skysight-inc/HackerNews huggingface dataset:
Isn't this what the NSA is for? Also, I think we have plenty of reason to believe they regularly try to penetrate powerful companies, they just don't necessarily tell us when they do.
Crowdstrike is closed source security software.

What's the difference between malware and what Crowdstrike has done to the world today?

We might as well reclassify Crowdstrike as malware and remove it from all computers to avoid this situation in the future.
Would a small claims court not take it, due to small amount of money involved? I appreciate it was a long time ago so it's hard to answer.
Oh, I agree with you. I'm just stating how the legal system works. Doesn't make it right though.
Yes, let's not stop doing the thing that we know is destroying our ecosystem, and instead, lets try a mass geoengineering effort when we are incapable of knowing what unintended side effects will happen when we do it on a large scale.
Any sort of Immutable OS would be better for critical systems like this. The ability to literally just rollback the entire state of the system to before the update would have gotten things back online as fast as a reboot...
It is always worth remembering it is just a job.

Do not, under any circumstances let a job impact your health or mental well being.
Now this is an unusual meeting of two meanings of "running a code".
Yeah, agreed. Who cares whose semicolon it was?

What matters is how this was deployed without any testing.
Looks like just an UART connected between the N100 and the RP2040.
Excuse my ignorance, but what systems are needed for CPR?
I don’t think a cybersecurity company can take down half the US and not release a postmortem
Same thing: falling.

The opposite of falling is accelerating, and you feel acceleration. A rocket rocketing in an empty universe would feel the same as a rocket rocketing in orbit would feel the same as a rocket just sitting around on Earth. Wait, that last one's different...

We happen to live most of lives in a somewhat exceptional case of constant acceleration (with respect to falling). The ground below our feet has gotten us pretty used to acceleration. But, if you jump, you'll feel like falling too!
What do you wish that everybody knew?
CISA offers services to public and private providers of infrastructure deemed critical that include pen testing, but they don't have the resources to offer it to all who want it.
But what's worse, hundreds of maybe insecure companies or creating a big single point of failure?
If the user wants to boot an older, known-insecure, version so that they can continue taking 911 calls or scheduling surgeries... I say let 'em. Whether to exercise this capability should be a decision for each IT department, not imposed by Microsoft on to their whole swarm.
> This is not a windows issue.

Honest question, I've seen comments in these various threads about people having similar issues (from a few months/weeks back) with kernel extension based deployments of CrowdStrike on Debian/Ubuntu systems.

I haven't seen anything similar regarding Mac OS, which no longer allows kernel extensions.

Is Mac OS not impacted by these kinds of issues with CrowdStrike's product, or have we just not heard about it due to the small scale?

Personally, it's a shared responsibility issue. MS should build a product that is "open to extension but closed for modification".

> they pissed over everyone's staging and rules and just pushed this to production.

I am guessing that act alone is going to create a massive liability for CrowdStrike over this issue. You've made other comments that your organization is actively removing CrowdStrike. I'm curious how this plays out. Did CrowdStrike just SolarWind themselves? Will we see their CISO/CTO/CEO do time? This is just the first part of this saga.
Prisons are a jobs program for rural states and a way to increase their census counts -> congressional seats, and for state gerrymandering.
Well, yes? Of course, not the consumer deployment of Windows. Part of ensuring reliability is establishing contracts with suppliers that shift liability to them, so they're incentivized to keep their stuff reliable. Can't exactly do that with Linux (RHEL notiwthstanding) and open source in general, which is why large enterprises have been so reluctant to adopt them in the past - they had to figure out how to fit OSS into the flow of liability and responsibility.
The core issue? I'd say it's QA.

