skysight-inc/HackerNews huggingface dataset:
MacOS seems to be fine (or I was too late to get an update)
This incident definitely makes a good case for staggered deploys of patches.
> But I cannot imagine doing that as an American. It kind of makes me wonder if he's messing with me but he hates Russia and Putin and I don't know why he would. I feel like I would be so unsafe. I'm a very "American" looking person and I only know a handful of Russian words. Well, I guess I look more German, blonde/blue eyed.

Now I’m imagining a flat with some Russian friends where they take turns throwing darts at pictures of Biden. Or Obama.

I don’t know why you think that Russians or whatever else would make an American unsafe. I mean what would they even care/have against you.

> Ironically I always expect an American to start shit with him when I'm out drinking with him so I sometimes deviate conversations away from him having to talk about being Russian at every bar we're at. He's only been in America a few years so as soon as he speaks the entire bar knows he's Russian.

Well talking about your country of origin is the most natural thing to do in those contexts.
Reason https://www.privacyguides.org/en/android/#f-droid
Currently at the top of the front page: https://news.ycombinator.com/item?id=41002195
> Efficiency goes against resilience.

Only when you are focusing on short-term effects. If you thinking long-term it is always better to not be out of business.
the app is utter rubbish. I have never seen anything worse in years, really.

First thing, you need an account (why? what for?). I have an Ikea symfony speaker and I basically can't use it. The whole process of discovery and connection is broken, had to go through several hacks. It could not connect to my very simple home network (no fancy authentication, 2.5GHz). Went to use the cable, it connects (hurray), but there is no way to play local files. Only cloud stuff. I had to give up.

These devices are everything music devices should NOT be. In the bin now.
this is really microsoft's fault for handing out kernel access to random 3rd parties, none of which are doing anything special that microsoft couldn't implement themselves (AV, anti-cheat, security)
There's NPR (new packet radio) on the 430 MHz band, never tried myself but it looks interesting. See for example https://hackaday.io/project/164092-npr-new-packet-radio. It can transport IP and goes up to 500 kbps.
That's the easy part? just do the domain controller first?
It's not an intrinsic property of IT, it's a property of how we've built it and allowed it to be built.
I wonder who exactly messed up the update, microsoft or crowdstrike.
Usually, there is pre-rollout update testing AND some companies use N-1 version staging for critical/production systems. For me it feels much more complex a failure than just "it's crowdstrike's fault". Everybody involved must have done something wrong.
The "fresh" section in supermarkets is indeed in quotes because often it is not fresh [0] and it is not real sourdough [1].

They certainly give the impression that it is though!

[0]: https://www.theguardian.com/business/article/2024/jun/11/fou...

[1]: https://www.sustainweb.org/news/dec23-lidl-sourdough-sourfau...
I assume that bananas that ripen naturally also taste better than those picked green, shipped halfway across the world and then ripened in ripening chambers? I tried various bananas in South America, but not a naturally ripened Cavendish, so I can't say for sure, but I know that this is the case for tomatoes.
Plus, CrowdStrike runs on Linux as well. _This time_ they only crashed Windows devices, but there's no guarantee that switching to Linux would prevent any of it.

You can switch away from CrowdStrike but I doubt you'll be able to convince whoever mandated CS to be installed to not install an alternative that carries exactly the same risks.
This feels like an auto-update functionality. For something that's running in kernel space (presumably, if it can BSOD you?) Which is fucking terrifying.
Ryanair is unable to check in passengers online. You can check in at the airport.
>> Consumers these days expect year-round availability of a product, which is consistent every time a person buys it, eats it, and cooks with it.

It's like a fairy tale witch cursed us all for our greed: you will have any food you like any time you like it, but it will taste bland and boring and you will long for a taste you have never known.

That's why people get so protective of their food culture, even their food habits (like meat-eaters getting up in arms when they hear from vegans). It's because if we leave food completely at the hands of big food, we'll all end up eating food that it is just nutritious enough to keep us from starving and just good enough to eat to keep us from all going mad.
The society didn't decide that we want this. The society didn't decide that we want something else.
All it needs is an "Under Construction" GIF.
> when the whole planet went down

If his business is the most critical thing for people's lives, sure. If it's anything else, his customers will have other things to worry about.
seems like he's also a relatively good amateur kernel driver developer - or at least his team is

and he's the former CTO of mcafee?
> As a rule of thumb there should be at least ten alternatives

I think you mean 14. https://xkcd.com/927/

> When the entire society and economy are being digitized AND that digitisation is controlled and passes through a handful of choke points its an invitation to major disaster.

Once again, it's Microsoft, directly, or indirectly, choosing a strategy of eventually getting all worldwide Windows desktops online, and connected via their systems.

Which is why I installed Fedora after Windows 7 and never looked back. 100% local, 100% offline if needed.

My company is looking to a non-Microsoft desktop. We're not affected by this, but it will certainly encourage us to move sooner rather than later.
I assume you mean "if the buyer will use the software in critical systems."

That's very realistic and already happens by requiring certain standards from the resulting product. For example, there are security standards and auditing requirements for medical systems, payment systems, cars, planes, etc.
Sure, but the USPS is not a government-owned corporation (like Amtrak), it was made an "independent agency" of the US executive branch back in July 1971, over half a century ago; under Nixon [0].

The head of the USPS (Postmaster General, currently Trump appointee Louis DeJoy) reports to the Board of Governors [1] (9 governors + PG + Deputy PG) who are nominated by the President; the PG can be removed by an absolute majority of the board. The USPS is overseen by the Office of Inspector General (USPS-OIG), current head Tammy Hull [2] and has a "hotline" (actually a web form) for reporting complaints [3] which fall under its focus areas, which includes fraud, computer crime and employee misconduct. Seems like one place to start.

For previous 2022 discussion of controversies involving Postmaster General DeJoy and what it would take to remove the PG, see [4].

The PG has no term limit but most recent PGs averaged ~5 years. Historically it wasn't seen as a partisan appointment and wasn't replaced when an incoming President changed to the other party.

[0]: https://en.wikipedia.org/wiki/United_States_Post_Office_Depa...

[1]: https://about.usps.com/who/leadership/board-governors/

[2]: https://www.uspsoig.gov/

[3]: https://www.uspsoig.gov/hotline

[4]: "Can Biden fire US Postmaster General Louis DeJoy?" https://www.federaltimes.com/federal-oversight/2022/08/24/ca...
Yes, Microsoft should just grant itself a monopoly on all those markets "for your own safety" and see what happens with their lawyers.
It is so incorrect, it is boderline idiotic urban legend. post-Soviet cities have hot water year around; same heating plants used for winter heating, are used for hot water in summer time, albeit at lower power. Also waste heat from power plants used for the same purpose.
For some areas of our critical systems we have three independent software groups program the same exact system on different infrastructure. Just for moments like these...
It’s a general political trend too: de-globalization. Everyone sold the idea of globalisation and off-premise ethereal globalized cloud services. Both good when they work, but a total disaster when they don’t.

Decentralization is the way.
Thanks! I have apps to do spam call and spam text message filterig. But the game has shifted w/ scammers. Its all GenAI now. So, had to adapt to the new scam world. Running on-device is the main value I add imo.
It honestly did not occur to me. In all seriousness, was stock exchange ever really hacked ( not just data exfiltration -- write access to everything )?
The Dildo of Consequences rarely comes lubed, it seems.
Guess we will never read the real facts. Truth is RMS was right. Again. Closed source security software is too often malware by design. We need open solutions we can truly trust.
AWS East going down will (and has) cause(d) disruption in other regions.
Last time it happened (maybe like 18 months ago), you ran into billing and quota issues, if my memory serves.

AWS is, as any company, centralized in a way or another.

Want to be sure you won't be impacted by AWS East going down, even if you run in another region? Well, better be prepared to run (or have a DRP) on another cloud provider then...

The cost of running your workload on two different CSP is quite high, especially if your teams have been convinced to use AWS-specific technologies. You need to first get your software stack provider agnostic and then manage the two platform in sync from a technical and contract perspective, which is not always easy...
Is that not called 'bluffing' with strategic planning?
Also iAlertU. It used the sudden motion sensor to make a loud noise like a car alarm. The fun part was that you could use the remote to turn it off and that kept up with the theme.

https://www.youtube.com/watch?v=h4XZpU1zzWs&pp=ygUHaWFsZXJ0d...
I literally dealt with this just a few hours ago. I need a new HVAC system. I wanted the high-end model, but it will only work with their fancy cloud-connected thermostat. You cannot replace it with an off-the-shelf thermostat.

Have home automation? Sorry, you'll have to use the Internet.

I vote with my dollars, so it cost them the higher-margin sale. I also went with the mid-tier system, and grabbed a Z-Wave compatible thermostat along with it. I wonder if I'll miss the nifty variable-speed system?

I really wish everyone would stop trying to trap us into their walled gardens. Apple at least lets people write software for theirs, but the hardware/appliance manufacturers (not to mention the automotive folks) are awful about this.
> Can you imagine having just one road connecting two big cities to cut costs?

Sure! But now imagine those roads private property.
Right. I thought the "big guys" know better and they have some processes to vet Crowdstrike updates. Maybe even if they don't get its source code, they at least have a separate server that manages the updates, like Microsoft's WSUS.

But no, they are okay with a black box that calls home and they give it kernel access to their machines. What?
"No-one ever got fired for choosing Microsoft".
It's a pro Ukraine anti Russia article
Are there publicly known exploits which allow RCE or data extraction on a default windows installation?
Doesn't matter to them. They just think we are either dumb or too poor to use an iPhone
LMAO

Yeah let's throw an LLM at the C++ kernel driver and auto-push to prod
If this comment tree: https://news.ycombinator.com/item?id=41003390 is correct, someone at Crowdstrike looked at their documented update staging process, slammed their beer down, and said: "Fuck it, let's test it in production", and just pushed it to everyone.
Just week or so ago, there was an issue with CS Release pegging a whole CPU.
Heh, can't wait for Google to release Angular 3.
> It is risk management 101, never put all your digital eggs in one (or even a few) baskets.

I mean, plenty of businesses only have penguin eggs in their basket, and some sort of penguin problem would cause major problems for them. I believe that last time this happened was with the leap second thing around 2005 or thereabouts.

"Don't put all your eggs in one basket" sounds nice, but it would mean a completely different independent service all through your stack. That's not really realistic, IMHO.

The bigger issue here is that: 1) some driver update "just" gets pushed (or how does this work?), and 2) the inability to easily do "this is broken, restore to last version". That is even something that could be automatic.
Yeah, tomatoes only taste of tomato in the heart of summer, and even then you better be in a place that produces them rather than one that imports them.

I'm guessing that's because tomatoes are fruit and fruit always tastes better when it's in season. For instance, I wonder if I've ever known the true taste of ripe mango. I have eaten plenty of mangoes, but I only ever eat them in the UK, where they're imported. I suspect that they taste very differently (as in much better) if you pick them from a tree in the right season. I bet South-East Asians in the UK must turn their noses up to the local mango supply, like I do with, well, most veg really.
> Consumers these days expect year-round availability of a product, which is consistent every time a person buys it, eats it, and cooks with it.

I am a consumer and do not expect year-round availability of fruit and vegetables.
I suspect the `assertNoBSOD()` test was marked as flakey
On my corporate Windows 11 22H2 "manage-bde -unlock C: -Password" does not unlock the disk with the user key. I guess it needs recovery key as well.
Chunghwa Telecom: Delayed Revocation with Controversial Extension
1. LSD hippie culture/aftermath
2. Pre-privatised/embryonic technology industry
3. A few geniuses

The question implies time travel, better to look to the future
This is, of course, why they should be doing phased rollouts. 1% of their customers, then 10%, then all the rest.
I suspect a lot of that 20% is things like pita and tortillas and similar where it just isn't relevant.
Digital Rummaging
> The details (the particular companies / systems etc) of this global incident don't really matter.

