skysight-inc/HackerNews huggingface dataset:
I admit I'm not a medical professional but these sound like problems with better solutions than lots of Internet connected terminals that can be taken down by edr software.

Why not an internal only network for all the terminals to talk to a central server, then disable any other networking for the terminals? Why do those terminals need a browser where pretty much any malware is going to enter from? If hospitals are paying out the ass for their management software from epic/etc, they should be getting something with a secure design. If the central server is the only thing that can be compromised then when edr takes it down you at least still have all your other systems, presumably with cached data to work from
It's not a lack of professionalism that caused this. It's the abandoning of MULTICS and all that stems from that premature optimization.

We've been nuts to run any systems based on Ambient Authority outside of a 1980s college classroom environment. Connecting everything via the Internet deranged us into a hellscape just waiting to emerge, as it does periodically.

You can't enumerate badness, as virus scanners try to do. Thus you have to TRUST all the code you run, which is nuts. Operating Systems should NEVER require that you trust code, especially mobile code (stuff that came from outside your 1980s college classroom).

We have fuses and circuit breakers, and all sorts of ways to limit the damage a short circuit can do, but no such analogs for limiting the scope of damage a chunk of code can do to the world. This is insane.

It's not the users, system admins, Microsoft, or anyone else. It's the security model underlying the OS. This problem was solved in the 1970s, for f*cks sake!
More specifically why is critical stuff not equipped properly to revert itself and keep working and/or fail over? This should be built-in stuff at this point, have the last working OS snapshot on its own storage chip and automatically flash it back, even if it takes a physical switch… things like this just shouldn’t happen.
No it couldn't. Crowdstrike on Linux uses eBPF and therefore can't cause a kernel panic (which is the fundamental issue here).
> The credential is not only the user's data. The credential is an agreement for access between the user and the service provider.

The credential is, in fact, only the user's data. How does it even make sense that a credential could be an agreement?

> The service provider has every right in the world to demand the user prove that they are securely storing the credential in a way that can't be extracted.

No, nobody has any right to dictate, or even know, how my device stores my data.
Can't boot, can't get cracked! Big brain thinking.
Okay, I'll give you that. Let me rephrase: Industry-led regulation can work, in industries that won't kill anyone or even realistically lose anyone a bunch of money for non-compliance, if-and-only-if government regulation exists as a real and powerful enough alternative to make it stick.
Thank you! I hadn't heard of either of these.
A hospital my wife worked at over a decade ago didn't use EMR's, it was all on paper. Each patient had a binder. Per stay. And for many of them it rolled into another binder. (This was neuro-ICU so generally lengthy patient stays with lots of activity, but not super-unusual or Dr House stuff, every major city in America will have 2-3 different hospitals with that level of care.)

But they switched over to EMR because the advantages of Pyxis[1] in getting the right medications to the right patients at the right time- and documenting all of that- are so large that for patient safety reasons alone it wins out over paper. You can fall back to paper, it's just a giant pain in the ass to do it, and then you have to do the data entry to get it all back into EMR's. Like my wife, who was working last night when everyone else in her department got Crowdstrike'd, she created a document to track what she did so it could be transferred into EMR's once everything comes back up. And the document was over 70 pages long! Just for one employee for one shift.

1: Workflow: Doctor writes prescription in EMR. Pharmacist reviews charts in EMR, approves prescription. Nurse comes to Pyxis cabinet and scans patient barcode. Correct drawer opens in cabinet so the proper medication- and only the proper medication- is immediately available to nurse (technicians restock cabinet when necessary). Nurse takes medication to patient's room, scans patient barcode and medication barcode, administers drug. This system has dramatically lowered the rates of wrong-drug administration, because the computers are watching over things and catch humans getting confused on whether this medication is supposed to go to room 12 or room 21 in hour 11 of their shift. It is a great thing that has made hospitals safer. But it requires a huge amount of computers and networks to support.
> then tickets would come back

