skysight-inc/HackerNews huggingface dataset:
> I am still unsure how I can tell it pointed to twitter originally.

You can usually find a comment by dang saying something like "we've changed the URL from <old link>".
One issue that hasn't received enough attention comes from a comment on Dave Plummer's video on the CrowdStrike outage. Dave Plummer is a former Windows engineer and runs a YouTube channel call Dave's Garage.

@zug-zug wrote:

> While this is technically what crashed machines it isn't the worst part.

> CS Falcon has a way to control the staging of updates across your environment. businesses who don't want to go out of business have a N-1 or greater staging policy and only test systems get the latest updates immediately. My work for example has a test group at N staging, a small group of noncritical systems at N-1, and the rest of our computers at N-2.

> This broken update IGNORED our staging policies and went to ALL machine at the same time. CS informed us after our business was brought down that this is by design and some updates bypass policies.

> So in the end, CS caused untold millions of dollars in damages not just because they pushed a bad update, but because they pushed an update that ignored their customers' staging policies which would have prevented this type of widespread damage. Unbelievable.

Link to video:

https://www.youtube.com/watch?v=wAzEJxOo1ts
I believe PG will abort the transaction on an exception (PK violation) and the subsequent update will not run in the same context that had original violation. So it could result in a data race. I don't know what isolation level would fix that, if any.

My understanding is that in general, if you hit an exception in postgres at all then you can't trust the isolation of the current transaction anymore.

That's what MERGE and speculative insertion (on conflict do update) addresses.
Speaking with HR, most of the CEOs just copy the bigger companies
>hire somebody rather senior to be a "CTO"

The right person fulfilling that kind of role can make all the difference.

When there were no comments I wrote a little message which instinctively favors focused CTO effort myself:

At the one extreme you write all new code.

At the other you have a turnkey system using code that is already written, perhaps a system brought together by combining various task-specific apps.

Or anything in between.

You still may never be able to hammer everything to perfection.

Either way as much code as possible should be built against a completely non-moving target, with a core that ideally meets a stable unchanging foundational requirement, the objective here is to have a digital enhancement/replacement of a highly-performant optimized manual workflow, whatever can go forward with no further updates or maintenance. Quite simply this makes for the best long-term investment if the code just plain lasts longer after it's paid for.

The moving-target stuff or component (which might include government regulations) might be better off "leased" since it might never be a very good investment anyway, especially not long-term.

Either way a CTO or equivalent should be the ultimate expert on how this gets done in your specific company, having more than just domain expertise, but specific-company expertise on top of that. The deeper and longer-term familiarity the better, must be an absolute master of the detailed workflow before any type of irreversible commitment should be made. The level of trust needs to be up to the highest integrity of executives, there can not be a doubt that decisions are in the best interest of the company.

You may already be a true master of the workflow and with enough mastery be more suitable for directing a team that could craft the most ideal solution, as long as you actually know how to program computers. You wouldn't really need to be up-to-date on any specific languages that are popular now.

Someone needs to fill or acknowledge a CTO role, pick up the ball single-handedly and don't make another move without making sure where the correct goalpost is. A little lonely indecision when you first pick up the ball is worth it if a CTO can then lead a team most directly to the desired end zone. Building a team from the ground up if necessary. It may not be completely necessary, but when that's not off the table, it's a whole new ball game anyway. More options, but probably gives rise to additional levels of uncertainty that need to be resolved.
3TOFU: Supply Chain Security Harm Reduction
They seem to be teasing a narrative that has yet to be released:

> “Should Delta pursue this path, Delta will have to explain to the public, its shareholders, and ultimately a jury why CrowdStrike took responsibility for its actions—swiftly, transparently, and constructively—while Delta did not,” wrote Michael Carlinsky, an attorney at law firm Quinn Emanuel Urquhart & Sullivan.

or maybe it's just how Delta didn't take their offer for help

> The cybersecurity company reiterated its apology to Delta for the initial disruption and said it had offered on-site assistance to Delta but was told it wasn’t needed. It said Bastian didn’t respond to outreach from CrowdStrike’s CEO.
Bad idea, then all the fake IP addresses on Law&order and co would suddenly be valid.
> fully paid by my employer

A privilege not everyone enjoys
It seems to always step from that CEO, or chief, or VP that works 7 days a week in some capacity. Maybe its an hour or two on the weekends to send some email about an idea they had or something they want to see but its enough that those below them feel they have to respond to that higher up so they work another 2-4 hours to account for him working those 1-2. Then it comes down to managers and tech leads who have to work half or the entire day sometimes to make up for that one chief thinking their 1 hour of work was enough to raise a question that will solve an issue.
By allocating fewer resources in that area, and not building the system around a Ponzi scheme. Basically, going back to the way things used to work pre-Ponzi.
> Crowdstrike is not handling critical infrastructure.

lol.
> The other person understood me just fine, and also noticed how obvious my statement was, and how you avoided it.