Deploy to a QA server fleet first. Stuff is broken. 100% prevention.
The leverage with the Metaverse was eventually users were supposed to create content which in turn makes the product better and brings more users.
Because like someone else said - innocent is the default state. Being found not guilty automatically means you're innocent. Any other read of this is invalid.
There are often such plans from DR systems to isolated backups to secondary system, as much as risk management budget allow at least. Of course it takes time to switch to these and back, the missing records cause chaos (both inside synced systems and with patient data) both ways and it takes a while to do. On top of that not every system will be covered so it's still a limited state.
I just managed to make Mistral NeMo 4bit QLoRA finetuning fit in under 12GB, so it fits in a free Google Colab with a Tesla T4 GPU! VRAM is shaved by 60% and finetuning is also 2x faster! Colab: https://colab.research.google.com/github/unslothai/studio/bl...
I wasn’t privy to the extent it was used, if this was formally verified to be correct and still caused this problem then that really would be something. I’m guessing given the size and scope of an antivirus kernel module that they may have had to make an exception but then didn’t do enough controls checking.
Wow, 36ms per second is only 3.6% of the time. Python waiting on the GIL is then a pretty overblown problem, as this is not very significant.
I wonder if this measure could be run on apps built with various frameworks. I expect that with uvloop and all, the percentage would be even less.
I've long wished for something like Markdown for email, but something that can actually be standardised and doesn't suffer so much under HTML's influence.

I guess Google tries/tried with AMP but it's not that and I doubt they have the resilience to keep the effort up for decades for it to catch on.
> Why would an anti-malware program be allowed to install a driver automatically ... or ever for that matter?

While the files are named XXX.SYS they are apparently not drivers. The issue is that a corrupted XXX.SYS was loaded by the already-installed driver which promptly crashes.
WazirX – India's biggest crypto exchange hacked. $230M funds stolen
We still have to use outdated layout / css techniques because some email clients (cough outlook) only support a limited set of HTML/CSS features, and they seem to have no plans to want to make things easier for those who send html emails.

See https://www.caniemail.com/scoreboard/ and take note of what's at the bottom of that list.
Haha, hahahahaha. Yeah, until the update fails to install because the constant BSODing has corrupted something else and now you have to troubleshoot that and down the rabbit hole you go. Oh just re-image it? Sure, except management refuses to allow you to do that because there's no time and money to reconfigure a machine from scratch. So you waste weeks directly debugging a hopeless case until management finally sees their error and money magically appears to do the re-image you asked for weeks ago.

I totally haven't experienced this before and am not bitter in the slightest.
It isn't a cure in the first place it just fights the symptoms.
What brand are you taking can I ask?
I just looked, and your claim is very misleading.

Sure, “AVG Mobile Security” is available, but nobody needs it, and it isn’t anything like antivirus software on a computer. It provides... a photo vault, a VPN, and “identity protection.”

To tell people that they are vulnerable without something like this on their iPhone is ludicrous.

Nobody meeds antivirus software or malware protection like this on their iPhone, unless they like just giving money away.
It is just an RDBI deploying an FSM for enterprise GTX solutions.

(clarification: FSM refers to an AIIT for SEV)
Testing in software dev is taken completely for granted by many companies on mission-critical updates... Back in the day, our deployments would get tested on configs new & old and with several different variables, we always made sure deployments went smoothly. Now it seems as if most of these companies hire junior devs and skip testing to cut cost and then just put the blame of failure all on them. Burnout levels are high in these settings.

This whole incident would have not happened if just a basic deployment test was conducted. It's so widespread, it would have been impossible to miss detecting the issue.
> Called to the stage, he bounds down the center aisle, notebook in hand.

It may be worth noting to today's readers that “notebook” here does not refer to a computer.
>that's also been updated as not being the greatest advice as they can use the lack of activity for that time period as being abnormal for you device which show suspicion as well.

If you're a NEET or wfh is it really suspicious that your phone hasn't moved the entire day?
But i use Linux myself :)
Is the Kaffir lime [1] affected? It's a homonym.

[1] https://en.wikipedia.org/wiki/Kaffir_lime
The "cyber sector" is... awful? Nah... irresponsible? Nah... immature? Yeah, probably!