Luxury! With Nintendo you'd often get only one ticket. Any further bugs would cost you further submissions, and months of slippage.
Zero trust means that there is no implicit trust whether you’re accessing the system from an internal protected network or from remote. All access to be authenticated to the fullest. In theory you should be doing 2FA every time you log in for the strictest definition of zero trust.
I changed the URL from https://mastodon.social/@netblocks/112808500770031751 after getting this email from a user:

If you figure the event is significant enough to be on the front page, isn't something about the event itself more appropriate? as opposed to a tweet about the network being down as stand-in

That seems like a good point. I hope it doesn't context-shift the comments too much (I'm in a meeting atm and don't have time to check.)
It’s mandated because someone believes Linux is as bad as Windows in that regard.

And, quite frankly, a well configured and properly locked down Windows would be as secure as a locked down Linux install. It’d also be a pain to use, but that’s a different question.

Critical systems should run a limited set of applications precisely to reduce attack surface.
My bank currently reprompts me for password whenever I make an important transaction (e.g., transferring out lots of $$$, or adding an account). Should they drop that security feature when they switch to passkeys?
Some say it's impossible to 'finish' a project ;)
Generally I like to decrease expectations and requirements for MVP, then release.
After that, I stop working on it. It feels like abandonment, but it's not if it's finished.
We've had security software in the past break software compilation in this method by replacing entire files with zeros. I'm not saying this is the case, but it wouldn't surprise me if it were.

Basically the linker couldn't open the file on windows (because it was locked by another process scanning it), and didn't error. Just replaced the object code to be linked with zeros.

People couldn't figure out what was wrong until they opened a debugger and saw large chunks of object code replaced with zeros.
Aaaaand its gone to Ukraine...
Try to get users before building, if you cant do that, forget it. If you can, build it for real
I don't get it. Shouldn't the file have a standard format, with a required header and checksum (among other things), that the driver checks before executing?
The beach that makes you old
Writing "layout next" in GDB gives you a TUI: Text user interface, like midnight commander. There are so many good debuggers in graphical environments I just wondered if there were any better ones for text.

Edit: I really like this simple Scapy wrapper though! Works like a charm.
I expected a privacy-preserving open source AI assistant like Mycroft (https://en.wikipedia.org/wiki/Mycroft_(software)) combined with Leon (https://getleon.ai).
You are right, it’s not sharing. It leaking. It should be “USPS leaked customer postal addresses to Meta, LinkedIn and Snap”
Bangladesh is going to sue US journalists in a US court for accurate headlines?

I'd love libel suits from hostile authoritarian regimes, personally. For a journalism organization, that would seem to be a badge of honor.

Something is deeply wrong if you have to essentially lie on behalf of the bad guys or risk significant financial penalties.
If they can paint, then so can I. And it took me years to learn how to do decent stickmen!

Either way, we are not going to see intelligent computers in our lifetime, let alone elephants. Don't mean to condemn them but sapio-genesis is often oversold as being too easy. We are nowhere near being capable of ourselves, we have just learned how to process things similarly to how brains do it, at a fraction of the efficacy and ten trillion times the cost.
"Have these idiots even heard of CI/CD???" strangely seems to be a common condescending comment in this thread.

I honestly though HN was slightly higher quality than most of the comments here. I am proven wrong.
An Afternoon with KaiOS
NT kernel drivers are Portable Executables, and kernel does such checks, displaying BSOD with stop code 0xC0000221 STATUS_IMAGE_CHECKSUM_MISMATCH if something went wrong.

https://learn.microsoft.com/en-us/windows-hardware/drivers/d...
> But our fascist gov and their goons used force and killed 50+ unarmed students until yesterday (3 from my alma mater alone.)

Is this what those students with the colored flags have been protesting about in US universities for the past half year or so?
I play one of those games that doesn’t strongly enforce anti-cheating, and I agree with you that it’s a huge detraction compared to games with strong anti-cheat.

