skysight-inc/HackerNews huggingface dataset:
Back in the 1990s when Microsoft wanted to enter the embedded systems market there was a saying "You don't want Windows controlling your car's breaks". We now let them control a huge part of our lives. Should we let them add AI to the already unpalatable cocktail?
Yeah, I feel like there's a real culture problem on HN right now, especially for topics that have received any degree of hype (AI and crypto, mainly). People can be excessively rude for no reason if you express an outsider view. Gets to the point where I can't trust anyone here to engage with me in good faith (the exceptions are a welcome blessing).

I've come close to blocking the site on my network many times but it's an absolute goldmine of interesting info too... I'm not really sure if there's a solution, other than to practice emotionally disengaging from internet discussions.
It used to be easier to sort Teams, but that's admittedly too many without hyperscroll.

Group chats are quick to make, refresh to the top, and naturally expire. It's nice that chats can be renamed to focus on a topic.
Sure, but it seems solve-able (even decoding urls one by one with captcha is better than nothing)
That is not an understatement. This is literally the largest failing of internet infrastructure to date.

Alas, using the internet has given us a lot of efficiency. The trade off is resilience. The entire global system is more brittle than ever but it what gave it such speed.
They are not willing perhaps? Why cannot they?
Major Windows BSOD issue takes banks, airlines, and broadcasters offline
Scoop: Meta won't offer future multimodal AI models in EU
It’s most likely the flame war filtering algorithm of HN. Posts that create a lot of discussion quickly are down ranked until an admin fix the rank manually, or not.
> Many (most? all?) nation-states have compulsory service

"The following 113 countries and territories have been identified as having no enforced conscription"

"The following fifteen countries have been identified as having a civilian, unarmed or non-combatant service optional alternative to compulsory military service"

"The following 19 countries have been identified as having no defense forces or as having no standing army but having very limited military forces"

https://en.wikipedia.org/wiki/Military_service
Chances if Microsoft or Crowdstrike will be held liable for financial losses caused by this outage?
CrowdStrike Falcon has a Linux product line for 'cloud security'.
Tried, "Real time quote data is not available". Big brain move, can't crash the stock price if the nasdaq is offline..
Can't wait for the Kevin Fang video about this.
> realtime protection of windows systems against various threat actors

So it's AV + a firewall? What does it actually do?
Because they made a continuing choice over the years to write their systems to rely on windows?
The repo map is computed dynamically, based on the current contents of the coding chat. So "importance" is relative to that, and will pull out the parts of each file which are most relevant to the task at hand.
Well, from the perspective of optimal play the more complex and changing nature of MTG means that optimal play is harder to find and doesn't stay still, so there's a lot more metagame of figuring out what that play is.
HN has some flame war protection I remember having read, downrating some discussions where it assumes nothing useful is being discussed.

Maybe a false positive? (100% speculation. That's the problem using closed source software)
Probably the key is to assume worst case scenario will always apply.
After all space is an hostile enviroment you cannot control, and you need to have the device working for at least the whole mission lifetime.
Nice website, Naya!
Mariupol is now de-facto Russian territory (it is administered/occupied by Russians) and you would need to either go from Russian side or cross the frontline.

(Please correct me if I'm wrong.)
I'd guess also a significant proportion of us are involved in our company's response to the incident.
Because reasons!
Yes, this has had no (statistically significant) effect.
None whatsoever, their contracts with customers will limit liability to the price paid for the software/subscription. If there was open-ended liability for software failures then very little software would get written.
I feel that the sarcasm was lost - what went out here was an, ahem, “functionally tested” diaper.

QC before restocking is fine. On the shipping side you just check that it’s the right product and that the packaging is intact and not indicative of damage.
Year of the Linux desktop at last!
> constantly yapped about how many bigger enterprises than ours completed their rollouts in just a couple of weeks.

Evidence is pointing towards him actually being right about this, despite likely being wrong about everything else.

