skysight-inc/HackerNews huggingface dataset:
"Diversity" (but not in the sense of marginalized people)

If more of the critical machines were running different OS's, the damage would be contained.

When we talk about the dangers of "monoculture" it's usually about plants. The same danger applies to computing infrastructure.
Something static on a cdn
For me, the word "smart" is a red flag. It generally means "unnecessary feature that's designed to screw you".
Can't we make a chip that only does one thing: multiply and add a lot of 32x32 matrices in parallel? I think that would be enough for all AI needs and easy to program.
So let’s be clear, your point is that you find the API of non-BEAM greenlets less useful, not that they’re somehow necessarily less efficient. Right?
I think a good remedy would be to completely remove "normal procedure" as a defense against liability. Our legal standard should defend people who break protocols if they know they will result in harm, and prosecute people who don't, or prosecute the people who make the protocols in those cases. Law should supercede corporate policy, not treat it as a form of law
They said they got in contact via Twitter, but a16z didn’t like that.
Also the wallet had "please return me, cash reward" written on it. (Bug bounty advertised)
Microsoft can't really "certify" their way out of this. Crowdstrike updates as they find threats; that is, all the time. Microsoft can't perfectly vet every update - they come too fast.
People ridicule the German fetish for doing things on paper and using cash, but many things tend to work here even if the computers stop working.

My general practitioner once treated me during a power outage, all I had to do was come back and have my insurance scanned later.
Next to a German flag, even though the website's in Dutch. Perfect.
Maybe some of what you're looking for, maybe not.

https://toitlang.org/
Yes... In my mind, there are three kinds of security bugs.

1. Caused by pure ignorance and completely avoidable (this bug).

2. Caused by subtle configurations, workflows, programming (mostly avoidable, secret scanning, security linters, code reviews, general intelligence, etc). This is where 99% of security bugs are.

3. Caused by a malicious actor aligning planets with a single intent to maximize their cause. You'll never stop these people (three letter agencies, state actors).

edit:

A must watch talk https://vimeo.com/95066828
Who in the org do you expect to have that competency, and do you think hospitals aren't keeping crucial things like credentials or software that gates access to things in the cloud when literally everyone in the world is encouraged to at every turn?

The culture of organizational IT is broken because a lot of powerful companies found it profitable to break it and leave something inadequate in its place
Just storm EDR company offices slap guns to devs' heads, push geofenced destruction.
> not responsible disclosure.

The researcher found an email address, tried it, it bounced, then reached out over Twitter with:

> someone from @a16z get in touch, now. its bad. security related.

https://x.com/xyz3va/status/1807330215955177937

That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what they did instead.
> It's true that any kind of pay-per-use would be a hard, hard sell, though. Who wants to have to think about whether every click is worth the nickel it's going to cost?

I've heard this argument before, but there's a common existence proof to the fact that it's possible: video games. People who play many different kinds of video games (RTS, MOBA, MMO, RPG) get used to making decisions as to whether to buy things many times an hour with barely any cognitive load - their brains just get used to working with smaller units of time and money.

And why shouldn't they? I found sources online that say that a YouTube video earns about $5 per 1k views, or 0.5c per view. If I have to pay half a cent to watch a video, even a short five-minute one, that's almost below the threshold of caring, and even those making median income are probably going to be constrained by the actual time that they have available to watch, rather than the cost of the videos. People will spontaneously spend $20 to go out to eat - after the initial adjustment to a micropayment system, they should have very little trouble spending 60 cents to watch YouTube for five whole hours after work, especially if the micropayment system has common-sense features such as clearly showing your wallet balance over time, how much you've recently spent, and how much longer your balance will last at your current rate of consumption.

Now, to be fair, the fact that it's possible, and that people will quickly get used to it after they spend some time with it, doesn't mean that people will be interested in trying it in the first place, and that's a much harder problem, because subscription services are more lucrative for companies. I think the only way to get micropayments off the ground would be a grassroots movement supported by a bunch of content creators making their stuff available on a micropayment platform. Otherwise, companies that move away from ads (e.g. Google) will just turn to subscription services to lock their users in.
Is the submitter a bot? This appears to just be somebody's initial boilerplate - no implementation or (non-empty) UI yet. The submitter seems to make a submission roughly every hour or two.
How is this even a suggestion for a company at this scale?

From the article, "Software updates should be rolled out incrementally

One lesson from the global IT outage, O'Neill said, is that CrowdStrike's update should have been rolled out incrementally."

This is why I find the coding interviews of many companies to be misguided.

I bet Crowdstrike's hiring process focuses on Leet Code problems and ignores practical considerations like, real world engineering considerations that matter when building an agent.

Leet code bakes premature optimization into the hiring process, and ignores the far more common business reasons that software fails.