Of a sample size of two that's a 50% failure rate.

You stated an us vs them, i pointed out that drawing an us vs them assumes that us and them are different.

That you apparently meant something different is odd to me, but you do you.

> Oh it absolutely does. The other person understood it perfectly.

Again, 50% failure rate.

If you wish to conclude that a 50% failure rate makes something obvious in favour of one side, feel free.
The Microsoft part of this I find interesting, I mean I guess it would be standard legal practice to also go after them even if it is thrown out. But that one is weird.

Maybe Microsoft encouraged Delta to use Crowdstrike, then ok I could see the case.

But if it is anything related to how Windows works, that seems like a stretch. Yes Windows could be better, but I don't like the idea that the OS provider could be sued for a piece of software causing problems. That seems... dangerous.

Regarding Delta. This seems like an interesting situation. Apparently Crowdstrike offered people to help, but how many people and where. Realistically how much help would they have been able to help given that it isn't like this was isolated to Delta and I imagine their people were stretched pretty thin. And importantly what exactly was the help provided. I don't see any information about this.

While I am sure that Delta's IT department was understaffed, this was also a unique situation. If you spent the time to make a well optimized machine for rolling out updates, things were automated, and you expected things to go wrong but I would have never anticipated every Windows machine being unable to boot. That is an extra-ordinary situation. I doubt any IT department is really staffed to be able to handle that situation happening. You don't expect to need to deal with every machine you have, its honestly kinda unrealistic.

It will be interesting to watch this one play out in the courts. Because at the end of the day the vast majority of the blame for this entire situation is on Crowdstrike. The companies were handed a situation that we were not prepared for.
I think it's ultimately about bypassing a TOTP 2FA by exploiting a race condition in the authentication failure backoff timer to submit thousands of possible codes simultaneously. The technique is about abusing the TCP stack and IP fragmentation to load up the stack on the server with as much data as possible before hitting it with a "go" packet that completes the fragments on the head of line blocking data buffer and spills all of the contents into the webserver before a single RTT can be completed.
Usually, these headlines seem outrageous because they are taken out of context, but in this case there appears to be no additional context that can help make sense of this debacle. According to Korean media, chaebol subsidiaries (Samsung/SK/Lotte/etc) are demanding "crunch mode" from their executives. Nobody knows why they are doing this, and what they are trying to achieve with only executives present. News articles say the executives are holding meetings or studying current events.
Profits are projected to tank heavily so I think they are showing up just for the sake of it. I thought Korea was way past this BS. Apparently not.
But in a power loss the WAL is also read to restore and transactions that were in flight, right?
"Money can't buy you love but it lets you rent it by the hour" – Max Headroom (from memory)
As a fellow gardener, this probably has to do with the type of tomato/carrot that you grow. For example, the carrots in your garden are probably of the sweeter variety than store-bought carrots.
> privilege not everyone enjoys

55% of Americans [1], and, I’d guess, a commanding majority of likely voters.

[1] https://www.census.gov/library/publications/2020/demo/p60-27...
I was expecting a lot worse that what the article describes.

Legal donations of tickets worth 30k spread across 66 politicians.

>My hope is that it’s always been like this and we are simply more aware now / the public is fighting back.

I think this is better than it has ever been. Again, these are reported legal donations below a threshold set by law.

Meanwhile, in other places you have politicians literally sell positions to to others and their office when they vacate.
If our civilization survives, we will, one day, through one manner or another, banish death. If that day comes, when it comes, I hope Jake's name is remembered for the monument to all who we lost, all of us who've had to grow and live and find meaning under the specter.
> Felt like I needed a shower once I was finished setting it up with the minimal apps that I use

And this is a lot of why I've been gradually drifting over the years to getting nearly all my apps from F-Droid.
The speed of evolution is faster than you think. The reason for that is that mammals rely on sexual selection instead of random mutations. This means that the prevalence of a gene within a population can rapidly change from say 1% of the population to 60% of the population within a few generations.
> Same South Korea that suffers from one of the lowest fertility/birth rates in the world?

I feel like the endgame of our "line goes up for the wealthy" system is - people abandoning making other humans.

The amount of pressure on 20s/30s people is immense. A 9-month pregnancy, maternity, and parenthood has become so risky from a job/earnings perspective for an individual. There is zero stability. Even hunter/gatherer societies created stability for their pregnant women and children.
Computable numbers, with an application to the Druckproblem – ScienceDirect
Public Work: a search engine for public domain images
Author of Europe's AI Act realizes it may have issues
No.

C already existed prior to the ANSI standardization process, so there was nothing "to be developed", though a few changes were made to the language, in particular function prototypes.