It'd be worth giving him a call, just to check in how he's going, and take him up on the offer to fire you as a client.
Good news (um, as in better than the bad news today) is the plane won't be taking off anyway, so you're golden.
oh, you think security won't mandate to run CS on linux.

Granted it didn't down linux this time but nothing is stopping it.
just out of curiosity I wanted to check whether I had some goo.gl links that I might want to migrate but apparently goo.gl now redirects to this announcement.

Would be happy to know if there is a way to access goo.gl links created while logged in with my account.
Yep, this is technical legacy in action.
2024!!! The year of Linux on the desktop!
They could publish it with public key encryption, so you can verify existing links without seeing all the links
It’s not a meme, the man really can’t write an ending to save his life. But generally the pages other than the last ~25 make it totally worth it (other than that post-death MMORPG book, that one was terrible and just a slog the whole way through).
i've seen photos of the bsod from an affected machine, the error code is `PAGE_FAULT_IN_NONPAGED_AREA`. here's some helpful takeaways from this incident:

1) mistakes in kernel-level drivers can and will crash the entire os

2) do not write kernel-level drivers

3) do not write kernel-level drivers

4) do not write kernel-level drivers

5) if you really need a kernel-level driver, do not write it in a memory unsafe language
So Crowdstrike protects your computers from cyber attacks. But who is going to protect you from Crowdstrike?
I’m churning out mediocre boilerplate here and it’s working great! Managing to build things crazy fast.
Consume a lot of CPU and occasionally delete development build artifacts?
It's not a "3 step solution" that some IT guy can do now. It's a high level critique of using Windows and ignoring known problems.
"Always look on the bright side of life!" - M Python
Can they recover this OTA considering the systems can’t even boot?
It's eye-opening how bad our crucial IT infra is nowadays. Running in-kernel third-party tools (AV) on critical infrastructure on Windows? Central banks? Control towers? Seriously? We should fire everyone involved and start IT from scratch. This level of negligence cannot be fixed.
I'm Norwegian. For my first few years living in the UK people regularly asked if I was Polish when they heard my accent. It seems a lot of people just try to map an accent to one of a very few stereotypes whether or not it fits, and if it doesn't they assume [nationality they've recently read about]. It changed to Romanian - which notably sounds nothing like Polish - after the papers moved on to worrying about Romanian immigrants.
Russia is a lot like west if you stick to the big cities. Sometimes it's "more western than the west", some people just eat in fast-food chains. Well, at least when I was there before the war.
Absolutely shameful display of how the cure can be worse than the disease. It's nonsense snake oil and security theater such as this that throws the cyber"security" industry into disrepute. One may as well have just installed McAfee Anti Virus.
Sounds like a time to buy SPX (always has been).

Joke being I have given up trying to time markets :-). With some rare exceptions to the rule (once in 10 year type things).
Need something like a hypervisor OS/hardware that isnt IME.
This is a sample of what Y2K would look like if not for the countermeasures.
Terrible, as is inflation, as is almost everything else, and in the south of the country you got hezbollah bombing things. I'm not Lebanese so just know what I know from close friends, but the comment read very strange to me. Life is very difficult there, none of the Lebanese I know want to move back. I'm not sure why OP painted it as an anarchist utopia, that's definitely not what I hear.
July 2024 global IT outages
All antivirus software is indistinguishable from malware.
If it was really all about non-lethal defense, weapons would look a lot different, and many current weapons would simply be banned, with anyone owning or employing such weapons getting forced -- by non-lethal force -- to give them up.
It is scary if all the core infrastructure is based on windows.
End Poem by Julian Gough
The problem is that the USPS isn't really a "government agency". It's a weird hybrid where in some ways the USPS is more or less forced at act as a private company would. I agree that it's bonkers that a national postal service would need to "market its products", but the USPS is constantly facing funding issues (in no small part due to its weird setup), so they have to do something to... well, drum up business.

I agree that they shouldn't be using tracking code from Facebook etc. for their analytics, but they do need analytics of at least some sort. I think that should hopefully be uncontroversial.
I highly doubt their SLA says something about compensating for damages. At most you won't have to pay for the time they were down.

