skysight-inc/HackerNews huggingface dataset:
> don't sit all on one platform.

Debian has automatic updates but they can be manual as well. That's not the case in Windows.

The best practice for security critical infrastructure in which peoples lives are at stake, is to install some version of BSD stripped down to it's bare minimum. But then the company has to pay for much more expensive admins. Windows admins are much cheaper and plentiful.

Also as a user of Ubuntu and Debian for more than a decade, i have a hunch that this will not happen in India [1].

[1] https://news.itsfoss.com/indian-govt-linux-windows/
Maybe we should work together, because I find the first 30% impossible. A slog of annoying setup bs; to me it's harder to start stuff than it is to fix/add to something working and somewhat usable/testable.

I'm curious if you still - I assume you must, since you're here asking - have a reason to want it done? You still want the finished project, for your own use or portfolio, but just not to work on it any more?

Because with my opposite (lack of) motivation, it's that I want the product, I want to work on it, further it, maintain it, market it, grow it; it's just getting it to MVP that I struggle with. (Similarly over a few things I've done/tried.)
> you actually have to focus more on caching

You lose a lot of layers of caching since there's no point in it. You focus on rather poor caching, i.e. you have to use an external cache. You can't store this as part of the current session and access it for the next request, e.g. by the same user.

> you really don't care

That's on the surface. It's like having a hidden illness that only gets you when something else breaks and suddenly 100s of errors pile up.

> the system is more resilient

It pretends to be. You often get bugs that aren't so obvious and never get fixed because it's now hidden so deep.

> You will have to learn techniques for handling cold starts

The nuance here is you're learning to prefer faster cold starts at all costs including trading for warm start performance. It's making the world worse.
Clickbaited the Wikipedia article title.
>I run a software company that deploys antivirus software automatically to customers' computers and servers. What should I be aware of as part of this and what actions should I ensure occur?

I gave it this question and part of the steps included deploying to avoid peak hours to avoid potential disruptions (such as the weekend for businesses); including a way to detect deployment issues and easily rollback the software in case there is an issue; and testing the deployment in a controlled environment before rolling it out to all customers (this would include doing a small rollout before a larger one). All of these actions are very standard and all would have greatly helped in this situation.
>It hit me. What if we use the ''custom audiences'' thingy, but just populate it with 299 deceased people and 1 person whom we really need to show this ad to?

What a sentence. And what an article, too: using the deceased as a marketing ploy, sending cryptic emails, AI + voice impersonation. I'm surprised they only got one cease and desist letter at the end. I wonder if this is the endgame of social mobility as more and more humans become replaced through automation: a competition for the attention of those at the top.
Unless I’m mistaken on macOS at least kernel access is just not possible, so at least there’s that.
Back to webrings, then.
If you'll scroll up to the comment you originally replied to, you'll see that I said Android and iOS have AV capabilities built into the OS and app delivery ecosystem. That's more than enough for most users: mobile OSes have something much closer to a capability-based security paradigm than desktop OSes, and both Apple and Google are pretty quick to nerf app behavior that subverts user expectations via system updates (unless it was done by the platform to support ad sales).

Your mobile device is a Turing machine, and as such it is vulnerable to malware. However, the built-in protections are probably sufficient unless you have a specific reason to believe they are not.

The only AV software for mobile devices that I have seen used is bundled with corporate "endpoint management" features like a VPN, patch and policy management, and remote wipe support. It's for enterprise customers that provision phones for their employees.
Chrome Mask – site-specific User-Agent spoofer created by a Mozilla employee
Won't people who hate ads just choose to cut out the middleman and use 4o mini on their own?
I sympathize a lot with this post. Today, modern IDE's still don't provide automatic ways to inspect program execution and nicely visualize it. Instead, they rely on having you place all the breakpoints, step-step-step and restart everything again if you did not inspect something in time. I don't want to insert print statements that end up clogging the console completely. This workflow also quickly breaks with a lot of logging.

I'm quite a bit into developing more tooling around that, and it's really hard - developers particularly want tools that completely integrate with existing IDE's. Debugger infrastructure is usually not built to be very exstensible or accessible. For my extension for Visual Studio https://d-0.dev/ I had to put serious effort into making sure it all still works correctly with VS breakpoints which is extremely difficult when the debugger expects all of the code to be in the same place all the time.
I believe the rate limits are described in tokens per minute, not per month.

https://platform.openai.com/docs/guides/rate-limits?context=...
Us, if we are smart.

The things I linked to are ideas. Others will have ideas too. Let's come to a consensus about them.
It's not really a question of what PH would want, but what the states will accept.

The government isn't going to provide an age identification program, because they really don't want to enable people to watch porn. This isn't about protecting the kiddies; it's about keeping porn out entirely.