C was being used in this fashion, and the ANSI standards committee made it clear that it wanted the standard to maintain that use-case.
There is no requirement for 'state actors' to agitate the far right in the UK - the country's private sector media is dominated by outlets well known for their race baiting. Any sampling of front pages of the Daily Mail, Daily Telegraph, The Times, The Sun, Express etc will provide all the evidence you need. Blaming Putin is weak sauce.
After reading half of this long, dramatic screed, I realised I had not been told a single new fact. I’ll skip the second half.
It’s not the login that’s the problem. On two accounts, I could login to Fidelity just fine. Displaying balances and positions threw an error, however.
"On The Tastes of Women in the Hamburger Kingdom: Doc as the Personification of Female Desire"
> Then, there’s a random byte like 0x25 or 0x07 followed by the column data – the rest of the columns are string types so they’re all stored in UTF-8. If you know what these inter-column bytes mean, leave a comment below! I can’t figure it out.

Next paragraph mentions TOAST and this byte is related to that. The low order bits (on little endian platforms) determine whether the value is stored inline (00, first 4 bytes are total length), is stored in TOAST table (11) or is shorter than 127 bytes (01 for even length, 10 for odd length, the total length is first byte >> 1). So for 0x25 you get 01, so length is 0x25 >> 1 = 18, which is that byte followed by "Equatorial Guinea".

Edit: the reason why endianness matters is that the same representation is also used in memory and the whole first word is interpreted as one length value. The toast tag bits have to be in first byte, which is most easily done as two highest order bits of that word on big endian. That means that it is placed in the two highest bits of the byte.
It's funny, people make the same argument in favor of 4-day workweeks. So, according to this argument, bot 4-day and 6-day workweeks will lead to more employment! Anything but 5 days, it seems.
> I know people that take buses to "do city things", and it takes them > 1 hour to get anywhere. I know others that walk (20+ minutes) or drive (20+ minutes to get a mile away, or to get a few city blocks due to traffic).

I grew up in a rural area, 3 miles from the grocery store & post office, a 40 minute drive to the "big" town (20k). My parents end up driving to the "big" town a couple times a week. I always thought this was nuts and looked forward to living in a city where that wasn't necessary.

Now I live on the SF peninsula... and everybody regularly drives 40+ minutes to do things. Just to get dinner, go to Ikea, or take the dog for a walk in a nicer park. It's a 10 minute drive to BART or to Caltrain, too. Unless you truly dedicate yourself to hardcore SF living, your average middle-class Bay Area resident is driving just as much as my rural parents did.
...because all CrowdStrike had to do was say "oops, we f*%&/$d up the last update, here's a fixed one", while Delta's IT had to locate all BSODing devices and somehow recover them?
The camera angles and editing on this video is so satisfying. Great work.
You do you. Dozens of people do prefer text-based over the context-switching involved in reaching for pointer interface and clicking that button.
It's kind of the same principle as "on call", if you want someone to be consistently available for periodic, unpredictable events, you have to have them available all the time.
The title seems to be in-character though.
It sounds a lot like CrowdStrike is saying "Delta should have known better than to rely on our software for critical functions."

Which may be a fair statement, but I think it's also fair to litigate whether or not this post-incident statement is consistent with how CrowdStrike sold their software to Delta.
How far into the future do you think population growth can be reasonably predicted, and why?
They can’t do anything about a 3rd party software that runs in kernel space
Not to state the obvious: The engineering is just a way to get the feelings out.
> exactly how C is to be translated into assembly isn't well-specified.

Exactly! It's not well-specified so the implementation is not prevented from doing a straightforward mapping to the machine by some part of the spec that doesn't map well to the actual machine.
I feel like this is a response to chinas rise.

The west has a lot of inefficiencies that were never really tested before. Think ceos paying themselves huge amounts for short term thinking (Boeing), a lot of people living off generational wealth and not needing to contribute meaningfully, many examples of rent seeking, governments subsidising big businesses in response to political donations, etc.

Not that china doesn't have problems but it’s clear there’s now a competitor. The temptation here is to work the few who actually contribute even harder. Bump the working days, push retirement age up until it’s non-existent but whatever you do don’t touch the elite.
Thanks!

> Death by old age is mostly a problem of the multicellular living beings (where only a small fraction of their cells are converted into the cells of new young descendants), so it is not something that affects the majority of bacteria.

Yes, and I know that there are multicellular organisms where senescence is pretty much a non-issue (hydra).

Senescence is two processes running in parallel: one is "bad luck" crippling the capabilities of a system. For example, a gene loses functionality after an error during replication. In general, it can happen that a subsystem strands in a part of its state space that it can not exit from, and this could happen even to single-cell organisms. The second process is a response to the first, and it is a set of evolved mechanisms that increases the fitness and/or average life-expectancy of an organism by preemptively shutting down the most fragile subsystems, the ones which are likely to fail early anyway.