And even more ironically; A botched update doesn't mean they are down. It means you are down. So I don't even think their SLA applies to this.
> Russians these days mostly have friendly excited reactions to foreigners speaking English in public.

That does not need to be a good thing, though. :D
That's opt-in.

In Enterprise setups the key should be backed somewhere in Active Directory.
To those who remember the Y2K bug scare, Microsoft delivered it: https://www.youtube.com/watch?v=WhF7dQl4Ico
Did you mean the Azure thing or CS thing? Just happened that the Azure thing did not impact me as I was already off...
It massively increases your attack surface but lets you tick the "cybersecurity" box on your audit. It's a good trade for many people, it seems.
Ouch, considering the devil works under Oracles lawyers, thats bad!
I know it does for personal accounts once linked to your machine. Years ago, I used the enterprise version and it didn’t, probably because it was “assumed” that it should be done with group policies, but that was in 2017.
Welp this fucked my night. A toast to the rest of you who are waaaaaay more screwed than me
There's nothing they can do right now, but my issue is that this will be forgotten when next update/purchasing round swings into action.

Take Mærsk who couldn't operate their freight terminals due to a cyber attack and had the entire operation being dependent on a hard drive in a server that happened to be offline. Have they improved network separation? Perhaps. Have they limited their critical infrastructure to only run whitelisted application? I assure you they have not. They've probably just purchased a Crowdstrike license.

Companies continuously fail to view their critical infrastructure as critical and severely underestimate risk.
I'd attempt an answer.

1/ imagine running >1000 legacy applications, some never updated in 20 years
2/ imagine a byzantine mix of local data centers, VPCs in aws/gcp/azure
3/ imagine a IT departament run by a lot of people who have never learned anything new since they were hired

That would be your typical large, boring entity such as a bank, public utility or many of the big public companies.

Yeah, there is no law of physics preventing this, but it's actually nearly impossible to disentangle an organization from decades of mess.
Seems like they should have put the magnet in the case and the sensor in the screen.
It's incredibly bad practice, but it seems to be industry normal as we learned today.
Or we just woke up because we are on vacation
It looks like it wasn’t a software update, it was a AV definitions update, so internal to the CA application.
That's the reason why I wrote, "stop putting" instead of "throw all of your PCs out of the window". Just like they migrated away from DOS they should start planning to migrate away from Windows to more modern, sandboxed solutions. There are ZERO reasons why a cash register shouldn't boot from a read-only filesystem, run AV, and so on.
They seem either unrelated, or the Azure one was caused by CrowdStrike.
Reputational damage from this is going to be catastrophic. Even if that’s the limit of their liability it’s hard not to see customers leaving en masse.
There are now USB-C cables with power meters which might satisfy your curiosity (re: charging power).

https://www.theverge.com/2022/1/28/22907150/usb-c-pd-cable-p...
Agreed. What happened to Patch Tuesdays?!
EDH is especially prone to it as a format, because it's a format which allows almost every card ever printed (with a pretty... inconsistent banlist). This makes for some pretty wild variations in power levels, and the top end tends to be both very samey and very expensive. It's very popular as a format but it only really works because there's a culture of trying to match power levels between decks (to be fair, there's also the fact that 100 card singleton does tend to mean it's hard to be completely consistent, so there's a lot more 'bleedover' between power levels in terms of chance to win in a given match, as well as the >2 player aspect levelling things out as a player obviously in the lead will tend to be ganged up on)
The Rubby Game v0.1
Modern Windows installs already run under a hypervisor. It's called Core Isolation or Virtualization Based Security.
Waitrose tills and card machines aren't working
I have never heard of crowdstrike. Is that some kind of antivirus? How is that related to PCs not booting? And why does it affect so many PCs if I've never heard of it? I'm so confused
The universe is fundamentally a non-deterministic technology, friend. We do what we can =D
Please remove the “74935 viewing “ from the beginning of the submission, since that is apparently a viewer count at the time of the HN posting.
Likely related to Windows Bluescreen and Boot Loops (update: caused by a Crowdstrike update) (492 points, 2 hours ago) https://news.ycombinator.com/item?id=41002195
I did them too, with two different teams of 8-10 people, once for two years and the second time for about one year. We didn't lose anything when we gave up on points and simply went for time based estimates.
Not the GP, but:

> That’s different from USPS not having some “legitimate” reason to use a Facebook tracking pixel somewhere.