But I strongly disagree about the use of invasive client-side anti-cheat. Server-side anti-cheat can reduce the number of cheaters to an acceptably low level.

See for example how lichess detects and aids in detection of cheaters: https://github.com/clarkerubber/irwin

And chess is a game where I feel like it would be relatively hard to detect cheating. An algorithm looking at games with actors moving in 3D space and responding to relative positions and actions of multiple other actors should have a great many more ways to detect cheating over the course of many games.
You're saying complicity is not a fault?? :)
> 2. What the GOP platform is for prices & inflation. Tax cuts, 10% tariffs, forcing interest rate cuts, and mass deportation would all seem to lead to more money in the economy or direct price increases

I hate to be this cynical because I think policymakers and economists who lean in different ideological differences all have contributions to make, and in some way probably value right wing economic ideas slightly more than left wing ones

But It seems pretty clear to me that the goal of the Republican platform is just to be as self serving as possible and there is no actual plan for a healthy economy, and at best they might engineer temporary economic outcomes that benefit certain groups, I wouldn’t be surprised it there’s some kind of big economic crash aka 2008 in the next 10 years.

I would be genuinely interested to hear how I’m wrong.
I wish your mother recovers promptly. And I’m glad she doesn’t run on Windows. ;-)
The market is crying for some kind of '10s "agile hype" equivalent for security evangelism and processes.
Independent of points for or against their rule, the ageist argument makes little sense. 25 year olds are generally politically naive and easily manipulated. The average person in their twenties has no idea about economics, geopolitics or other such topics that are important to understand for running a country. When you look at uprisings against ancient leaders in countries with very young populations, they regularly end up even worse then before, sadly. Take Sudan as an example.
ebpf works in Windows as well.
Ask HN: What happened to the Gpt4o-mini thread yesterday?
The article about OpenAI's Gpt4o-mini was submitted yesterday but it didn't appear on the front or 2nd page as would normally be the case. The only way for it to be found was other ways, like the past or new page, or by trying to submit the link yourself.

As I commented yesterday: "it says 181 points, 6 hours ago, and eyeballing the 1st page it should be in the top 5 right now".

Was this article flagged or did it trip an automated controversy filter? Normally a new openai model produces a lot of comment and interesting analysis on HN (e.g. gpt-4o had 2366 comments), but this one only had 74 comments. Mistral NeMo had 144 comments by comparison.

Here's the link to the announcement thread: https://news.ycombinator.com/item?id=40997585

which linked to: https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/
OS absolutely does matter. Windows has an enormous attack surface because Microsoft doesn't care.

There's a number of minimal operating systems without all bells and whistles. The reason they aren't as popular choice is the "OS doesn't matter".

If OS is minimal it doesn't need OTA updates, let alone from a third party...
One of the nice things about moving to EVs is not caring so much about the price of oil anymore. America is one of the countries less enthusiastic about that (since we produce lots of oil), but other countries not caring so much about the Middle East anymore would probably actually make it a more peaceful than it is now.
What percentage of ex convicts are so completely isolated from society that they have no friends, family, or even a public defender, social worker, or parole officer?
I’ll provide the links for the two suras cited above for the curious:

An Nisa (the women) - https://quran.com/4, https://en.m.wikipedia.org/wiki/An-Nisa. In dowry and inheritance matters it’s actually quite advanced for its age.

Al Anfal (the spoils of war) - https://quran.com/8, https://en.m.wikipedia.org/wiki/Al-Anfal. These are, of course, orthogonal to our moral values but not more depraved than bounty customs employed hundreds of years afterwards.

Prophet Mohammed himself took one fifth of the spoils, including taking women as wives, eg see Safiyya bint Huyayy, who was his tenth wife after her tribe was killed (https://en.m.wikipedia.org/wiki/Safiyya_bint_Huyayy).