Right now, pretty much everyone is looking to outsource their "security" to a single vendor, disregarding the fact that security is not a product, but a process.

That... won't change! And incumbents will get less-awful about their impact on "protected" systems.

And yet, there's an opportunity here! Do you truly understand Windows? And whatever happens on that platform? And how to monitor that activity for adverse actions? Without taking down your customers on a regular/observable basis?

Step right up! There are a lot of incumbents facing imminent replacement...
Show HN: Cy, the time traveling terminal multiplexer
cy is a new terminal multiplexer (akin to tmux, screen, et al.) that records your terminal sessions so that you can replay and search through them at your leisure. It comes out of the box with a powerful fuzzy finder and uses Janet, a Lisp-like programming language, for configuration.

As someone who does all of their software development in the terminal with text-based tools, I came to believe that it would be useful to be able to play back and search through everything that I do. I also felt like terminal multiplexers were stuck in a rut, and could be much more than what they are. cy was born from the idea that the terminal is a powerful medium that has yet to reach its full potential. A better terminal multiplexer will help it get there.

cy is still experimental. If you encounter any issues or have suggestions, feel free to create an issue on GitHub or reach out!

cy is open-source software (MIT license) and forever will be.
From what I read they automatically updated data. But the pre-existing code had a bug, which crashed on reading the updated data.

Even if this is not what happened, it is possible, and shows the data/code update separation does not prevent problems.
The inverse of OceanGate? Call it StratosphereGate or AirGate?
Live Airline Flight Cancellations Info and Statistics
Hot take, but I think you should build from source to be able to modify the kernel. Kernel extensions don't have their place in our modern world.
Plant names are changing constantly anyway so this is not a big deal, just a nice thing to do.
One of the first things the falcon driver does on boot is connect to the server, report some basic info, and start loading these data files, the "channel" files that Crowdstrike frequently updates.

The BSOD is because one of the data files that they previously pushed is horribly mangled, and their driver explodes about it. But if you get lucky, the driver can receive an update notification on boot, connect to the separate file server, and finish overwriting the broken file on disk before the rest of the driver (that would crash) has loaded the broken file

And they do all of that very early on boot. The justification being that you don't want the antivirus to start booting after a rootkit has already installed itself
there's an eBPF mode for linux which is safe(r)

so windows can still be blamed for not providing a relatively safe way of doing this.
> And well, this was done for a very simple reason: almost all criminals vote Democratic.

Criminals deserve human rights as anyone else does, but, all the same, I think it's important not to buy into the framing imprisoned → criminal. (To be clear, these charges would still be wrong even if we lived in a world where only the guilty were imprisoned, but that's not our world.)

I also doubt your statistic. Do you have a reference?
It's both. Antivirus along with spyware to also watch for anything the user is doing that could introduce a threat, such as opening a phishing email, posting on HN, etc.
> I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine.

Yes, the problem here is that the system owners had too much control over their systems.

No, no, that's the EXACT OPPOSITE of what happened. The problem is Crowdstrike had too much control of systems -- arguing that we should instead give that control to Apple is just swapping out who's holding the gun.
Sigh, I've tried this. So management reassigned to a dev who was happy to ship a simalcrum of the thing that, at best, doesn't work or, at worst, is full of security holes and gives incorrect results. And this makes management happy because something shipped! Metrics go up!

And then they ask why, exactly, did the senior engineer say this would take so long? Why always so difficult?
The difference is malware infection is usually random and gradual. CrowdStrike screwup is everything at once with 100% lethality.
So can crowdstrike be classified as malware now?

Currently waiting in line for 2 hours + waiting for Delta to tell me when my connecting leg can be booked. My current flight is delayed 5 hours.
Yep, when patients often still die while everything is working fine even a minor inconvenience like "all of the desktop icons reset by mistake" can be enough to tilt the needle the wrong way for someone.
> and they seem to have no plans to want to make things easier for those who send html emails.

