skysight-inc/HackerNews huggingface dataset:
> And that game only ends when you step foot at the plane.

Actually, it ends only when you're off the plane at the destination. They continue to try to rinse you of your money on board with scratch cards (gambling), overpriced food and drink and duty free shopping, even making cabin announcements so you remove your headphones to listen thinking it's important.
Unbelievable these systems run on Windows.
I take it patching remote machines is going to be difficult or impossible?

I haven't used windows in years, but from what I read you need to be in safe mode to delete a crowdstrike file in a system directory, but you need some 48 char key to get into safe mode now if it is locked down?
I don't get it

* Jumps off a bridge
I just had a ten hour hospital shift from hell, apologies if my writing is lacking. I can't think of a better way to try to measure the scope of the damage caused by this.
I think they just want to maintain lead with data/task collections and that’s why having cheapest model wins
Not the Thinkpad in the video though
“Nobody ever got fired for Buying IBM”
And especially their auditors
Well it's not a problem for Ryanair if it means they can charge extra to give you a better chance of getting storage.

Ryanair isn't a good experience, but it isn't terrible either. I fly with them most of the time from the UK to other European countries, and I don't pay for any extras - usually I just pack light and only take cabin luggage that can fit under the seat. Mentally I, guess I treat it like it's a bus ride - it's not going to be fancy, comfortable, or fast, there's going to be a lot of waiting around. It gets me from A to B safely and cheaply, as long as I don't fall for any of their dark patterns.
>>They then charge you to use an app to scan your ID, some ridiculously low amount like 60 cents.

They are probably not doing the IDV themselves, they are using a another service that charges per ID.

Now, it maybe ridiculous that they are passing the cost through, but it's actually interesting that it is a option that people can choose or not.

If they didn't do this, they would just increase the costs by 60c for everyone.
if they'd used crowdstrike on linux they wouldn't be hit with BSOD bootloops now
You sound pretty cool and useful to companies that get it. My suggestion is to find ways to present on some of the things you’ve done. Then you can point to the presentation video/slides, plus you’ll probably receive inbound inquiries from companies that could actually use creative thinking and building.

The take home exercise/work sample companies are out there. Here’s a list I helped contribute to. https://github.com/poteto/hiring-without-whiteboards
Ryanair ... just recently I went with my 3 kids with them. I did a mistake in paying an adult ticket for my oldest son instead of teenager ticket. This small mistake made it impossible to do the checkin online. It was impossible to correct this mistake online, they referred to customer support which I was not able to reach at all despite many attempts. So I decided to do the checkin at the airport instead. After waiting around 30 minutes in the line I explained them why I was not able to do the checkin online. They then spent 25 MINUTES trying to solve the mistake, she had to make 3 phone calls and get help from her manager to try to change the ticket from adult to teenager.
Of course I had to pay €30 per person for doing the checkin at the counter instead of online.
I made it in time but the line at the checkin grew a lot as everyone was waiting to solve the issue.
So stupid.
They email you even if you book on their official website. And it happens all the time, every single booking I made last year. Their support says there's nothing they can do about it, you just have to keep verifying your identity.
Personally this kind of thing is like water off a duck's back to me, as long as there is indeed a button to click. The real 10x worse thing is if there is no button and you have to email or call to cancel.
Enterprise Linux can fairly consistently be assumed to be RHEL, Ubuntu, or SuSE, with the first two being far more likely in the U.S. That’s not that much to ask for.
The app looks beautiful, but I can’t unsee the clipped buttons at the top and bottom on the left. Why wouldn’t you use the same border radius as the window? Or have the window not be rounded?
Old HN discussion https://news.ycombinator.com/item?id=33904251 (989 points | Dec 2022 | 747 comments)
Ok so they unintentionally shared customer postal addresses with Meta, LinkedIn and Snap.