A robust system for incremental roll-out and verification should be 101 for software with this level of success and market penetration.
.pyx is used by Cython
https://cython.readthedocs.io/en/latest/src/quickstart/cytho...
It really depends on what you are building and who you are building it for. No code builders generally get bad rep, but some of them actually produce highly performant code.
Yeah, I keep hearing people say “CrowdStrike is done for” or similar. But I honestly think this will be blown over and forgotten in a month or 2.

Almost every large tech company in existence has had some sort of fuck up and survived. (Intel CPU vulnerabilities, iCloud security scandal, Sony multiple data leaks, ..).
Wouldn't a strongly typed language like rust sill catch a bad datafile?

E.g. loading it would require you to setup a maximal size and a valid configuration struct?
I admit to not understanding the relationship between OpenSUSE and SUSE as well as I understand the relationship between the various Red Hat distributions but my impression is that it's neither a strict downstream rebuild nor a somewhat arms-length upstream--but happy to be educated.
Walk down your street lighting matches every five feet
Any legal basis to challenge this practice ? If a company claims that they pay bug bounties but use flimsy reasons like this to chicken out of seemingly genuine cases like these
You can still do unsafe, and you do need unsafe in some cases.
Does anyone use this for a real-world use case? What are the pros and cons?
WTF is this thinking?

>Any dev knows what it's like having a million responsibilities,

Any airplane mechanic has a million responsibilities, and if they are not followed people fucking die. Maybe software devs should step up and take a little responsibility for their lack of action that can have consequences for their users.

Security researchers owe you nothing. If you make the path of least resistance selling sploits to blackhat groups the world will be a worse place.
Worse is Better has eaten the world. The philosophy of building things properly with careful, bespoke, minimalist designs has been totally destroyed by a race to the bottom. Grab it off the shelf, duct tape together a barely-working MVP, and ship it.

Now we are reaping what we sowed.
Ukrainian scouting culture thrives in the woods of western New York state
Whenever that time comes it would be at least 50 years too late.

But I hope to see it in my lifetime.
This has led to some interesting comments over the years, https://hn.algolia.com/?query=Lisp%20as%20the%20Maxwell%27s%...
Indeed, you are correct in mentioning the range from five jiao to two yuan. During my travels, I have often encountered overcrowded restrooms, especially in scenic areas and popular highway rest stops. The issue of long queues for women's restrooms is also significant, along with the presence of cigarette smoke. However, paid restrooms are indeed rare nowadays, at least in Zhuhai, which may be due to its status as a tourist city; the public restrooms there are well-maintained. When I can't find a public restroom, I often use the facilities in banks or government offices. As you mentioned, while local judicial rulings may not apply nationwide, central administrative directives do have a broad impact. In Guangdong Province, I rarely encounter obstacles when using restrooms in government departments, except during the pandemic.
In that case, they can collect whatever they want. The unique or special value of owning it in your collection is effectively nothing since I can enjoy the full-fidelity version at no cost wherever I go. This is the inherent problem with "collecting" something that is digital and can be infinitely reproduced.

I collect things because they're unique. Things that exist everywhere in abundance are not interesting to me. I could collect Coke-a-Cola bottles, but that wouldn't be special; I'd just be hoarding a bunch of trash.
Yet another reason why ublock should be a default extension for everyone as it blocks those by default.
I literally don't know what you're talking about, but it seems quite personal, off-topic, or plain delusional. It seems you are the one who really needs to spend some more time abroad to widen your perspectives. But I realize how this is easy to say for someone from a high income country who spent a lot of time working and travelling abroad, while people from low income countries will simply never get to see much of that. So I suppose the best I can say is that I feel sorry for you if you think this is what sets us apart. I wish the world didn't work that way.
Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.
The same reason everyone just uses a microcontroller on everything. It's like a universal glue and you can develop in the same environment you ship. Makes it easy.
Oh, wow, I came here for the same thing. The tone of the post got more and more annoying as it progressed.

Posting quotes from reddit as if they're intellectual discussions was a red flag, but this specific statement was just too much to ignore.

Although I work on Linux almost daily, I'm happy to say it's possible to simply avoid those kinds of people. Fostering a healthy environment where people can discuss and disagree respectfully is incredibly important for volunteer-led projects like Linux distributions.
You can do bugs in any language. The problem here was monoculture and critical dependence on one supplier, not a programming language choice
I've been using quarto a lot too. I've found the typst pdf travel output to be a bit rougher than latex pdf when using GT. Hopefully something that will get fixed.
This is kinda like hitting an engine with a hammer and it fires up. You don’t know why, you don’t care, but it works.
I was a freelance trainer and specialised in NetWare and networking at the time. I was very busy (UK) working for the likes of Barefoot computer training (Aris), Skytech, Azlan, Comtec, Expertise, QA and others.