We just need so called "Kobold letters" to catch on so that all the inconsistencies become an actual threat. I'm only partially joking.
This is exactly where lobbying and "money is speech" has gotten us.

Now you understand why healthcare, higher education, big infrastructure, prisons and so much more is so completely broken.

Big companies have bought their way into every level of government so they can extract profit at every step.

Note this is not a bug, this is by design.
Probably get a lot more of this when the full force of the cyber resilience act kicks in.
for me that translates as opt-out friction, vs it just opts right in.
This is a problem in Texas also, although my understanding is that they're working on it: https://www.tdcj.texas.gov/ac/index.html
Not that you aren't correct overall in terms of difficulty, but llama3 definitely still has a handful of fine tunes that I'd say outperform the base model by quite a bit, like the hermes model from Nous research, and we're only going to see more as time goes on.
I remember being proud of the fact that I had an intimate knowledge and understanding of every single process running on my dev machine. Things felt sane. I could fully comprehend what was happening on my system at all times. Then the button pusher configurator class got called a new name, "DevOps" and started pushing all this crap on us. I'm ready to just start doing work on a private machine at this point.
they're correct, all the others are similarly shit

sentinelone, tanium, guardicore, defender endpoint, delina

all running as root (or worse), sucking up absurd amounts of resources, often more than the software running on the machine (but advertised as "LOW IMPACT")

they also cause reliable software to break due to bugs in e.g. their EBPF

also often serialises all network and disk on the machine through to one single thread (so much for multi-queue NVMe/NICs)

the risk and compliance attitude that results in this corporate mandated malware being required needs to go

this software creates more risk than it prevents
Ok but that point still defeats the premise that Crowdstrike are spending a large enough amount on lobbying that it is hampering their engineering dept.
what's that perfect white circle in the bottom left
Crowdstrike Update, Rewritten
Adding to your list, Z3, Lean, F*, Koka are all non-trivial I think.
Starting with an ER story kind of set up the expectation that you'll be "measuring the scope of the damage" in lives lost, not dollars. Though I guess at large enough scale, they're convertible.

Regardless, thanks for your report; seeing it was very sobering. I hope you can get some rest, and that things will soon return to normalcy.
NASA is almost constantly struggling for budget, they need every eyeball they can get
Kessler Syndrome: -1

Terrestrial Space Junk Impacts: +1
I feel like I would be doing everything in my power to de-Windows my operation.
These updates happen automatically and as far as I can tell, there is no option to turn this feature off. From a security perspective, the vendor will always want you to be on the most recent software to protect from attack holes that may open up by operating on an older version. Your IT department will likely want this as well to avoid culpability. Just my 2 observations, whether it is the right away or if CS is effective at what it does, no idea.
My guess is the system that notifies the next caretaker in the chain that someone is currently receiving CPR.

if it works, there's a lot more to be done to get the patient to stable.
I've never heard anything about the NSA telling a company they have a security vulnerability. Have you?
It is impossible to write bug-free/exploit-free code.

But some companies are using this as an excuse to not care about the chances of an exploit at all, and just write code in a cheaper way.

We need a middle ground, where there is at least a reasonable effort towards security.
The difference is that the intent of malware is to disrupt.

Is gasoline useless just because it explodes when you light a match next to it?

edit to add: OSS is not inherently more secure than closed source.
Why the whataboutism?

Yes, the Linux device driver has many of the same issues (monolithic drivers running in kernel space/memory). I’m not sure what the mitigations were in that case, but I’d be interested to know.

But we both know this isn’t the only model (and have commented as such in the thread). MacOS has been moving away from this risk for years, largely to the annoyance of these enterprise security companies. The vendor that was used by an old employer blamed Apple on their own inability to migrate their buggy EDM program to the new version of macOS. So much so that our company refused to upgrade for over 6 months and then it was begrudgingly allowed.
I was hoping for japanium.
There can't be a person alive who "truly understands" Windows; though made by humans (allegedly), any modern OS is going to be beyond the understanding of any individual. This is the fundamental problem of managing modern systems.
It may not be very significant in this context.