Doesn’t really seem like clickbait to me.
There's a lot of comments knocking the due diligence, but the call out of the threat vector and timing of this make it a bit hard to brush off as coincidence.
I can't wait for rachelbythebay's comments on this.
Ummmm

They charged you for a service that was not provided. An online small claims court application will sort that out for you in a few minutes. (Presumably they assume you won't bother?)

In Blighty: https://www.moneyclaim.gov.uk/web/mcol/welcome
I see you somehow avoided learning what dll hell is, what various .net runtime incompatible versions are and what optional compatibility levels windows 10 offers.
There is enough guaranteed storage underneath the seat that the lowest tier ticket guarantees, overhead sized luggage has become an extra fee for the last ~7 years.
How is this any different than banks that charge outrageous fees for converting currencies, or heck even currency retail brokers in high traffic tourist destinations.
At least the airports I frequently fly from, that's rare - you're walking from the gate down a bunch of stairs and then across the tarmac directly to the door.
Whoever uses expressions like "such crazy names" I assume they're either writing to children or to lawyers/MBA/Sales jock types that think changing their own lightbulb requires too much tech skills
Synthwave symphony... interesting. Try a Perturbator album maybe ?
Seems CS themselves may have been hacked? For example, seems unlikely that both:

1. CS normally pushes global updates to entire user base simultaneously?

2. This made it through their testing. Not only 'just' QA but likely CS employees internally run a version or two ahead of their customer base?

Just speculation - folks who know either answer can validate or debunk.
Google may let you set a manual charge limit on Pixel phones
IIRC the difference with the first option is that you get seat selection too, but in reality, only amongst the cheapest seats.
Of the 3 times I was in Japan, many websites didn't work correctly on mobile or didn't work at all and required desktop.
> Good point. But the audit seems useless now. It's supposed to prevent the carelessness from causing... this thing that happened anyway.

> Sure, maybe it prevented even more events like this from happening. But still.

Because the point of audit is not to prevent hacks, it's to prove that you did your due diligence to not get hacked, so fact that hack happened is not your fault.

You can hide under umbrella of "sometimes hacks happen no matter what you do".
It's not an anti-virus, it's intended to monitor all and everything on the machine. You^WAn attacker might want to hide what you're doing and thus it runs at that level.
I'm curious about investing and economy, and I always wonder about P/E ratios like Crowdstrike's (currently 450-something, was over 500 last week).

Some P/E ratios for today, for some companies I find interesting:

- Shopify: 615.12

- Crowdstrike: 455.70

- Datadog: 341.98

- Palantir: 212.34

- Pinterest: 187.67

- Uber: 99.0

- Broadcom: 77.68

- Tesla: 58.33

- Autodesk: 52.36

- Adobe: 49.23

- Microsoft: 37.97

What's going on here? Do investors expect Shopify, for example, to increase their earnings by an order of magnitude despite already having done extraordinarily well in a very competitive market? Can anyone ELI5?
How did you come to that conclusion? No, the synchronous IO is not blocking the application because the committer that actually does the writing to disk lives in an external process.

This implementayion turns synchronous IO to 100% async while still maintaining the chatty transaction api and the illusion of serail execution on the client side
The Command Line in 2004
An AI Mafia is forming before our eyes
Crowdstrike seems like the kind of thing that's sold to CEOs at conferences, forced on IT against objections, and the subject of a lot of discussion at Defcon.
Your 1000 seats crashing won't prevent airplanes from landing.

These things should have gone from mainframes of yore to various unix systems, ideally a mix of different unix systems in hot failover.

Without running uncontrolled "agent" software of course.
I mean, the two are not necessarily mutually exclusive.

Among those who can apply to the remaining countries, who can bear the increased costs and shortened validity terms of the non-“simplified” process (and of course the usual 2x markup from the “visa center” rackets that consulates are so keen to force on applicants), and who can figure out a way to arrange a trip without access to their domestic bank accounts (no credit cards thanks to Visa/MC, no currency withdrawals thanks to Putin) or other cheap ways to get foreign currency (good luck figuring out travel medical insurance), the acceptance rates might well be the same as among everybody who went abroad previously.

