjet and Ryanair
100% nix based here so thankfully zero systems affected. Everything from routers to devices, we have a total blanket ban on any Windows based software.
Just a small reminder that's it's never "the guy" and always "the process", or lack thereof.
Dupe: <https://news.ycombinator.com/item?id=41002195>
That’s a pretty good deal and probably not a bad idea to have on hand especially for a lot of people that live in areas more prone to severe weather or natural disasters.
Haha companies are even making their own memes now
Were you using the second passport to leave Malta, or to enter Israel?
Extraordinary IT outage hobbles business around the globe
I actually don't think they are that bad - you just have to appreciate that when they have a maximum bag size (or some other arbitrary limit) they are entirely serious about it. And if you do break their rules they will try and charge you - but it's pretty easy to work within their rules so not a huge problem if you do some basic preparation.
I’m curious, which software do you use for the lead mining quality improvement use-case you mentioned?
Wolfram LLM Benchmarking Project
Boarding planes is the proof of our failure as a species. Something so easy made so complicated.
Lol we were using Symantec software so thankfully no affect.
> Yes, software industry as we know would not exists if companies where held liable for all damages.

Of course it would. Restaurants are held liable for food poisoning, but they still operate just fine. They just - y’know - take care that they don’t poison their customers.

If computer systems were held liable, software would be a lot more expensive. There would be less of it. And it would also be better.

I think I can get behind that future.
2024 CrowdStrike Incident
How is the * (star / asterisk) character allowed in the file name?

I thought such characters are forbidden by Windows.

https://learn.microsoft.com/en-us/windows/win32/fileio/namin...

How did the tool even manage to create such a file?
Thank you for sharing. It reminds me of a similar website I made with my dad at similar age, in the mid 90s.

I hope she enjoyed it, and continues to enjoy it.

I also hope to do similar with my children when they’re at at that age.
If I were running an organization that needs these audits, I'd always have fallback procedures in place that would keep everything running even if all computers suddenly stop working, like they did today. General-purpose software is too fragile to be fully relied upon, IMO.

If a general-purpose computer must be used for something mission-critical, it should not have an internet connection and it should definitely not allow an outside organization to remotely push arbitrary kernel-mode code to it. It should probably also boot from a read-only OS image so that it could always be restored to a known-good state by just rebooting.
> if you’re not educated in the Soviet Union you will know it

My grandparents and parents and siblings all learned Ukrainian in school during Soviet times. This is in what now would be considered a predominantly Russian-speaking part of Ukraine btw.
Global Tech Outage Grounds Flights and Hits Businesses
Cloudstrike outage causes worldwide business disruptions. Airlines, broadcaster, banks and McDonald’s effected.

“Shared” link:

https://www.nytimes.com/live/2024/07/19/business/global-tech...
If you read their comment holistically, they obviously agree with you and think that the outcome of the audit should be more meaningful.
Ramification implies adverse unwarranted complexity. There are no ramifications, just a few straightforward requirements.
> You're down? Great, so are your competitors, your customers, and your suppliers. Head to the pub. Actually, you'll probably get more real value there, as your competitors, customers and suppliers are at that same pub. Insurance multinationals have been founded from less.

I mean yeah, that's the other thing - the Keynesian sound banker aspect. But that's more for software that you're intentionally using for your business processes. I don't think anyone was thinking about Cloudstrike being down in the first place, unless they were worried about an outage in the webpage that lists all the security certifications they have.
So literally today i tried to install sql server developer edition, and for some reason the downloaded file was corrupted. The error msg wasn't "ctrl-c"-able, so i had to retype whatever nonsense shown on the screen.

That was Microsoft's database, from Microsoft's website, to be installed on a Microsoft's OS.
Yeah, you need to manually fix each affected system by booting in safe mode. Not possible to do remotely.
Heady Topper? 8% alcohol. Seems a good fit for the UK market.
I tried most IPAs available in London and France and they seems to me to go in two directions: 2x percentage of alcohol or using various syrups. They invariable give me headaches and I keep coming back to traditional beer.
... no compulsory service until the bombs start dropping.
Personally I took that "in russia" like I would with "in europe...insert generalization here". As in Russia the general area, not specifically the country. Similarly we still refer to a good part of the Balkans as ex-Yugoslavia.
Interesting theory. I think it's also still mostly optimized for a pre-agricultural diet.