I don't think the USPS has any legitimate reason to be hosting tracking pixels from any entity outside the US government. USPS should have analytics on their website, but the USG has a hosted analytics package[0], and that's what they should be using -- which they are[1], so they should already be getting the data they need.

[0] https://digital.gov/guides/dap/

[1] https://analytics.usa.gov/postal-service
Thanks god all the critical infrastructure in my country is still on MS DOS!
This is an insane take. Do you think other industries get away with limiting their liability to the product cost? No, because that doesn't provide adequate incentives for making a safe product. The amount of software that gets written depends mostly on the demand for that software. Even if Micrososft would not be willing to up their game to make the risk viable then someone else would.
It doesn’t really matter what the contract says. Laws take precedence over contracts. For example, Boeing’s liability for 737 airliners that crash due to faulty software certainly isn’t limited to the price of the planes.
So far requires going into recovery mode and removing/rename the cloud strike executable. Then you can boot into Windows from there, it will probably be a sys admin thing dependent on the organisation setup.
Or, and that maybe a radical idea, YOU DON'T INSTALL THIS FUCKING SNAKE OIL IN THE FIRST PLACE.

The idea of antivirus software is laughable when Adobe cannot implement a safe and secure PDF parser then how can Crowdstrike while simultaneously supporting the parsing of a million other protocols?

Everyone involved: Vendor, operator, and auditors who mandate this shit are responsible and should be punished.

YOU HAVE TO MINIMIZE THE ATTACK SURFACE, NOT INCREASE IT.
> Linux being the most advanced operating system in the world without question.

Only if you don't need a GUI/Desktop.
Doesn't matter what testing exists. More scale. More complexity. More Bugs.

Its like building a gigantic factory farm. And then realizing that environment itself is the birthing chamber and breeding ground of superbugs with the capacity to wipe out everything.

I used to work at a global response center for big tech once upon a time. We would get hundreds of issues, we couldn't replicate cause we literally have to set up our own govt or airline or bank or telco to test certain things.

So I used to joke with the corporate robots to just hurry up and take over govts, airlines, banks and telcos already, cause thats the only path to better control.
Not Microsoft, that’s for sure
Linux isn't exactly reliable either... I'm sorry but that OS is barely capable of outputting a stable HDMI signal, god help you if you are on a laptop with external monitor.

For 3 computers, 2 laptops, I've never _not_ had display bugs/oddities/issues. System upgrades always make me nervous because there is a very real chance of something getting fucked up and my screen staying black the next time it boots, having to go into a TTY, and manually fixing stuff up or booting the previous version that was still saved in GRUB.

We can not get computers perfect. They are too complicated. That's true for anything in life. As soon as it gets too complicated, you're left in a realm of statistics and emergent phenomena. As much as I dislike windows enough to keep using Linux, I never had display issues on windows.

To anyone compelled to reply with a text that contains "just" or "simply": simply just consider that if you are able to think of it in 10 seconds, then I have thought of it as well, and tried it too.
Building SaaS applications for highly regulated industries
The thing is we know how to make (eg) food that is safe or to a lesser extent bridges that don't fall down. If you sell food that makes people sick you should have known how to avoid that and so you can be held liable.

