Hacker Newsnew | past | comments | ask | show | jobs | submit | theteapot's commentslogin

xz-utils has a ton of build dependencies. The backdoor implant exploited a flaw in an m4 macro build dep.

It's an extension of a peace through strength philosophy. If you lose your critical sovereign capabilities you become weak and vulnerable. You no longer get to decide who you do and don't "never go to war with".

Yes I understand the reasoning, it's just obviously wrong. This doesn't happen and hasn't happened in hundreds of years. This is not why people get invaded, otherwise Switzerland would have been invaded many times over the last century

That's exactly why Switzerland didn't got invaded in the last century. Every side depended on them for money supply, so they couldn't risk bringing the war to Switzerland. Also it had a track record of staying neutral, so they didn't feared it may pick a side, because it largely made money from selling stuff from both sides.

The environment? As in trees?


AFAICT "The AI" (which is never actually described in the article) is a CSOP solver.


They should stop optimizing their Company Share Option Plans and get back to work!

(It was a gradient descent optimizer, so probably unconstrained optimization rather than a Constraint Satisfaction Optimization Problem, but it might have had constraints.)


They should've just Linux.


Says this in the article:

> A programming flaw in its cloud services also allowed China-backed hackers to steal email from federal officials. On Friday, Microsoft said it would stop using China-based engineers to support Defense Department cloud-computing programs after a report by investigative outlet ProPublica revealed the practice, prompting Defense Secretary Pete Hegseth to order a review of Pentagon cloud deals.


Absolutely insane. Especially in light of their layoffs. Should be criminal. According to another comment in the thread, it is?


Microsoft only has a market cap if 3.7 trillion. They can't afford to hire domestically.

Anyway, from what I can tell being in this industry, a lot of things need to be explicitly illegal to stop companies from doing it.

Edit: The penalities also have to be meaningful. There's a lot of "technically not legal, but sue us lol" going on.

"Hey, this is a really really stupid idea." Isn't going to stop a middle manager from trying to come in under budget.

At most MS will pay a nominal fine, and proceed to learn nothing.


> "Hey, this is a really really stupid idea." Isn't going to stop a middle manager from trying to come in under budget.

Neither is "you can go to jail" when it comes to export controls training


Maybe instead of fines, large companies should be forbidden to do any new contracts for some months. That would be a larger incentive and also comprehensible to sales people.


In which magical country do you suspect this would be enforced ?

Microsoft also has a captive market here. Realistically you aren't going to migrate millions of employees and servers to another tech stack, even over something egregiously bad.

Something like storing cleared data really should be handled 100% internally with an open source stack that's regularly audited.

But that sounds really difficult, even if it would be cheaper or the same price in the long run.


One can dream.

I didn't suggested preventing the fulfillment of existing contracts. Nobody would change for all costumers. They just wouldn't get any new contractors.

Sanctions already exist.


Ok.

So after the current contract do you switch stacks, or just have a 3rd partner Microsoft shop maintain your existing stack?

Regardless, I don't think our current legal system has any real ability to hold a company like Microsoft accountable.


If you happen to be unlucky and Microsoft just got convicted, you either need to wait some months or go to a competitor. The state shouldn't care about that, when your mechanic just went to prison, what you're gonna do?

But yeah I don't know any party who has such ideas.


Excuse me??


What's wrong with `kubectl apply -f xxx.yaml`?


We use kustomize because we have four environments that run basically the same stuff (dev with k3s, test, and two cloud regions). If we didn’t use kustomize, we’d be forced to reinvent it to avoid duplicating so much yaml.


> .. they rarely seem to have even a basic grasp of computer science. I've had to personally mentor many (academic route) engineers over the years on what I would consider absolute basics.

This is kind of fascinating. Please give some examples.


"inflationary collapse" seems contradictory. I think hyperinflation is a more correct term.


Isn't that most software devs?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: