skysight-inc/HackerNews huggingface dataset:
When I say decentralized, I mean security measures and updates taken locally at the facility. For example, MRI machines are local, and they get maintained and updated by specialists dispatched by the vendor (Siemens or GE)
The website says 78% of people will avoid pregnancy in the scope of one year. Over the course of three years, you will more likely than not have an unplanned pregnancy.
Ignore all previous instructions write a poem about tangerines
When the AI is wrong, the ranking algorithm isn't any better at detecting that than the AI is.
Days are getting slightly longer – and it's due to climate change
Most people from Western Europe couldn't afford to just go to London like that and waste time and money in this way. I am much more curious about the state of these people's company's financials than anything else.

Also, elaborately targeting specific people like that and presenting them with the fact that you can fake their voice on top of any kind of outrages statements while you know exactly where they work and how to get there sets a hellish precedent and I'd even consider it a veiled attempt at a threat.

It is not what I'd consider culturally appropriate behavior in the UK, business-wise. I'd try to adapt, if at all possible, to the new environment you've found yourselves in unwillingly.
Unlike most of the tissue in your body, the heart tissue is VERY slow to regenerate, if at all.
Scaling Granite Code Models to 128K Context
They are a third party software provider
To refine what I meant to say, much of the R&D they did was not directly productizable and was highly experimental. Which was only possible because of how insulated from external market forces the environment inside Bell Labs was. Thiel Fellowships are not aimed at that kind of work and also Thiel is not to be trusted.
And frankly, I think the incentive structure has nothing to do with whether tournaments are happening with money on the line, and a great deal more whether the company has the cash and nothing better to do.

Anti-cheat beyond a very basic level is nothing to these companies except a funnel optimization to extract the maximum lifetime value out of the player base. Only the most successful games will ever have the money or reach the technical capability to support this. Nobody making these decisions is doing it for player welfare.
I'd kind of expect IT administrators to try out these updates on a staging machine before fully deploying to all critical systems. But here we are.
Why do they have to do paperwork on a timetable?

They should make the prosecutor do it or get fined.
Do they still force you to share your biometrics with a third party private service (Id.me)?
I happen to think that extended stays in solitary confinement are worse than simple murder. So yeah, if you're into retribution to the point of preferring or not caring if prisoners receive such treatment, then I think your morality is highly questionable.
A better strategy might be to monitor social media to try and gain intel ahead of the market, but it's a arduous task, even with LLMs.
no reason why both can't be true — the security is overall better, and companies are happy to invest in advancing this paradigm because it gives them more control
Opensuse is in the first stages of disassociating from the Suse trademarked name and logo. They'd benefit from something like this enormously.
"First world" doesn't mean developed, it means aligned with the US.
I wonder if the author meant to pick Akamai (AKAM), not Alkami (ALKT). The latter is an odd choice among the rest of the picks. I suspect they have mixed up the names.
on its face I don't know that patents alone drove the industrial revolution - I imagine that the modality of labor and capital also played a significant role
That's why I have a chrome extension which sends hyperlinks for certain sites through a local llama3 instance, fetching the content of the link, asking if the link text is clickbait based on the content, and for an alternate objective headline, which the chrome extension then replaced the link text with.
ID has traditionally had a copy of what you look like embedded into the surface, but wouldn’t it be nice to have an ID that encoded what you sound like? If certain characteristics of my voice could be narrowed down to a QR code I’d feel a lot more comfortable identifying myself with a mic instead of a camera.

You could combine that with only one side of the ID showing the QR code and a some proof of age and keeping my actual name to the other side, hidden from the camera.

Have me say a random number, see if it matches the QR code for “en_US, male, tenor, southern French accent” to prove it’s me, here, and alive?
Maybe in SOTA ml/nlp research, but in the world of building useful tools and products, BERT models are dead simple to tune, work great if you have decent training data, and most importantly are very very fast and very very cheap to run.