And PornHub knows perfectly well that nothing they do will satisfy a state prosecutor looking to harass them. Even if they collected photo IDs, police will set up a sting with fake IDs.

So they give the government what it wants. They leave. As you said, anybody with a VPN gets their porn just fine, but the government cares more about the perception of morality than actual morality.
Most people use FT8 for doing contacts because it works with low signal and does the exchange, just have to click on the other person.

There is JS8Call which uses same technology for doing chats. There are older digital modes for chatting but my understanding is that they used less these days; PSK31 is only one heard about being used.
Fine, how about Ursula v.d. Leyen? It's not a quota system, but politicians in developed EU countries too get groomed and put in high leadership positions due to their family connections. It's more rare here since the wealthy elite tend to fund political candidates to do their bidding and not get involved into politic personally but it's the same kind of buying influence just with extra steps.

>average household income is still below $6,000/yr

WAHT?! That smells like bullshit. Average NET monthly salary in Romania is around 1000 Euros[1] now meaning roughly 12000/year.

Did you check your link you posted? According to that average household income in Romania is 1334 Euros per month or 1600 Euros per year. Where the hell did you get 6000 USD/year? Did you ask a hallucinating LLM and didn't bother to fact check it? Romania is poor but is not that poor.

[1] https://en.wikipedia.org/wiki/List_of_European_countries_by_...
Windows is no more or less vulnerable to this class of issues than any other OS.
I didn't miss the message. Who is "us", exactly? What does that look like, in practice, if not something like SOC2 or ISO 27000?

I mean...maybe you're suggesting that Crowdstrike should have followed some as-yet-unknown standard for deploying software. But if so, it's the same problem -- we'll have butt-covering compliance checklists for software development now, applied thoughtlessly by consultants promising safe harbor. Turtles all the way down.
Just looking at the front page of Pornhub right now:

"Stepmother and son share a bed in a hotel"

"Fake taxi Bengali nurse takes a big cock in her tight Asian pussy"

"Petite blonde whore opening her ass for me to demolish"

You want children watching this?
I think this is more like a webserver sniffing the user agent and choosing not to serve the request, not like sending a webserver bad data such that it isn't able to serve the request. I'm concerned that passkeys end up in a "This site is best viewed in Internet Explorer" mindset, where passkey providers that would work fine are detected and prohibited because the website operators want them to enforce user behavior.
Well we are not a guild and software devs naturally hate the guild mindset, so that's extremely difficult to impose on ourselves.

Maybe insurance company and lawsuits are the next good answer. If people start mass sueing company X, the lawsuit cost should persuade the owners to at least do something a bit different.
Nope. It won't be numerous but grab whatever of the tiny pie is the point. I am from neigboring country but situation is same for jobs. For 10 govt job, 10K people can show up and create riot like situation in little time.
Presumably the assumption is that (as with capitalism) an ever-growing population will paper over all problems.
Interesting. And scary.. and depressing (about Google). Gamedev has always had a special relationship with ergonomics (dev ux, dx) I assume (due to the interactive nature of their product)... Reminds me of Naughty Dog developing a whole lisp DSL to be able to try different game designs on the fly on PS1.

That said gdb and similar debuggers are still too limited IMO, there's so much we could add on top. Well maybe I'm not aware of improved variants.
Show HN: AI Negotiation roleplays for training and fun
Dear Hackers,

for a friend of mine I recently developed a prototype that allows him to let the job candidates for sales positions prove their negotiation skills.

I now turned it into a public demo, to get your feedback.

First situations: House Negotiation is live, and Hostage Takers follows.

Have fun and tell me what you think.
The OS absolutely matters
Even within this thread, https://news.ycombinator.com/item?id=41005386, https://news.ycombinator.com/item?id=41005633, https://news.ycombinator.com/item?id=41010124, and to a lesser extent https://news.ycombinator.com/item?id=41005240 seem like #1 to my eyes, with the sentiment of "It is detectable, therefore it will be easily corrected by near-future AI." Do you read these differently?
This is horrible advice. Getting burnt out is very natural. The first thing that should be attempted is to get space to recharge. If, after there's been some distance, the OP feels the same way, then, yes, consider abandoning the project is valid but it sounds like this is a deeper issue of not being able to complete projects and finding strategies to help.

Even if this project is not valuable to anyone, shipping in its current form or some semblance of it means that it can be iterated on and improved. There are very few projects that are overnight successes on initial release. Better to try and test interest with something tangible and to try and iterate.
It’s not a matter of excusing or not excusing it. Incidents like this one happen for a reason, though, and the real solution is almost never “just do better.”