But they do matter. This is elementary. It's like saying "playing with matches doesn't matter". This is a problem that has happened before, albeit on smaller scale, and the solution/cure is well known and imho it should be established 2 decades ago to every org on the planet.

This is basic COBIT (or BYOFramework) stuff from 10-15-20 years ago.

How can you push a patch/update without testing it fist? I get it if you are a tiny company with 1 IT person an 20 local PCs. Stuff like that cripples you for a couple of days. But when you are an org, with 10k+ laptops, 500+ servers (half of them MS Win), how can you NOT test each and every update?

If you don't want to have the test/staging environments, then at least wait 1-3-5 days to see what the updates will do to others/the news.

Sorry not sorry guys and gals. I've been auditing systems and procedures for so many years, that this is a basic failure. "One cannot just push an update without testing it first" any update, no matter how small/innocent.
> LLMs do not provide reference information

Many do, although it's true that's often not the case.
You seem to have put an awful lot of eggs in the basket of that metaphor.
A very interesting article about a conflict I know allmost nothing about. With the intention to figure out, how to effectivly help people, under oppressed governmen, by helping the local community structures directly.

"I was making the trek into Myanmar to get a sense of how communities were organizing themselves in the vacuum created by the retreating Tatmadaw"

"The restrictions placed by Western governments on engaging with pariah regimes limit the ability to negotiate access to communities and peoples in desperate need of assistance."

"or however dramatic and intense the conditions ordinary people confront in such contexts, their community structures continue to function. It is on such local governance structures that any international effort in contested political settings should be built."

"What I discovered in the course of the five-week trip was a country in the midst of a profound transformation. The struggle against the Tatmadaw has morphed from a fight by ethnic groups to control territory into the emergence of a new form of participatory governance. This governance model has been created organically by a new generation of activists"

But meeting the goal here concretely is not so easy, as traditionally international help goes to strictly civilian organisations only, to not participate in the war. But here there is no seperation.

"I mentioned to Arkar Min Tun, one of the founding members of the group, that in order to receive international support it could be in the organization’s interest to clearly separate the military and civil components of KA-Zero’s activities, he told me it was not possible for as long as the fighting continued. The country was in the midst of an all-encompassing revolution; any separation of activities would be artificial and would undermine the legitimacy of the movement in the eyes of the population"

All in all, the rebels sound quite nice:

“When you give a soldier a gun to fight, you need to tell him that he needs to know that he will have to give it back.”

But there are also dark sides, for sure:

"Sometimes this creates challenges. Marwi explained to me that many of his backers exhort him not to take prisoners."
As others have already stated, yes, that is how we should be interpreting comments, in good faith and in the most charitable way as the site guidelines suggests us to.
I'm not surprised, seeing how this madness has even infected OSS/Linux.

https://github.com/canonical/microk8s/issues/1022

A k8s variety. By Canonical. Screams production, no one is using this for their gaming PC. Comes with.. auto-updates enabled through snap.

Yup, that once broke prod at a company I worked at.

Should our DevOps guy have prevented this? I guess so, though I don't blame him. It was a tiny company and he did a good job given his salary, much better than similar companies here. The blame goes to Canonical - if you make this the default it better come with a giant, unskippable warning sign during setup and on boot.
MacOS does not allow kernel extensions anymore luckily
The Moldavian Soviet Socialist Republic was a constituent republic of the USSR from 1945 until 1990.
I don't understand what this means. As in white people aren't allowed to live there? What's the problem with buying these houses?
Are you rolling out CS updates as is everywhere? Are you not testing any published updates immediately at least with some N-1 staging involved?
> Only 80%?