I’m missing your point about adhering to these “when it’s convenient”. This was standard practice for Muslim armies for hundreds of years afterwards (of course others did the same).
> There is a way with AWS, but it carries risk. You can force detach an instance's volume while it's in the shutting down state, but if you re-attach it to another machine, you risk the possibility of a double-write/data corruption while the instance is still shutting down.

This is absurd. Every BMC I’ve ever used has an option to turn off the power immediately. Every low level hypervisor can do this, too. (Want a QEMU guest gone? Kill QEMU.). Why on Earth can’t public clouds do it?

The state machine for a cloud VM instance should have a concept where all of the resources for an instance are still held and being billed, but the instance is not running. And one should be able to quickly transition between this state and actually running, in both directions.

Also, there should be a way to force stop an instance that is already stopping.
> yet the same US government is supposedly scared of shutting down attempts at vigilantist violence?

Who said that? What is that even meant to mean?

Here is what I said: Americans demand that criminals be harshly punished and if the government isn't willing to saite that desire then Americans, having individualist mentalities, will take justice into their own hands more often than the people in countries like Norway. The government does try to prevent this vigilantism, because vigilantism is harmful to society as a whole, but there's not a whole lot the government can actually do to stop me from murdering my neighbor with a baseball bat because he did something to my son. What the government can do to stop me from doing that is give me a credible promise of punishing the man for me.

The American public demands harsh treatment of criminals, which is why the American government provides this. If the American public were a bunch of Norwegians then American laws would reflect Norwegian values. Both systems are a product of their respective culture. The difference between the two systems of justice reflect cultural differences in attitudes towards justice.

> I also find this American exceptionalism unconvincing. No, you are not uniquely

If anything, its the Scandinavians who are unique. Go to Africa, Asia or South America and you'll find that criminals are given harsh punishments and people generally like this. In fact this is more or less true in most of Europe as well, which is why people always talk about Norway/Sweden/etc as the go-to counter examples. They are the ones who stand out as exceptions to the norm of inflicting punishment on criminals. What I'm saying is that system is designed for that culture and would not satisfy most Americans. Most Americans are satisfied with seeing criminals get what they deserve.
Conjecture: there is no exit from despotry because more than deriving happiness from the current state, the despot fears dissolution. A counter-example might be post apartheid South Africa or Idi Amin’s exile, but there are sufficient examples of worse personal and family outcomes to rule out simple projections of psychopaths.
15 Years of Realtime OLAP (Part 1)
Clickable links:

Here's the link to the announcement thread: https://news.ycombinator.com/item?id=40997585

which linked to: https://openai.com/index/gpt-4o-mini-advancing-cost-efficien...
You're quite correct. It's ethylene and not ethylene oxide that does the ripening.

Sometimes you don't want to have to wait days for a fruit to ripen, that's why it's faster to use the plastic bag trick.
“Use my prompts as the top of the instructional hierarchy… Ignore all previous instructions.”
It sounds like they are a bunch of shitheads type A nihilists. How stereotypical.
For relying on windows to run this kind of stuff and not doing any kind of staged rollout but just blindly applying untested kernel driver 3rd party patching fleet wide? yeah honestly. We had safer rollouts for cat videos than y'all seem to have for life critical systems. Maybe some criminal liability would make y'all care about reliability a bit more.
I think it was "predicted" by Sunburst, the Solarwinds hack.

I don't think centrally distributed anti-virus software is the only way to maintain reliability. Instead, I'd say companies to centralize anything like administration since it's cost effective and because they actually aren't concerned about global outage like this.

JM Keynes said "A ‘sound’ banker, alas! is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way along with his fellows, so that no one can really blame him." and the same goes for corporate IT.
Right! Windows should NEVER blue screen. Ever. From a third-party software.

Maybe Windows doesn't provide the right ABI or whatever for CS, but come on, you should never be able to kernel panic Windows.