Now, these are evolved systems, not designed. They work in an all-is-good-as-long-as-the-species-survives basis. And so comes the heretic question: what happens if the system is engineered? Can we develop and possess algorithms and workflows to design organisms with longer lifespans? Doing so for M. Genitalium is not going to do anything for humans, but once that ball is rolling, we may want to keep pushing the envelope and aiming for bigger and bigger model organisms, until we get to Canis familiaris. Then we pretty-promise to stop.
Look, appalled is a pretty strong reaction to an ad about an AI chatbot that it's hard to take seriously. That footballer who made a speech about how women need to embrace their natural roles as wives and homemakers is appalling, this is at worst "eh, it didn't land for me."

Hey look this kid used a writing assistant to write something— literally dystopian. Grammarly could have made the exact same ad. It seems that there's a group of people who are frothing at the mouth towards anything with the words AI on it and this article is one of them.
The 'Show HN' category is a bit stricter: It's for something users can test immediately. Posting it without 'Show HN' is fine though. https://news.ycombinator.com/showhn.html
Afaik the x25519 recipient uses chacha20poly1305 which is authenticated
> Why can't I personally test the security of my bank?

For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's not in the contract between you and the bank, and the general law doesn't allow for it ("I was not trying to burgle that house, Your Honour, I was testing its security" — "That's a nice joke, mister, so I won't you hold in contempt of the court. Still, guilty, five years").

> Why can't I ask an organization I trust to test the security of my bank?

For the same reason the bank can't ask an organization it trusts to test how well you store your PIN and secret phrase, I imagine: it's not in the contract.

And good luck trying to find a bank that would agree to let you inspect their security.
In terms of what's best for the customers and the business, of course I understand your call.

In terms of self-preservation and your quality of life, I'm surprised you got that call and proceeded to take no action on his priority for an hour.
I really dislike this line of thinking because it assumes that Microsoft is responsible for anything you run on your Windows machine.

I should be able to do whatever I want with a computer I buy, but that doesn't mean Microsoft should hold any liability for it. What am I missing here?
I did.

Twice.

Please kindly go white knight somewhere else. Your additional agitation is unnecessary, and is not helpful for anyone.
This is just their response to a legal challenge. If we're asking rhetorical questions, then "why wouldn't CrowdStrike's lawyers try to defer responsibility and not pay millions of dollars?". Otherwise it's reading a bit too much into it and the courts will sort it out.

> CrowdStrike said Sunday that its liability is contractually capped at an amount in the “single-digit millions.”

That's probably a key question too^
> Hour later he called back to find out what we had done, the answer was "nothing". Again I had to explain:
"I have 4 P1s, 5 P2s and I don't know how many other tickets."

This reads as a lesson in miscommunication more than mismanagement. On his first call, he should have explicitly asked for an ETA. (Even if the assumption was you would immediately start working on his ticket.) On the first call, after his ticket was escalated, he should have been provided with the new context.

The solution, ironically, might be inserting a manager between you and him who can better handle communication.
The difference is that we generally do not recognize a right to coerce someone else into meeting our needs, but we do generally recognize a right to meet our own needs.

This is why articles like this rarely come out and say "I need the introverts to come back to social events to meet my needs", they always try to frame it as about productivity or (as very condescendingly demonstrated here) about the mental health of the introverts themselves.

I think the balance we need to get to has to be one where extroverts are meeting each other's needs by working in teams that choose to be in person and hanging out with each other socially rather than moping online about how everything is so much less fun. You don't need to drag us along for the ride to have a good time.
And in turn, Microsoft blames the EU for forcing them to allow an external vendor having kernel level access https://www.euronews.com/next/2024/07/22/microsoft-says-eu-t.... Lot of finger-pointing going around here.
I’m not saying it makes it right, but retail is probably better off sitting tight for now. If anything, pros and institutions already had those sell orders ready to fire last night and would get in ahead of retail on market open, at least that’s my guess. So I don’t know what good it would have done me to be at the end of the line to sell my retail stuff.

OTOH, if you desire to go shopping for bargains, yeah, not being able to trade sucks.
This technique is briefly discussed in chapter 5.3.1 in the master thesis "Exploiting Race Conditions in Web Applications with HTTP/2" - https://ntnuopen.ntnu.no/ntnu-xmlui/handle/11250/2781157

The same paper is also referenced to by James Kettle in his research.
You're missing their point.

It's not that it cannot be done. It's that even if you do it perfectly (whatever that means), you cannot expect people to trust it.

People trust papers in envelopes in transparent boxes in classrooms all around the country because it's intrinsically trustable, decentralised, easy to understand, extremely hard to manipulate at a global scale, etc.

People do not trust an electronic system. You can explain to them that it's safe until you're red in the face, it's not the point.

Democracy works if people have sufficient trust in it.