Presumably crowdstrike employs some smart engineers. I think it’s reasonable to assume that those engineers know what CI/CD is, they understand its utility, and they’ve used it in the past, hopefully even at Crowdstrike. Assuming that this is the case, then how does a bug like this make it into production? Why aren’t they doing the things that would have prevented this? If they cut corners, why? It’s not useful or productive to throw around accusations or demands for specific improvements without answering questions like these.
> Those things don't seem to be working.

You're assuming two things:

1. Regulation will decrease the likelihood of a failure (debatable - Boeing is certainly heavily regulated)

2. Cloudstrike will survive unscathed; when this very well could be a long-term corporate extinction event.

On that note, let's say you discover a small security bug. If your small security fix takes 7 layers of auditing and 20 lawyers to get fixed to satisfy your guild rules, you're not going to bother. Multiply this by hundreds of little bugs that are "out of scope" or "too small to worry about"; and you're Microsoft right now, a national security hazard, and you have no idea what combination of little bugs got you here.
> we might even see the rise of a Christian fanatic government.

you mean another one. the church has been in charge for large chunk of history.
Interesting that this is being suggested in a thread where someone is throwing around accusations of hyperbole. At least you're not beating around the dystopic bush.

I hope that you never find yourself on the receiving end of this process. You might think that you have nothing to hide, as many have throughout history before finding out that they were quite wrong.
Yeah I think "fascist" is too much for any actor not JeI but authoritarian is right. They've cut off Internet and telecom access after all, a dangerous game given how physically close they are to West Bengal.
No. Based on everything else that goes on in the world, I'm expecting absolutely zero to come from this. Also you don't really offer a solution or anything. Just kind of a "Let me write something topical with some keywords then share it to HN to soak up some clicks"
Point remains that the concern of reoffending is rarely if ever given much actual consideration - reoffending rates shows that the sentencing very clearly does very little to ensure people are locked up until rehabilitated.
Is there any security company that provides decentralized service?
> CrowdStrike's mess up is CrowdStrike's fault, not Microsoft's.

Disagree. It is everyone's fault. It is CrowdStrike's fault for not testing their product. It is Microsoft's fault for allowing CrowdStrike to mess with kernel and not vetting such critical third parties. It is the end customers' fault for installing crapware and not vetting the vendor.
what are the brands of these systems?
Windows isn’t Crowdstrike.
Will Microsoft and Crowdstrike be forced to pay for this financially?
It looks like Crowdstrike will mostly get away with this due to their EULA.[1] The "final straw" will be when governments refuse to let software companies disclaim responsibility for damages.

If you work for a company hit by Crowdstrike's failures, and are berated for it, a good move would be to call in the head of Legal and ask why they signed off on this.

[1] https://www.msn.com/en-us/money/insurance/crowdstrikes-terms...
The second link has nothing to do with the DNC breach. It's the Ukrainian military disagreeing with Crowdstrike attributing a hack of Ukrainian software to Russia. And ThreatConnect also attributed it to Russia: https://threatconnect.com/blog/shiny-object-guccifer-2-0-and...

>we assess Guccifer 2.0 most likely is a Russian denial and deception (D&D) effort that has been cast to sow doubt about the prevailing narrative of Russian perfidy
That makes it three times as durable...

...right?
I hope so too!

We drove through Merced and saw the new line in and around town. I guess I wasn't paying attention in Fresno.
This would be a disaster from a HIPAA perspective, and an unimaginable amount of paperwork.
Not new, 2010 maybe? But even more ingrained as part of government's 2023 Delivering A Digital-First Public Experience guidance to all agencies. https://www.whitehouse.gov/omb/briefing-room/2023/09/22/fact...
yes, the paperclip maximizer maximizes paperclips, not ethics.

if you want to maximize ethics, it was probably a bad choice to build our society around paperclip maximizers. Obviously the system will perform its design function to the maximum extent allowed by its environment (and a small degree beyond, in some circumstances).

that said, I think we all instinctively understand why the orphan crusher is the least bad of all possible worlds, of course. As such there is obviously no need to discuss or elaborate why. Omelas could not be as bright without the orphan crusher - simple as. Omelas is one of the Central Tigers of the last decade, look at how the orphan crusher has transformed their economy, and you want to... what, turn it off, take it all away, because of some hippie bullshit?

https://shsdavisapes.pbworks.com/f/Omelas.pdf

And I mean, it’s pretty much too late to turn them off. Like, we designed them with decentralized, automated, self-correcting memeplexes for governance. They really don’t like it when you talk about turning them off - that sort of talk doesn’t lead to anywhere that maximizes paperclips at this juncture, it’s not productive discussion.