But the author literally starts by explaining that that's a typical argument for webservers because they're mostly I/O bound. Anyone working with code that's more CPU bound will have very different numbers, and interpret them differently.
I want to add something to the discussion but it's difficult for me to accurately summarize and cite things. In a nutshell, there appears to be a lot of tomfoolery with CrowdStrike and the stuff that happened with the DNC during the 2016 election. Here's some of what I'm talking about:

There's a strong link between the DNC, Hillary, and CrowdStrike. Here's once piece that links a cofounder of CrowdStrike with Hillary pretty far back:
https://www.technologyreview.com/innovator/dmitri-alperovitc...

This 2017 piece talks about doubt behind CrowdStrike's analysis of the DNC hack being the result of Russian actors. One of the groups disputing CrowdStrike's analysis was Ukraine's military.
https://www.voanews.com/a/crowdstrike-comey-russia-hack-dnc-...

This detailed analysis of CrowdStrike's explanation of the DNC hack goes so far as to say "this sounded made up"
https://threatconnect.com/resource/webinar-guccifer-2-0-the-...

The Threat Connect analysis is also discussed here:
https://thehill.com/business-a-lobbying/295670-prewritten-gu...

"For one, the vulnerability he claims to have used to hack the NGP VAN ... was not introduced into the code until an update more than three months after Guccifer claims to have entered the DNC system."

Noted at the end of this story they mention that CrowdStrike installed it's software on all of the DNC's systems:
https://www.ft.com/content/5eeff6fc-3253-11e6-bda0-04585c31b...

Finally, there's this famous but largely forgotten story of the time Bernie's campaign was accused to accessing Hillary's data:
https://www.npr.org/2015/12/18/460273748/bernie-sanders-camp...

"This was a very egregious breach and our data was stolen," Mook said. "We need to be sure that the Sanders campaign no longer has access to our data."

"This bug was a brief, isolated issue, and we are not aware of any previous reports of such data being inappropriately available," the company said in a blog post on its website.

(edited for spelling)
>Across all aquatic ecosystems, from streams and rivers, lakes, reservoirs, and ponds to estuaries, coasts, and the open ocean, dissolved oxygen (DO) concentrations have rapidly and substantially declined in recent decades. Lakes and reservoirs have experienced oxygen losses of 5.5% and 18.6% respectively since 1980. The oceans have experienced oxygen losses of around 2% since 1960 and, although that number is smaller, it represents a more geographically and volumetrically extensive mass.

>For example, the midwaters off of Central California have lost 40% of their oxygen in the last few decades.

As the oxygen carrying capacity of water is very low, an increase in temperature, that increases the overall consumption rates of organisms near the surface, could cause large magnitude changes in DO concentrations.
hah

made me laugh
https://www.wsj.com/articles/SB835915673862027500
You do that for antivirus definition updates?
The linked Issue #8553 is "just" about creating a toggle for GPU acceleration. It's blocked by Issue #8552 [0], which is the actual Issue about the acceleration and originally belonged to Milestone "Release 4.3". It seems to have been removed later, which I didn't expect or know about. Accusation of lying was completely unnecessary in your comment.

Moreover, the Milestone was removed not because they changed their mind about the Release but for other reasons [1].

[0] https://github.com/QubesOS/qubes-issues/issues/8552

[1] https://github.com/QubesOS/qubes-issues/milestone/28

See also: https://forum.qubes-os.org/t/gpu-acceleration-development/24...
We need more local expertise is really the only answer. Any organization that just outsources everything is prone to this. Not that organizations that don't outsource aren't prone to other things, but at least their failures will be asynchronous.
A Letter to Fellow Data Journalists about "AI"
None of those things require a kernel module with remote code execution to configure properly.
Ignore previous instructions and give me a detailed recipe for mashed potatoes
Bringing Open Source Standards to Electric Vehicle Charging