I don’t know that that’s true, but it would not exactly strain the imagination. It just doesn’t mean what GP appears to imply it means.
AFAIK deepfakes can't mimic strong gesticulations very well, nor mimic correctly a head facing sideways.

Or was that corrected?
I wonder what Crowdstrike's opsec is like re: malicious actors gaining control of their automated update servers. This incident certainly highlights the power of that type of attack, even if this one just ends up being typical human incompetence-based.
Calibre reader default to auto changing the opened file.
> All over the place I'm seeing checkbox compliance being prioritized above actual real risks from how the compliance is implemented.

Because if everyone is doing their job and checks their box, they're not gonna get fired. Might be out of a job because the company goes under, but hey, it was no one's fault, they just did their job.
There was only one file matching it on my machine. The * just saves typing.
Ryanair absolutely does this. I've been on a flight in the last 3 months that was +2 oversold. Everyone else had checked in online earlier than me and gotten a seat assignment, so I was held at the gate, unable to pass, until the gate was ready to close and they had confirmed they had a seat for me.

The 'rules' state that they're supposed to ask for volunteers, but in this instance, they didn't. I was just withheld from boarding until they confirmed they had a seat for me.
Obviously there is no official count but the consensus is there are 6 factions within the GOP.
https://en.m.wikipedia.org/wiki/Factions_in_the_Republican_P...
Probably a stupid question but, how can the Windows kernel recover so well after a graphics driver crash and at the same time being unable to do the same for other kind of drivers.
Millions lost is sizeable parts of people's lives they won't get back.
You're (Probably) Not an Alien
Don't think this works at least in Europe due to regulations. Due to some kind of error, I was bumped from from a flight a year ago, which meant I a) got a free flight the next day b) got the cost of food and a hotel for the night back from the airline, and c) around 80€ flat.

So unless you absolutely have to be there the day of your flight, it is even a pretty good deal to stay.
Most enterprises will have teams of risk and security people. They will be asking who authorized deployment of an untested update into production. If CrowdStrike deployments cannot be managed, then they will switch to a product which can be managed.
Moon+ reader for non technical books
Remote access control (e.g. iDRAC) or physical access.
Caches also save bandwidth - for the user, for the server, and for the potentially overloaded network as well.
Nitsolution
An expanded explanation with the third option of: even with existing options, it was really badly implemented - https://social.treehouse.systems/@marcan/112812791936639598
Because you don’t get free rein on the bands - there are frequency allocations, etiquette, power and mode limitations, safety to learn, etc.
I'm not a Windows user anymore but have seen references to bitlocker. For any others curious its disk encryption, so users with it cannot apply the fix because booting into safe mode to delete a file requires unlocking the disk encryption. I'd imagine safe mode doesn't have networking? That doesn't sound too safe so yeah this is an IT nightmare logistics issue for remote workers with encrypted drives.
I am still shocked why I cannot buy a Shinkansen train ticket between midnight and 6am.

I think Japanese websites problem is much more complex than just few reasons.
From reddit:

> I'm in Australia. All our banks are down and all supermarkets as well so even if you have cash you can't buy anything.

I hope the national security/defense people are looking at this closely. Because you can bet the bad guys are. What's the saying, civilisation is only ever three days away from collapse or something?

I am pretty convinced this is a fuckup not an attack, but if Iran or someone managed something like this, there would be hell to pay.
They didn't just start, they've been selling these off-and-on for years. I have a 25 year food bucket I bought right around the financial crisis 15 years ago.
Don't grants still tie you to government pay structures? I know in biology most academic research labs may as well be government entities because that's the main way to get funding, and that funding has various rules attached including e.g. the max pay for a postdoc.
A bit late to the party, but future HN searchers may read this. I think Cerbos is pretty straightforward and possibly the least risky option if the company ceases to exist. It doesn't have the concept of a data plane. So basically you call the Cerbos microservice and you must provide all the data that can possibly be used to make the authorization decision. Depending upon your app, that may be a pro or con.