We don't have a good idea how to make software that is flawless, at least, not at scale for a cost that is acceptable. This is changing a little bit now with the drive by governments to use memory-safe languages, but that only covers a small part of the possible spectrum of bugs in software and hardware.
This issue could easily happen on any other OS - Linux, macOS, BSDs - because it's a third party kernel driver which would be installed by the corporate IT regardless of anyone's opinion for compliance reasons. Your advice is incompatible with how the real world operates.
Today, maybe, but I doubt you could have said that of Bell Labs, at least by Occam's razor. (Maybe they weren't a business all by themselves, but their output was effectively deployed to the parent concern by most standards)
This is insane. The company I currently work for provides dinky forms for local cities and such, where the worst thing that could happen is that somebody will have to wait a day to get their license plates, and even we aren't this stupid.

I feel like people should have to go to jail for this level of negligence.
I’m sure the patch itself can be fixed, and there will be a workaround to boot up the machine to fix it. My only concern is the BitLocker keys. If the hard drive is encrypted by Windows and assuming no backup for that key has been done, the system admins will have to activate their disaster recovery plans for these devices, and I hope they have that too, but hope isn’t a strategy!
Shareholders prefer profits to long-term investment. Thanks capitalism!
Validating that a complex spreadsheet is correct is notoriously extremely difficult at the best of times; unfortunately they are about the closest thing to a write-only language in common use, and you really have to front load a lot more care than you do in conventional modern languages. The usual safeguards of testing and code review are essentially absent.

I’m sceptical that anyone really _should_ be using generative AI for anything where correctness matters at all, but spreadsheets in particular seem close to a worst-case scenario.
well, apparently they aren't
They make security software that is really popular in various industries.
It's not a failing of Internet infrastructure.

It's one vendor pushing out a bad update, and thousands of companies with no supply chain diversity.
I was just a contractor there, and don’t work with them at the moment. But I’m a customer of theirs and they’re definitely having an outage right now, so I’m guessing it’s all still in place.
CyberStrike offers a temporary solution for crashed systems
Cyberstike has given users a potential way to fix their systems.

Boot Windows into Safe Mode or the Windows Recovery Environment (you can do that by holding down the F8 key before the Windows logo flashes on screen)
Navigate to the C:WindowsSystem32driversCrowdstrike directory
Locate the file matching “C-00000291.sys” file, right click and rename it to “C-00000291.renamed”
Boot the host normally.
Strong recommendation for The Pragmatic Programmer, Andy Hunt & Dave Thomas.

Agile Manifesto, which many "agile" techniques often forget as well: https://agilemanifesto.org/principles.html

Test-Driven Development by Example, by Kent Beck. No other. Kent Beck doesn't even show up on the first page of Google anymore. The book is on page 6. But it's a human way to develop software, dealing with the human limits of the average programmer. The book is easier to read than most of the articles written about it.
It isn't clear at this point that the Azure thing and the CS thing are unrelated
You are a liberal arts major at an American university in the first half of the first decade of this century. At every house party you attend, you see a copy of this book on every coffee table. You are aware that it is critically acclaimed and you participate in numerous conversations regarding its merits (or lack thereof). You have never read the book. You regret nothing.
> AV was never a necessity on UNIX, whatever MS bundles in is usually enough

What prevents someone pushing a malicious package that takes my user data (that is accessible from a logged in session directly) and sends it somewhere? Especially in non-system repos, like Maven/NuGet/npm/pip/RubyGems and so on? What about the too widespread practice of piping shell scripts from the web, or applications with custom update mechanisms that might be compromised and pull in malicious code?

I'm not saying that AV software would protect against all of these, but even if users don't do stupid things (which they absolutely will anyways, sooner or later), then there are still vectors of attack against any system.

As for why *nix systems don't see that much malware, I've no idea, maybe because it's not as juicy of a target because of the lower count of desktop software installations (though the stuff that is on the systems might be more interesting to some, given the more tech savvy userbase), or maybe because a lot of the exploits focus on server software, like most CVEs.

On Windows, I guess the built in AV software is okay, maybe with occasional additional scans by something like Malwarebytes, but that's situational.
What you describe sounds like Agetic RAG https://zzbbyy.substack.com/p/agentic-rag