Keto has been shown to be helpful with a huge number of health issues, and from my understanding humans spent most of the year in ketosis (or all year during the ice ages?).
Align well with the strengths and limitations of various devices and file formats
Nuclear fusion experiment hits new record for magnet strength
I dunno about that. I'm regularly _flabbergasted_ by what hackers will do just for fun, and how they run circles around an industry veteran like me.

Look at the modding scene for games (an extreme example being a 30 year old obscure German game called "Gothic" where the modding community is still building amazing stuff on top of this ancient piece of software). Look at 3D printing, or people dabbling with Arduinos and Raspberry Pis. Look at the Emacs community and all the packages people build with a level of attention to detail you rarely find in commercial software.

Those people are all doing it for fun. That's my dictionary definition of "extremely talented and motivated people". The world is big, and I figure those kinds of people would happily work in a place where they can put their talents to use full time for a livable wage. Provided they don't feel like they got the short end of the stick compared to their colleagues/managers, financially or otherwise, maybe.

Probably not in the average tech company bureaucracy with all the overhead, micro management, politics and user-hostile antics though.
"Everyone ends up paying for 'speedy boarding'"

That has never happened on any Ryanair flight I've been on.
oh this is great. there's still room for improvement but it satisfies my basic requirements very well.

thanks, this is quite useful for my macos.
They likely run software written for windows, patched together over decades, that wouldn’t port easily to an iPad.
Kinda. Yes. Apple moved away from deep kernel extensions years ago. They are no longer permitted on their latest releases.

Of course something like an EDR requires kernel level access otherwise it's too easy to bypass. But Apple has system extensions as a useful compromise. They're basically kernel level APIs that can be called by validated signed software. I think it's a good alternative to just allowing random code to run in the kernel.

The thing is, Apple has a habit of going to software vendors and saying: "We're changing this next year. There'll be a 2 year deprecation period and after that we'll lock you out. So change up or die off. We don't care."

Microsoft doesn't really do this and even if they do there's a lot of ifs and buts. They're much more receptive to the concerns of legacy software vendors because they represent a much bigger share of their market and the customer base (enterprise market) that cares about legacy is also very big and vocal.

Needless to say this is also the customer base that got heavily hammered by what happened today. But nobody thinks about that until it actually happens.
I find myself reluctant to go to the doctor, dentist, etc. because I always feel like they're trying to upsell me on some bullshit, or doctors that split treatment into multiple 15 minute visits to squeeze me as much as possible.
echo lol > 'l*l';
ls 'l*l'

I bet it's a glob pattern and indicates "anything"
You're half right - people who compiled it from source could theoretically get those releases, but no, it wasn't released in any distros. So in practice since no linux distro released it, no-one relying on linux distros was exposed to it.
valuable 2 cents

is there any writeups from the pentesting side of things that we can read to learn more?
These are small fish, the big fish but beer concentrate tech from https://brewvo.com/
I'm not sure how "IPAs aren't real beer and are made from concentrates!" ends up at "There's a company planning to ship all sorts of beers in concentrated form straight to the end user", but there was a change of direction there somewhere.
CrashStrike
You can blame whoever you want. Personally, I blame pbrw.
What a fun time to be less than 48 hours out from a transcontinental flight
He has already told you how to prove it: enumerate the functionality of the driver - the GPU and the code are finite, bounded environments. You can absolutely prove that there is no tea in a cup, that there are no coins in a purse, that there is no cat in a box, etc.
Taboola and Apple News? No Thanks
> Crowdstrike is finished

Unlikely, just as Solarwinds wasn't finished when they distributed malware that got government agencies hacked. You underestimate the slow turning radius of giant company purchasing departments.
That reminds me of why McDonalds got such a high penalty in the court case everyone remembers as "person sues for spilling hot coffee on themselves".

The reason this reminds me of that, assuming that I remember right, is that I think they had even taken the decision that the cost of paying lawsuits for those injuries was lower than the increase in revenue for being able to say "we have the hottest coffee"… and that was why they were deemed so severely liable.

They were definitely shown to have known it was resulting in injuries from other settlements:

https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restau...
Or anyone who likes backpacking. The equivalent at REI is several times the price.
Yeah, but heads will have to roll for this one, the world will be calling for blood, so who better if not "the guy"?
Jobs was known for his ability to convey complex ideas in a simple, engaging and often entertaining manner. His presentation style is amazing
Which is not about brewing from concentrate like the home brew kits are, but brewing to concentrate and shipping like that for dilution in a bar, and it doesn't sound like it's in production yet.

Not something I'm interested in. But it certainly doesn't support your weird assertion that IPAs in particular are all made from concentrate.