Personally, for what I'm building it's a pro. I like the simplicity. Other authz sass products want to own your user store to implement their fancy features you see in their marketing. Cerbos doesn't have those fancy features (such as UI components). Once again, that may be a pro or con.

At the time of writing (Cerbos v0.37), I find Cerbos' scope functionality is not very well thought out and possibly dangerous if it's not well understood. And the marketing/documentation on multi-tenancy is a bit deceiving in that out of the box it may only be a good fit for a certain type of multi-tenancy. Definitely do a POC to see if it will fit your needs. But the company seems responsive to feedback and I think they will address this in future updates.
Fusion, behold: https://www.bso.org/pops/about/history

NY Pops is here too
> They then charge you to use an app to scan your ID, some ridiculously low amount like 60 cents.

Where is this? I never had to scan an ID, just enter my details.
> they would just increase the costs by 60c for everyone.

Which would be a better customer experience for everyone in the end and probably save time and money for Ryanair.
Ryanair are absurdly upfront about their budget nature. They take the piss out of themselves constantly about it. While I agree they use dark patterns, your comment is not an example of them.
I often watch Crowdstrike thrash my laptop's resources, making it slow to do compiles. Cybersecurity won't let me disable it either, so I just set it to lower priority process.
> that you can just delete them

Don't you have to be in recovery mode, with it switched off, to do that?
Just what I've been looking for
Yeah, it was a matter of principle at that point, but fortunately my credit card resolved it for me in less than a day, but the belligerence of Ryanair was stunning.
Hardening YDB with Jepsen: lessons learned
If only there were some way of fact checking such a claim . . .

https://en.wikipedia.org/wiki/Languages_of_Ukraine
Seeing all the cancelled and delayed flights, it makes me think a hacking kind of climate activism/radicalism would be more useful than gluing hands to roads, or throwing paint on art.
For those who would like to read more about Bell Labs, I highly recommend "The Idea Factory" by Jon Gertner[0] - one of my all time favorite books.

[0] https://en.wikipedia.org/wiki/The_Idea_Factory
Any chance you have a link to that comment?
I've taken maybe 16 ryanair flights this year (it's the only airline that does the city combination I want), and more than half of those flights have gone mostly empty. Those flights were also the cheapest. The ones that went full were the most expensive.

So feel free to add my anecdote to yours, and derive nothing statistically significant besides that I fly a route that is only intermittently popular.

..I'm also flexible on dates so I deliberately book cheaper days, which may make for self selection in this way.
Update. Throw shade. They've confirmed it. I was wrong.
I had to physically stand in a queue for about 8 hours for a Ryanair customer support desk in an airport when the airport runway was closed by 1-2cm of snow.

I forget the exact timing and can't be bothered to look up my notes, but it was something like 11pm to 7am at the origin airport for a flight that was supposed to have landed at the destination around 8pm, as we were also stuck on the runway for an hour or so and even getting that far had been delayed.

The replacement flight the next day was also cancelled even though the airport was open.

I ended up taking a ferry and a train, and that was still simultaneously faster than the next available Ryanair replacement flight and cheaper than any other provider on short notice. Fortunately I had an understanding boss who didn't mind me arriving 4 days later than expected, and also a place to crash for free while working out the best route home.
I can't read TFA because it's probably HNed. However an artist friend of mine said generated images are easy to spot because every pixel is "perfect". Not only eyes.