Chorley wood bread makes *terrific* toast. This explains its popularity in Blighty.

> I'm in the UK now and it seems all but impossible to buy bread not made this way.

Utter rubbish! 30 years ago maybe, but these days even small corner shops (let alone large supermarkets) will offer quality fresh breads from a local bakery.
How come AWS sometimes has even better tooling for .NET than Azure, while JetBrains offers better IDE on Linux, macOS and, depending on your taste, Windows than Microsoft? Or, for some reason, the most popular deployment target is just a container that is vendor-agnostic? Surely I must be missing something you don't.
From windows tos:

Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows.
This is politicizing science, that is unfortunately a fashion trend currently, and a big problem in itself.

"Science is good if it coincides with my ideology or is only focused in cherry-picking facts that I like" is a very dangerous path.
Low interest rates increase house prices.
Russia. Here is a post lining up his reporting and his sexpat account in Vorkuta, Vorgashor, Kotlas.

https://www.reddit.com/r/BaldAndBaldrDossier/comments/16euvy...
So what? Crowdstrike is a kernel AV. How else would you solve this?
Contrary to that viewpoint I think there is much to be said for separating peaceful non military companies from military ones. Some reasons:

Google FB etc are inherently global. Military is inherently regional.

Mixing military and civilian tends to cause messes. See Boeing doing military stuff and now their planes and ISS shuttles don't work. Also so Cheney transferring the military biodefense budget to Fauci and the NIH and now we have lab leaks and covid.
MacOS does not allow kernel extensions anymore so these kinds of crashes cannot happen. The falcon client on Mac hooks into another layer
Baffling name. Sounds more apt for a DDoS service.
Nightmarish with a tablet.
<< There is no 'AI', that is always only hype. There is machine learning, which is a very powerful technology

I agree with you on the technical aspect, but the distinction makes regular people eyes glaze over within 5 seconds of that explanation. AI as a label for this is here to stay the same way cyber stopped meaning text sex of IRC. The people have spoken.

<< MSFT is highly overvalued.

Yes, but so is NVDA, the entire stock exchange and US real estate market. We are obviously due for a major correction and have been for a while. As in, I actually moved stuff around in my 401k to soften the blow in that event 2 years ago now. edit: yes, I am a little miffed I missed out on that ride.

So far, everything was done to prevent hard crash and in the election year, that is unlikely to change. Now after the election, that is another story altogether.

<< I doubt MSFT will be leading that revolution.

I think I agree. I remain mildly hopeful that the open model approach is the way.
There’s a reason that I admire the federal system of the US:

For all the US’s problems, devolving critical functions to layers of differing granularity has proven surprisingly robust to many faults.

I suspect we’ll see economic equivalents, where critical functions are spread around at various scales. We dont need to be either totally globalized or totally domestic.
So, anti-malware software turns out to be malware? How odd. SecOps out on anti-open source training, I presume?
Why would you use Crowdstrike on Ubuntu? Is because of a real security concern, or abiding to regulations (thou shalt have an antivirus) or else?
do you think they will now also employ passkeys as a form of digital tokens or do you think that they will rather use other methods?
I made a separate (longer) comment about this..

Why don't orgs test their updates? Every decent IT management/governance under the sun demands that you test your updates. How the hell did so many orgs that are ISO 2700x, COBIT, PCI-DSS, NIST CSF, etc. certified failed so hard??

(ToS/contracts will probably get you out of any damages.)
Wait, I thought in this case we are the customer!? Okay what kind of contracts are we talking about? :D
Because it's evidently a bad idea and there are reasonable alternatives.
what does archive.ph have to do with that? Isn't it just a way to get around paywall?
This should clue you in.

CS is not sold to SA or technical types. It's sold to management as a risk reduction.

The whole point is that if you are technical, you are so untrusted that management is willing to require circumvention of known good practices and force installation of this software against technical advice.