I was also a systems and networking installer.

Some training companies insisted that their trainers were 'Novell Certified' - and indeed I was, because to purchase, install and get support directly from Novell, your organisation (in my case, my own company with me as sole employee) you had to have one person qualified as a Certified Netware Salesperson (I think that's what they called it), so I paid for and passed that exam. I never bothered with CNA, CNE or ECNE, although I did write official material for them.

That reminds me - I also wrote some of the original CompTIA A+ Service Technician training material, and ended up delivering it and running train the trainer courses around the world.

Again, one company asked me whether I was A+ Service Technician certified, and I said I wasn't, so to deliver training for them, I registered, popped into their exam room and took the cert during a morning break in training. Happy to say I passed - helped somewhat by the fact that I wrote some of the exam questions!
The whale fall is ending. The Internet, maybe all telecommunications, used to be a special "thing" you could be in on. Getting information from other people like product reviews, whatever

Now the predator have caught up to the prey and the free lunch has ended.

All trust is built on reputation and you can no longer trust strangers for free. I started taking my friends recommendations first for products and services, because I know them in person and I know they want to maintain the friendship and not burn it for affiliate marketing.

MLMs still try to hijack friend groups but at least for now you can see those a mile away.

Hell at least cybering is still pretty fun
Not just QA; security assurance, code reviews, static and dynamic testing, threat surface analysis, unit testing, and pentesting either didn’t exist or weren’t sufficiently applied.

I have to imagine that this bug has existed for quite some time and I’d be curious to know what other input validation errors they have, considering the amount of untrusted input they evaluate at ring 0 originating from userland.
I expect the local admins to be able to install a fresh OS not connected to the enterprise network. And I expect them to have physical copies of stuff like disk encryption keys, also backups of OS installations and images, and all critical software. If they don't have that or can't use it during an outage, the problem is incompetent IT management that has no business running a hospital, not CrowdStrike. Something else would take them out sooner or later.

Again, we had all of this for a forest logging operation - is it too much to expect at a hospital?
We always need to do our due diligence when using someone else's project. It's an open source project, available for free.

If they weren't very clear in the docs is one thing, but it doesn't appear so. Anyway, we won't combat these types of shenanigans by assuming others did everything up to snuff. We gotta be more careful ourselves.
It wasn't easy to program the 68k mac either. I don't think there was a really easy-to-use system for GUI programming until Microsoft's Visual Basic.

Would you have preferred something like Plan 9 or a Smalltalk workstation?
I understand where you're coming from, but you're using "should" a lot. Companies should do a lot of things! They should make their sites secure. They should have a formal bug bounty program. They should have security@ and engineering@ and lots of other emails easily visible. We agree.

But many don't. And a lot of things in the business world are not as they should be. And in this real world of imperfection, others sometimes need to put in effort (and be paid for that effort) to make up for the failings of companies. This is one of those cases of imperfection.
I'd argue it's several things, these two things included.

To screw up so legendarily requires a concert of bad decisions.
https://crowdstrike.wd5.myworkdayjobs.com/crowdstrikecareers

Looks like Crowdstrike outsources their SDET/QA while keeping most software engineers stateside.

I generally don't have an issue with outsourcing, but it's obvious they're trying to save money on QA here. A few 200k SDETs could of probably caught this.

I see this at tons of companies, they see QA as less important...
Yea, they aren't going up on GH, they are going up on sketchy-site . ru
OK, sure, but don't you think that being a world-wide antivirus vendor should have warranted a better process?
You can write drivers in Rust - it's just quite hard at the moment. Microsoft published metadata packages for WDK APIs and started creating samples: https://github.com/microsoft/Windows-rust-driver-samples
An embedded controller can deliver all of this information over a serial line to a central hub.
I think it would take Crowdstrike doing five, six of these in a row before they tanked. Look at Boeing; two planes full of passengers died for quite scandalous reasons, followed up by a whole bunch of other engineering scandals, and while the value of Boeing shares took a 50% hit, the company's still in business, and people are still buying planes from them.
Yeah; I'm imagining the record sits in a basement for 100 years, and has mildew + scratches. Each error correction block has to be (I'd guess) at least 10x wider than a scratch, assuming the codes can correct 1 bit out of 10.

CDs use Reed Solomon, configured for a 1:10000 bit error rate, but NAND storage uses LDPC, which is much more robust.

Anyway, reading such a block would likely take the record player 10's-100's of milliseconds, and xwax seems to target 1ms.
Wow! Love running into MA users. Your comment totally made my day. Thanks for the kind words and I'm so happy that the system is working out for you. After all the work we've put into building this thing, it's the best feeling ever to hear about positive impact it's having on people's lives.