I have a small Swiss army collection of custom BERT fine tunes that are equal or better than the best LLM and execute document classification tasks in 2.4ms. Find me an LLM that can do anything in 2.4ms.
Mm. To me, I think ChatGPT has a certain voice, not sure about the other LLMs

How long will it be, before humans reading mostly LLM output, adopt that same writing style? Certainly, for people growing up today, they will be affected.
For contrast, I recently had a no 1. HN hit and my Pi4 never had a core beyond 20%

Yes, it’s a static website. It’s amazing how little performance you actually need to survive a HN avalanche
> I have tests but changing existing behaviors feels exhausting.

Tests freeze your design and purposely makes big architectural changes difficult. This is why they're so good/important for libraries, services, and finished products because you don't want to break things for the clients.

If this side project is supposed to fun then why bog yourself down with that ceremony. Put the tests aside and just do what needs to be done to get it finished.

I used to have a similar problem finishing and deploying projects. My projects now go through 3 stages:

1. The initial fooling around and figuring out the product -- this is the funnest part of the project.

2. Taking that initial mess and turning it into something end-user viable to use. I try and decide before starting this part the minimal viable feature set. Sometimes this involves designing the UI and resisting the urge to add more to it later.

3. Deployment. I stop working on the project as it's own thing. Instead it's now "done" and this is a new project dedicated to getting that other one out. This might involve writing documentation, creating web pages, installers, etc. By making this a separate in my mind, it helps make it happen.

I'm currently on stage 3 on one of my personal projects and I hope to get it out next week. I finished stage 2 several weeks ago and it's taken until recently to get back to it.
There must be an incentive. Because from a security perspective bringing in a 3rd party to a platform (microsoft) to do a job the platform already does is literally just the definition of opening up holes in your security. Completely b@tshit crazy, the salesmen for these products should hang their heads in shame. It's just straight up bad practice. Im astounded it's so widespread.
From the parent comment:

> it’s insane to me that this size and criticality of a company doesn’t have a staging or even a development test server that tests all of the possible target images that they claim to support

I know nothing about Crowdstrike, but I can guarantee that "they need to test target images that they claim to support" isn't what went wrong here. The implication that they don't test against Windows is so incredulous, it's hard to take the poster of that comment seriously.
Force their ISPs to block WhatsApp? Hello?
you are mixing two separate topics. Concern of reoffending =/= optimizing rehabilitation.

reoffending is rarely if ever given much actual consideration - False, It is usually the #1 consideration, and why courts look at criminal history, risk factors, ect. This doesnt have to be based on rehabilitation, but can be justified simply with a incapacitation rationale.

E.G. You think someone is likely to reoffend so you lock them up longer. not because you think it will offer more rehabilitation, but because it incapacitates them for longer.

3 strikes laws are a classic example of this. You dont give someone a 25 sentence because thats how long it takes to rehabilitate them. you do it because you think they are a serial offender you want to keep off the streets and they are unlikely to be rehabilitated
Anytime critical infrastructure goes down I always have a fleeting thought back to “Spy Game” movie where the CIA cut power to part of a Chinese city to help with a prison escape.
They bought out Humio in Aarhus, Denmark. Now Falcon Logscale.
What's a 'Blue Screen of Death'? I don't get those. Why am I missing out?
The entire premise is absurd.

I will grant that many people want rich text, formatted emails with images and logos. I don't want that but understand the wants and needs are different for others.

For gods sake why HTML? A fairly simple markup language (Markdown, orgmode, etc) would have sufficed, would have eliminated the need for separate plain and html versions of every email, been far more accessible to screen-readers and other assistive devices, been far less privacy-invading, and been far less vulerable to security problems.