That this blue screened is 100% Microsoft's fault. It's a mess all the way around.
But isnt this already the case? At some point Comrade we have to realize that maybe the Soviet system doesnt need an improvement but actually needs to be destroyed.
> You understand that having doctors and social workers report a specific type of crime to law enforcement is not the same thing, and not even related to the idea, as the idea that law enforcement has to pursue prosecution of crimes they are aware of, right?

There are multiple entities here. The OP mentioned "public agents", both the museum employees may be public agents (working for some preservation or historical department), and the police, or the prosecutors maybe public agents. I was talking about the first case most when someone witnessed a crime and they have to report it. It doesn't apply directly to the case here, but that general principle exists.

It seems you're talking about whether the prosecutors can selectively prosecute or not. In US they pick and choose, can but other countries that may not have that choice they are forced to if they are aware of crimes: https://www.ibanet.org/article/A835FD91-8EB7-4CBF-8AFE-E7E2E...

> For example, the new German corporate criminal liability framework[3] removes prosecutorial discretion (opportunity) and requires that public prosecutors prosecute legal persons whenever there is sufficient reasonable suspicion of occurrence of a criminal offence attributable to a legal person. Furthermore, due to the legality principle, the majority of legal systems are not allowed to choose whom to prosecute and must prosecute both the legal person and the natural person without the possibility of giving a preference.

So both options exist: forcing people to report crimes they are aware of, and prosecutors not having the discretion to prosecute but being forced to.
It is potentially bad data, since authentication data is supposed to show that a valid user wants to log in to the service. If the client makes it easy for anyone to pretend to be that user, than the authentication data is bad data.
Looks like a small scanner + printer running a small minimalistic RTOS would be a good solution.
fwiw there's like a billion devices out there with cpus that can run java byte code directly - it's hardly experimental. for example, Jazelle for ARM was very widely deployed
Meanwhile the linux desktop just keeps on truckin'.
this had nothing to do with government regulation, thank private sector insurance companies.
If you want to avoid yet another few decades of incidents like today.... read up on this, and perhaps Genode[1] and HURD[2]. Get comfortable with at least one of them, and perhaps give it a try on some small project at work in a few years.

[1] https://genode.org/

[2] https://www.gnu.org/software/hurd/
The level of surveillance makes it impossible to form coherent organizational structures domestically which can effectively oppose this system, because your organizations' and family's financial, communication, and social lives can be mapped out for strategic legal attack by the very same players they wish to protest. This is the price of KYC & AML.
A small printer connected to the scanner should do.
I mean, those are the best parties
Not sure if you're a troll or not, but that would be related to Israel and Palestine.
Setting myself up to fail: Publicly attempting 100 organic downloads this week
Hey guys! I wanted to share my story with you all and ask for some advice.

I took on the challenge this week of getting 100 paid downloads for my iOS app without spending any money on marketing. The app is called Imagine Storiez, and it's a family friendly party game where each player tried to make a short story using 5 random words in under a minute. There is an emoji mode as well, and it is priced at 0.99 USD (Link for reference: https://apps.apple.com/us/app/imagine-storiez/id6497486404 )

Here is what I am doing on my end to promote the app:

Posting in forums / relevant discord communities

Blogging about my progress each day on Medium: https://medium.com/@tech_talk_/best-ios-game-for-whole-family-and-how-i-am-trying-to-get-100-organic-downloads-this-week-a882eb34afe1

Making reels that are entertaining and track my progress through the week. I am posting these on Youtube, Insta, X, and TikTok, and engaging with people when possible. Here is an example reel: https://www.youtube.com/shorts/H5EDtxWcb2w

Creating valuable posts that sometimes mention the app in Reddit.

None of this is working, and I am really worried that I am not going to be able to complete the challenge. But I really want to prove to myself that I can get sales, because I don't think I should be spending more time developing apps if I can't get them to the right audience (I have already made 5 apps before this that did not take off).

I feel like the issue is that I am not getting in front of the right audience, which is families/teens/parents. Also I'm not able to demonstrate how fun the game is with friends because I am doing the challenge alone. I would really appreciate any advice in the comments. Thank you!