> any plans on expanding into physics problems? would LOVE these ideas to delve back into phsyics. (especially circuits.)

Our grand plan is to completely fill out out math courses, then expand to other related fields such as computer science and physics.
Eat a cow, do not replace it, and wait for it to escape the atmosphere or decompose naturally. And lighting a methane leak on fire can also help.

(sarcasm tag)
Something like Turbo Pascal with support for high-level GUI programming would have been ideal.
If you add `import “server-only”` to the file, it will fail to compile if you to use it on the client. React also has more fine grained options where you can “taint” objects (yes that’s the real name).
it turns out, civilization works because most of us are civilized.
This is a kernel driver. Runs in kernel space. Intercepts syscalls. You'd definitely be fighting uphill to write it in Rust. And your code would be riddled with `unsafe` by necessity anyways.
> No one was looking

It's a16z, not Grandpappy's Model Railroad Museum Showcase ("Come see a photo of the tiniest steam wagon in Sheboygan!").
they can just bribe a company to do it :D
Some photos of the actual Inception https://www.independent.co.uk/news/uk/the-village-inside-a-v...
That's all fine, until one day Crowdstrike is the threat.
Yeah, that's because it's assumed that the other half consumed is non-registered moonshine. I don't get how that would apply to condoms, though.
“Independent data center develops have approached Williams for natural gas capacity directly form its pipelines, Armstrong said.”

“Develops” “form” … do they even read their own articles before hitting submit?
Some of the earlier Mars rovers used inflatable balloons to cushion the landing. They bounced around for dozens of meters on rocks without popping. Not an expert by any means, but would think it should be possible to inflate a gas bag at a certain altitude, after dumping the thermal shield and using a parachute to slow down.

A powered-flight probe would be interesting in that it could be more easily directed to specific areas and have the ability to stay over a given area. A balloon would likely not be as controllable.

But would be happy with any Venus mission, even a low altitude orbiter would be cool.
Of course I’m using “should” a lot. Because “should” clearly didn’t happen.

That doesn’t change anything. Just because a company has shitty security reporting practices doesn’t suddenly mean the onus is on the researcher to do the company’s job.
Great ask. I'm not advocating for paywall blocking. Something simple like a crawler that hits a paywall on an article automatically attempts the router du jour. Or a "paywall" flag users can tag that initiates, etc.
what do you want them to do? nothing? we've already established that they tried to make contact.
I understand that. It's just that many people still use these passages to the present day to justify bad behavior.
This looks great, nice job!

Does anyone here use Foundation for Emails? - I found it to be pretty good (circa 2020) but the code it produced still needed some tweaks to display images correctly in Outlook for Windows.
Every real malware programmer would be damn proud of this blast radius.
As if the difference between "republic" and "rule of the mob" is decided by having an electoral college. People are getting every bit as riled up for and against candidates as if they voted directly. The only thing that the electors are good for is adjusting counts such that smaller states get proportionally more votes. I find this practice questionable when it comes to electing the president, and on the other hand, that much could be done without an electoral college, at all. On the other hand, if you still want an electoral college, make it so that the weights are evenly distributes—that one Californian voter has as much weight as one from Rhode Island, and that electors representing all the candidates that people voted for are apportioned seats in the college (no winner-takes-it all delegations). The college can then serve as a 'buffer' to prevent the rule of the mob (for people who believe they indeed fulfill that function).
Tbf Windows has windows in it

It's not called Microsoft Ads 2020
In the Netherlands we have a completely seperated bus network. No speedbumps, traffic light priority and audible cue at the intersection. Works pretty well for emergency services.
> I could see budgeting in some tax breaks for local businesses that make their restrooms publicly accessible.

People significantly underestimate the cost of maintaining clean public restrooms in urban areas.

When restrooms are used properly, maintenance costs are reasonable and predictable. But that is not what happens.

Restrooms contain private areas, and that reality invites other uses, like drug use, prostitution, and sleeping. And those uses come at a steep cost.

Separately, in my experience, many businesses do make their restrooms available to people who look presentable and who ask politely. They just don’t advertise it, and they may even advertise the opposite.
What were they up to on October 6? I wonder what could have happened that might have brought out the retributive side. Surely the broad support for terrorism pushed by Qatari money and slow-burning propaganda couldn't have further inflamed them for the umpteenth time in 3000+ years of suffering and trying to avoid abuse... /shrug

If it was really a response to Saudi Arabia on the verge of signing a peace agreement with Israel, what would that say about the unfortunate aggressors?
It still was a terrible experience, no idea why you wouldn't use LaTeX or Typst over this, even Word felt better.
Agreed. They would have never written this if they remembered to don their tinfoil headgear first.