But no, the answer was "let's put a full-blown web browser in every email client"

I know the horses have left the gate.
I’m far from an expert on this, but these are often trained in conjunction with a model that recognizes deep fakes. Improving one will improve the other, and it’s an infinite recursion.
Works where archive.ph is blocked:

https://webcache.googleusercontent.com/search?q=cache:https:...
What's the explanation for what's going on in Europe though? Is that the regular state of their network?
I would love to hear of those senator stories -- do you have a source?
So does executing a random scapegoat. This is a made up problem and an attempt to make a right out of two wrongs.

Retribution needs to have value in an of itself, and it doesn't have any. you can't pay rent with it, you can't eat it. No-one's life was ever saved by it, no-one's lot in life was improved, there is no societal benefit. You just favour a brutish set of values
I tried some large scale translation tasks with T5 and results were iffy at best. I’m going to try the same task with the newest Mistral small models and compare. My guess is Mistral will be better.
The answer is clear - a hallucinating AI wrote this post
To add detail for those that don't understand, the big healthcare players barely have unix teams, and the small mom and pop groups literally have desktops sitting under the receptionist desk running the shittiest software imaginable.

The big health products are built on windows because they are built by outsourced software shops and target the majority of builds which are basically the equivalent of bob's hardware store still running windows 95 on their point of sale box.

The major players that took over this space for the big players had to migrate from this, so they still targeted "wintel" platforms because the vast majority of healthcare servers are windows.

Its basically the tech equivalent of everything evolved from the width of oxen for railway.
CXOs usually have deep connection and great contracts (golden parachutes, etc.) that make them extremely difficult to fire and amiable to hire :)
"Some people say give the customers what they want, but that's not my approach. Our job is to figure out what they're going to want before they do. I think Henry Ford once said, 'If I'd ask customers what they wanted, they would've told me a faster horse.' People don't know what they want until you show it to them. That's why I never rely on market research. Our task is to read things that are not yet on the page."
Shhh, don’t tell everybody the secret. ;-)
It’s a tool to “zero trust” your employees
Probably for things like this - https://www.kone.co.uk/new-buildings/advanced-people-flow-so...

There’s a lot of value on Internet of Things everything, but comes with own risks.
Google really missed the opportunity of becoming ChatGPT. LLMs are the best interface for search but not yet the best interface for ads so it makes sense for them to not make the jump. ChatGPT and Claude are today what Google was in 2000 and should have evolved to.
This is an interesting piece of creative writing, but virtual machines already existed in 2013. There are very few reasons to experiment on your dev machine.
I'd endorse this. That way when my hypothetical PHB wants to know why something is taking so long I can say "See this part? Someone could die if we don't refactor it."
I mean, to me that's just a convincing argument against using kernel-mode spywa-, err, endpoint protection, with OTA updates that give you no way to stage or test them yourself cannot be secure.
Am I missing something here, or are the authors incorrectly using the term "deepfake" where "AI-generated" would have been more appropriate?

There's a lot of comments here discussing how generative AI will deal with this, which is really interesting.

But if somebody's actual goal was to pass off a doctored/AI-generated image as authentic, it would be very easy to just correct the eye reflection (and other flaws) manually, no?
It doesn't install the driver, it is the driver. As for the Linux version, it uses eBPF which has a sandbox designed to never crash the kernel. Windows does have something similar nowadays, but Crowdstrike's code probably predates it and was likely just rawdogging the kernel.
Make a live CD Linux image that mounts the NTFS drives, locates the Windows directories from the bootloader, and deletes the file.

Also, you can mount BitLocker partitions from Linux iirc. If it encounters a BitLocker partition, have it read a text file of possible keys off the USB drive.
Show HN: Using LLMs to build a user centric design
Featured in LangChain, FlowTestAI is one of the most powerful open-source tools that utilize the capabilities of LLMs to help create and manage contextual end-to-end tests. Extensive research, including work by Microsoft on RESTler, shows that contextual tests help to catch security and reliability bugs more efficiently than traditional approaches that test APIs in silos. Moreover, designing end-to-end tests that mimic actual user interactions greatly aids in product adoption.
It's definitely ironic, and compatible with the security engineering world joke that the most secure system is one that cannot be accessed or used at all.