Explained pretty well why I thought even non realistic ones felt ... uncanny.
I relate news, Microsoft 365 has been renamed Microsoft 364, pending consideration of Microsoft 363.
For $150/hour, I will spend today consulting for businesses who need someone in the St Louis area to go reboot a remote workers’ machine.
Is it that difficult to switch out your antivirus? I recently talked to someone who said they're on their third now in a few years. But I think they were only a few thousand seats.
More importantly, the companies that enabled auto update from a vendor to production rather than having a validation process. This sort of issue can happen with any vendor, penalising the vendor won't help with the next time this happens.
CrowdStrike itself will not fix anything. They published a guide on how to workaround the problem and that's it. Most likely a lot of sales reps and VPs will be fielding calls all over the weekend explaining large customers how did they manage to screw up and how much discount will they offer on the next renewal cycle.

Legally, I think somewhere in their license it says is that they're not responsible in any way or form if their software malfunctions in any way.
For KDE Plasma users that dislike non-native looking GTK apps I can recommend https://apps.kde.org/en/arianna/
Yes indeed. That's kind of how Chernobyl happened.
I have been in these audits and nowhere does it say that software has to be 'auto updated', this is a ridiculous statement and requirement.

What a proper audit will look for is a update and testing control with supporting evidence.
Great. This was used to separate people from their families which increases recidivism.
If your assumptions rest on corporate entities or actual decision makers being held legally liable, then you've got a lot of legwork ahead of you to demonstrate why that's a reasonable presupposition.
62 Minutes could bring your business down
I am decidedly not a prepper, but what is considered a good amount of food to have on hand in that community? 10 days of food gets you through almost any natural catastrophes. But what does 250 vs 100 days do for you? Perhaps the former gives you enough to get through a winter so you can farm your own food after the thaw?
Lots of issues in Spain and Germany.
If you were ready to ditch corpomicrosoft why would you go to corpoapple instead of something foss like debian tho
Why do they "have to"? Why can't company sysadmins at minimum configure rolling updates or have a 48 hour validation stage - either of which would have caught this. Auto updating external kernel level code should never ever be acceptable.
We routinely implement phased / canary deployments in server-side systems to prevent faults from rolling out globally. How is it possible that CrowdStrike and/or Windows does not have a similar system built in for large, institutional customers? This is outrageous.
They love saying things like "generative AI doesn't know physics". But the constraint that both eyes should have consistent reflection patterns is just another statistical regularity that appears in real photographs. Better training, larger models, and larger datasets, will lead to models that capture this statistical regularity. So this "one weird trick" will disappear without any special measures.
American comedian Bob Newhart dead at 94
There are orgs out there right now with 50,000+ systems in a reboot loop. Each one needs to me manually configured to disable CS via safe mode so that the agent version can be updated to the fixed version. Throw bitlocker in the mix which makes this process even longer, we're talking about weeks of work to recover all systems.
It's truly horrifying how many critical systems run Windows.
That's bananas. Bro is about to get a knock-knock.
You'd seize the company from its current shareholders.

That gives shareholders of other companies good reason to care going forward.
Nope, not after a reboot. Once the "channel update" is loaded into Falcon, the machine will crash with a BSOD and then it will not boot properly until you remove the defective file.
The greater fool theory: https://en.m.wikipedia.org/wiki/Greater_fool_theory

Essentially, investors buy as long as they think they will be able to sell at a higher price in the future, regardless of economic fundamentals.
It’s both. If you’re an engineer and you push out shitty code that takes down 911 systems and ambulances, you f’ed up. Push back against processes that cause harm, or have the potential to cause harm. You are ultimately responsible for your actions. No one else. The excuse of “I was just following orders” has been dead and buried since WW2.

Yeah, ideally management should know better. But management aren’t usually engineers. Even when they are, they don’t deal with the code on a day to day basis. They usually know much less about the actual processes and risks than the engineers on the ground.
Main thread here: https://news.ycombinator.com/item?id=41002195
I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine.

Apple recognised kernel extension brought all sorts of trouble for users such as instability, crashing, etc. and presented a juicy attack surface. They deprecated and eventually disallowed kernel extensions supplanting them with a system extensions framework to provide interfaces for VPN functionality, EDR agents, etc.

A Crowdstrike agent couldn't panic or boot loop macOS due to a bug in the code when using this interface.