I think you have a number of things mixed up in your head here.
So where can I buy an ETF of companies specializing in software Quality Assurance?
That's cool, I had no idea!
Enterprise Linuxes also employ Crowdstrike or similar "security" products as mandatory part of their IT deployments. Often (always?) this is due to companies wanting certification for their secure processes, in order to sell to government or large corporations that require them.
> same signature as an important system file

AFAIK important system files on Windows are (or should be) cryptographically signed by Microsoft. And the presence of such signature is one of the parameters fed to the heuristics engine of the AV software.

> How hard would it be to craft a malware that has the same signature as an important system file?

If you can craft malware that is digitally signed with the same keys as Microsoft's system files, we got way bigger problems.
I wonder if the * (asterisk / star) character in its name isnt causing the issue.
And IT has dual power supply servers, and endpoint UPSs.

Electricity is aggressively made redundant for mission-critical systems.
I'm a bit unfamiliar with this stuff anymore... supposedly it was a content update, not the agent itself :/
"Crowdstrike Update: Windows Bluescreen and Boot Loops" https://news.ycombinator.com/item?id=41002195 1260 points, 1008 comments
yep, but "trust us, we're secure, pinky promise by our internal employees" doesn't really work either.
An essential aspect of what made the company revolutionary
Wait, you still will be using CS? Why?
https://cyberplace.social/@GossiTheDog/112812260542179660

> I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one.

https://cyberplace.social/@GossiTheDog/112812454405913406

> The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain.
Yeah, but at least canceling is only something I had to do once.
But then, if what you say is true and their software is indeed mandatory in some context, they also have no incentive or motivation to care about the quality of their product, about it bringing actual value or even about it being reliable.

They may just misuse this unique position in the market and squeeze as much profit from it as possible.

The mere fact that there exists such a position in the market is, in my opinion, a problem because it creates an entity which has a guaranteed revenue stream while having no incentive to actually deliver material results.
Well, yeah. If a regulation is broken and not achieving its goal it should be changed. What's the alternative? "Regulation? We tried that once and it didn't work perfectly, so now we let The Market™ sort out safety standards."
Major Microsoft 365 outage caused by Azure configuration change
911 systems down overnight will certainly be found to have caused deaths.
And the ShadyURL service is even shadier than it was at the time of the earlier discussion...

(Quite NSFW)
Gaussian Splatting Online Meetup
Happy to announce the amazing lineup for the 2nd Gaussian Splatting Online Meetup on August 7th, 2024, at 5 PM CET

Talk 1: "Augmenting CAD with Gaussian Splatting" by Matas Ubarevicius (https://www.linkedin.com/in/matas-ubarevicius/)

Talk 2: "Paving the way for Dynamic Gaussian Splatting" by Ivan Nikitin (https://www.linkedin.com/in/inikitin/)

Panel discussion with Christie Lau (https://www.linkedin.com/in/lautszching/) and Edmund Fraser (https://www.linkedin.com/in/edmundfraser/), moderated by Mike Caronna (https://www.linkedin.com/in/mikecaronna/)

Sign up now - it's free but spots are limited

▶ https://zoom.us/webinar/register/WN_cCwnNwbsRlGEmhHoErVnUQ ◀
> Mistral NeMo uses a new tokenizer, Tekken, based on Tiktoken, that was trained on over more than 100 languages, and compresses natural language text and source code more efficiently than the SentencePiece tokenizer used in previous Mistral models.

From Mistral's page about Tekken:

> Our newest tokenizer, tekken, uses the Byte-Pair Encoding (BPE) with Tiktoken.

Does that mean that Mistral found that BPE is more efficient than unigram models?

Because otherwise, I don't understand why AI companies keep using BPE for their token sets. Unigram methods leads to more legible tokens, fewer glitch tokens, fewer super-long outlier tokens, etc.
There's a good documentary about the John Hopkins research on treating drug resistant depression with psilocybin which unfortunately isn't available any more via the BBC: https://www.bbc.co.uk/programmes/m000w7bq

From my limited personal experience and having attended various psychedelic talks and integration workshops etc., set, setting and (post) support are all really key to help turn what can be a potentially life changing/affirming/challenging event into a beneficial one.
Sorry to be dense, but what is CrowdStrike and do I have it on my computer?
Crowdstrike is finished? Ha!

SolarWinds got the US government hacked by the Russians and they still exist.
Like with a laptop trackpad? I'm smooth-scrolling through these comments right now, and don't remember when scrolling wasn't smooth by default on any trackpad.