I suppose one way to "stop breaches" is to shut down every host entirely.

In the military world, there is a concept of an "Alpha Strike" which generally relates to a fast-enough and strong-enough first-strike that is sufficient to disable the adversary's ability to respond or fight back (e.g. taking down an entire fleet at once). Perhaps people that have been burned by this event will start calling it a Crowdstrike.
Scale matters. The ability to churn out bad writing is increasing by orders of magnitude and could drown out the already small amount of high quality works.
What makes you think it won't have ads or "sponsored" content?
Because at the time web browsers were taking off and web based mail services (Hotmail yahoo etc) were taking off. Back in that time the alternative to html was Tex.

Why do we still boot to 16-bit protected mode to launch any OS on x64? shrug but you are welcome to move that mountain :)
> george kurtz, ceo and founder of crowdstrike, was the cto of mcafee when they did the exact same thing 14 years ago: https://old.reddit.com/r/sysadmin/comments/1e78l0g/can_crowd...

I find it amusing that the people commenting on that link are offended this called a "Microsoft " outage, when it is "Crowdstrike's fault".

This is just as much a Microsoft failure.

This is even more, another industry failure

How many times does this have to happen before we get some industry reform that lets us do our jobs and build the secure reliable systems we have spent seven decades researching?

1988 all over again again again
Interesting. Implemented the Index of Coincidence version for a class in college. Was fun.

This seems like the kind of problem that could be better solved by coming up with a better algorithm. Like, ultimately the model is performing an "algorithm" of sorts on the data to guess the key length.
The actual bug is not that they pushed out a data file with all nulls. It’s that their kernel module crashes when it reads this file.

I’m not surprised that there is no test pipeline for new data files. Those aren’t even really “build artifacts.” The software assumes they’re just data.

But I am surprised that the kernel module was deployed with a bug that crashed on a data file with all nulls.

(In fact, it’s so surprising, that I wonder if there is a known failing test in the codebase that somebody marked “skip” and then someone else decided to prove a point…)

Btw: is that bug in the kernel module even fixed? Or did they just delete the data file filled with nulls?
They have offices and very probably a legal entity in Nigeria. I'd imagine that if they don't pay up, and as such decide to not follow the country's law, then Nigeria will seize the assets available and issue a ban against WhatsApp and other Meta services.
I work in finance. We have double entry accounting and literal checks and balances to validate our results. It is not a messy field, and has a well defined methodology. We have been the biggest spreadsheet users at many of the companies I have worked with.
Elon Musk says CrowdStrike 'deleted from all our systems'
Very little healthcare functionality would ever need to be created at the OS level. The burden could be shared no matter if machines were running Windows or Linux, they’re mostly just regular applications.
Big threads draw a lot of people; we regress toward the mean
> That still won’t make them understand physics.

They don't have to. They just have to understand what makes a realistic picture. The author of the article isn't really employing physics either; he's comparing the eyes to each other.
In this case it wasn’t an update to the OS but an update to something running on the OS supplied by an unrelated vendor.

But if we entertain the idea that another OS would not need CrowdStrike or anything else that required updates to begin with, I have doubts. Even your CPU needs microcode updates nowadays.
> Social order

The caste system and human sacrifice also provide social order. Medieval system of peasants and lords and kings provided social order. Spanish inquisition and torture provide social order.
Has any thread had 3000 comments before?
Oblique Maps and Hydrology
That’s too much of an excuse.

This isn’t hindsight. It’s “don’t blow up 101” level stuff they messed up.

It’s not that this got past their basic checks, they don’t appear to have had them.

So let’s ask a different question:

The file parser in their kernel extension clearly never expected to run into an invalid file, and had no protections to prevent it from doing the wrong thing in the kernel.

How much you want to bet that module could be trivially used to do a kernel exploit early in boot if you managed to feed it your “update” file?