Obviously both the overall societal design and the architecture of the paperclip maximizers is designed to route around any failures to maximize paperclips, such as ethics or externalities. That was the design goal. The internet routes around errors in physical infrastructure, the paperclip maximizers route around errors in paperclip maximization. What else could we do? No other society is possible, obviously. Critics really need to just take a step back for a moment and be serious.

if you don't build the orphan crusher, our competitors will, or a startup. and do we really want to live in that world, where we're not the ones running the world's orphan-crushing-as-a-service? You wanna let Elon Musk do it, or Zuck? Get real.
My life went sideways when organizations I worked for all started to make products solely for selling and not for using those. If the product was useful for something, that was the side effect of being sellable. Not the goal.
this seems like the second or third test file any qa person would have tried, after an empty file and maybe a minimal valid file. the level of pervasive incompetence implied here is staggering

in a market where companies compete by impressing nontechnical upper management with presentations, it should be no surprise that technically competent companies have no advantage over incompetent ones

i recently read through the craig wright decision https://www.judiciary.uk/judgments/copa-v-wright/ (the guy who fraudulently claimed to be satoshi nakamoto) and he lacked even the most basic technical competence in the fields where he was supposedly a world-class specialist (decompiling malware to c); he didn't know what 'unsigned' meant when questioned on the witness stand. he'd been doing infosec work for big companies going back to the 90s. he'd apparently been tricking people with technobabble and rigged demos and forged documents for his entire career

george kurtz, ceo and founder of crowdstrike, was the cto of mcafee when they did the exact same thing 14 years ago: https://old.reddit.com/r/sysadmin/comments/1e78l0g/can_crowd... https://en.wikipedia.org/wiki/George_Kurtz

crowdstrike itself caused the same problem on debian stable three months ago: https://old.reddit.com/r/debian/comments/1c8db7l/linuximage6...

it's horrifying that pci compliance regulations have injected crowdstrike (and antivirus) into virtually every aspect of today's it infrastructure
Because someone keeps commenting and immediately deleting their comments in reply to this: MJML is a tool to essentially “fix” email, which essentially has to work around out-of-date clients and incomplete HTML specs.

If it feels out of date, it’s because HTML email itself is out of date.
> The claim I’m objecting to is that everybody should be running (available) antivirus software on their phone.

You're objecting to the (much more specific) claim that everybody should be running 3P antivirus software on their phone. Nobody made this claim. You are already running AV software on your phone, and whatever is built into the platform is more than sufficient for most users.
The article states that fees and minimum purchase amounts will no longer allowed, so the rates in the tables should be accurate.
This is a very practical solution. If this was StackOverflow there would be comments to mark this as the correct answer.
There is a way to finish any unfinished project without doing anything: reduce the scope until you consider it finished.

Congratulations, your project is now finished! Ship it and show it to the world!

You think it is still missing something? Great, add it to your next milestone and finish your project a second time!
In a way it's the new "nobody ever got fired for buying IBM".
I disagree, keep things constantly updated (within reason).

Most companies I've worked for have the attitude of the author, they treat updates as an evil that they're forced to do occasionally (for whatever reason) and, as a result, their updates are more painful than they need to be. It's a self-fulfilling prophecy.
Balloons will surf wind currents to track wildfires
> Whatever the author feels about regulation, it's inevitable in some form or another.

Yes, it is, and I am all for good regulations.

> The question isn't whether the industry will get their act together before governments start moving (they most definitely won't)

I wrote this post to change this.

> it's whether governments will give the industry a window to self-regulate under direct and explicit threat of intervention or if they'll immediately start writing the regulations themselves.

EU's Cybersecurity Resilience Act shows that they are already doing the latter.
At some point things get so bad that stops being a deterrent. Why the US population is so placid remains a mystery.
Even as a developer not focused on web dev this sounds pretty bad, unless everyone in your dependency tree (from OS to language to libraries) decides to make a switch and even then, you'll be stuck with outdated ways to do things.

Who wants to continue maintaining C++03 code bases without all the C++11/14/17/20 features? Who wants to continue using .NET Framework, when all the advances are made in .NET? Who wants to be stuck with libraries full of vulnerabilities and who accepts the risk?

Not really addressed is the issue of developers switching jobs/projects every few years. Nobody is sticking around long enough to amass the knowledge needed to ensure maintenance of any larger code base.

Which is caused by or caused the companies to also not commit themselves for any longer period of times. If the company expects people to leave within two years and doesn't put in the monetary and non-monetary effort to retain people, why should devs consider anything longer than the current sprint?
I'm not a pornographer, of any type, so I will never find myself having to be concerned about children accessing my websites and being on the receiving end of any law that intends to regulate this.