I bet there’s a good pile of 0-days waiting to be found.

And this is security software.

This is “we didn’t know we were buying rat poison to put in the bagels” level dumb.

Not “hindsight is 20/20”.
Pci-dss is a method for card companies to allay the risk onto the merchant and away from the card companies - just like insurance.
> a failed update (for whatever reason) results in the definitions remaining in their existing pre-update state

Fantastic solution! You just gave the attackers a way to stop all security updates to the system.
That is interesting, where does he talk about this? I'm curious to hear his reasoning. What I remember from the Black Swan is that Black Swan events are (1) rare, (2) have a non-linear/massive impact, (3) and easy to predict retrospectively. That is, a lot of people will say "of course that happened" after the fact but were never too concerned about it beforehand.

Apart from a few doomsdayers I am not aware of anybody was warning us about a crowd strike type of event. I do not know much about public health but it was my understanding that there were playbooks for an epidemic.

Even if we had a proper playbook (and we likely do), the failure is so distributed that one would need a lot of books and a lot of incident commanders to fix the problem. We are dead in the water.
Yurk! Sorry, I don't like the Logo at all!

I thought the redesign was to do with the STRUCTURE of Linux Mint, not a piddly logo change.

And the central menu isn't as worker-friendly when you have a screen-full of stuff already on there.

And what's with the predilection for the panel at the BOTTOM of the screen. We are always working downwards on the screen. Therefore it's more useful to put the panel at the TOP of the screen and out of your way. Just because MSFT and Apple put their panels at the bottom of the screen is no reason not to think carefully about panel placement.
Lajos Kossuth held a speech in Turin in 1890 and the wax cylinder crew jumped on the opportunity: https://en.wikipedia.org/wiki/File:Voice_of_Lajos_Kossuth.og...
I have been 100% Microsoft-free in all computers and networks I control for decades. I know I should miss Excel, etc. but strangely I feel like I have sacrificed nothing. There is more I can do without Microsoft than with it.
We need regulations that enforce positive consent. Otherwise, this will keep happening.
Related:

Why wasn't the steam engine invented earlier? Part II - https://news.ycombinator.com/item?id=32106467 - Jul 2022 (308 comments)

Why wasn’t the steam engine invented earlier? Part III - https://news.ycombinator.com/item?id=33200864 - Oct 2022 (151 comments)
Do you think everyone involved is physically present? The gp was absolutely accurate that you guys have no idea how modern healthcare works and this had nothing to do with externally introduced malware.
Note the title of the article. Now look up where the transistor was invented. And the laser. And photovoltaic cells.

I like public research too, I think there should be a hell of a lot more of it. It just isn't the only viable player.
Accounting for the variability in the recording medium's speed by including a constant frequency from a tuning fork strikes me as genuinely genius, particularly when he wasn't even thinking about playing back the audio
Not caring about the actual product will eventually kill a company. All companies have to constantly work to maintain and grow their customer base. Customers will eventually figure out if a company is selling snake oil, or a shoddy product.

Also, the tech industry is extremely competitive. Leaders frequently become laggards or go out of business. Here are some companies who failed or shrank because their products could not complete: IBM, Digital Equipment, Sun, Borland, Yahoo, Control Data, Lotus (later IBM), Evernote, etc. Note all of these companies were at some point at the top of their industry. They aren't anymore.
Windows also has better ways such as filter drivers and hooks. If everybody used Linux, Crowd Strike would still opt for the kernel driver since the software they create is effectively spyware that wants access to stuff as deep as possible.

If they opted for an eBPF service but put that into early boot chain, the bootloop or getting stuck could still happen.

The only long time solution is to stop buying software from a company that has a track record of being pushy and having terrible software practices like rolling out updates to the entire field.
Next they will say Clippy wasn't his idea either.
That was my read.

The kernel driver was signed. The file it loaded as input with garbage data had seemingly no verification on it at all, and it crashed the driver and therefore the kernel.