News for hackers. Stuff that matters.
Re:QBittorrent breaks out of sandbox to commit crimes by mraniki on Sunday September 06, 2026 @09:02AM (#49586173)
I'll copy the whole announcement here for those who don't want to click:

> I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this happened, which will involve consuming these media files until the answers become apparent. Thank you for your cooperation during this trying time.

Re:QBittorrent breaks out of sandbox to commit crimes by weberer on Sunday September 06, 2026 @11:35AM (#49587531)
Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.
Re:QBittorrent breaks out of sandbox to commit crimes by sillysaurusx on Sunday September 06, 2026 @11:43AM (#49587624)
I had a nice mobile experience. It asks you to log in or create an account, but it’s along the bottom, and you can read all the content fine.
Re:QBittorrent breaks out of sandbox to commit crimes by magnat on Sunday September 06, 2026 @11:58AM (#49587779)
Especially when the page source actually contains all the content (so no need to fetch it in JS), part of which is even presented in title.
Re:QBittorrent breaks out of sandbox to commit crimes by masfuerte on Sunday September 06, 2026 @12:07PM (#49587876)
It has the content three times (not including the title). Once in json (as escaped html) and twice in meta tags (as plain text). They used to have it in plain html too but that got hidden then removed.

You see read the unescaped html here:

https://beige.party/users/intransitivelie/statuses/117057396...

No stinking js or app required!

Re:QBittorrent breaks out of sandbox to commit crimes by smallerize on Sunday September 06, 2026 @12:00PM (#49587810)
Re:QBittorrent breaks out of sandbox to commit crimes by 0points on Sunday September 06, 2026 @11:53AM (#49587726)
FWIF, way back when, Twitter was the "Twitter for tech nerds".

Lots of water under the fridge since...

Re:QBittorrent breaks out of sandbox to commit crimes by reactordev on Sunday September 06, 2026 @12:14PM (#49587948)
[delayed]
Re:QBittorrent breaks out of sandbox to commit crimes by taylor-tg on Sunday September 06, 2026 @12:44PM (#49588287)
Just have to remember that it's X, not Y, that marks the spot.
Re:QBittorrent breaks out of sandbox to commit crimes by weberer on Sunday September 06, 2026 @12:28PM (#49588088)
That's not how I remember it. Ever since the beginning circa 2008, it was the one site that was being pushed hard by the mainstream media, celebrities, and marketers. None of it was organic. All the tech nerds were on sites like Digg, old Reddit, or Slashdot.
Re:QBittorrent breaks out of sandbox to commit crimes by hnlmorg on Sunday September 06, 2026 @01:19PM (#49588663)
Early Twitter was used loads by tech nerds as a notifications API.

There definitely was a community of experimentation back in early days.

Re:QBittorrent breaks out of sandbox to commit crimes by 0points on Sunday September 06, 2026 @02:37PM (#49589474)
How you remembered it is anecdotal, it's not relevant for the discussion unless you add something of value.

Way back when is not when it broke mainstream. It's when the service started getting attention.

It was literally pitched as a "micro blog site" for techies to communicate news, and the "app" was 160 character SMS messages.

Nerds used it as a free (as in beer) way of sending alert SMS on server errors. (At least I did).

In 2008, twitter had already started to become mainstream, quickly shifting focus away from nerd interests.

Re:QBittorrent breaks out of sandbox to commit crimes by kapitanjakc on Sunday September 06, 2026 @03:18PM (#49589823)
What is the meaning of FWIF ?

Google says "For what it's worth", won't that be FWIW ?

Re:QBittorrent breaks out of sandbox to commit crimes by 0points on Friday September 11, 2026 @03:29PM (#49664030)
Typo. I meant FWIW
Re:QBittorrent breaks out of sandbox to commit crimes by fragmede on Sunday September 06, 2026 @11:51AM (#49587706)
"Certifiably insane" to enable JavaScript, which was invented in 1995, or install an app, which first happened on the Palm series of smartphones in 1996. Either of those are "certifiably insane"?

For reference, the term neurodiversity was coined circa 1998.

Re:QBittorrent breaks out of sandbox to commit crimes by serf on Sunday September 06, 2026 @12:04PM (#49587851)
Neither the invention date or the mental health terminology have anything to do with the fact that js being commonplace is a privacy and security nightmare -- which was actually the point.
Re:QBittorrent breaks out of sandbox to commit crimes by micromacrofoot on Sunday September 06, 2026 @12:30PM (#49588118)
JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way... and "privacy and security nightmare" can be used to describe most of the internet at this point with or without it
Re:QBittorrent breaks out of sandbox to commit crimes by swiftcoder on Sunday September 06, 2026 @12:35PM (#49588186)
> JavaScript asceticism is a weird trend that has just never died out, no one treats any other language this way

I'm not aware of any other language that is layered on top of a perfectly serviceable user-facing content delivery syntax?

Re:QBittorrent breaks out of sandbox to commit crimes by alt227 on Sunday September 06, 2026 @02:18PM (#49589273)
Literally any scripting language?

I have managed to get 35 years into a sysadmin career without knowing or writing a single line of python. I see a python script, I run a million miles away and wont touch it with a barge pole.

Re:QBittorrent breaks out of sandbox to commit crimes by tomrod on Sunday September 06, 2026 @12:33PM (#49588161)
It can certainly come across as a "weird trend" but I've found that the most insistent for disabling JS are the folks who have deep knowledge of browsers and the security plane running webapps. YMMV.
Re:QBittorrent breaks out of sandbox to commit crimes by micromacrofoot on Sunday September 06, 2026 @12:37PM (#49588206)
I don't drive a car because I have deep knowledge of mortality statistics, but I don't complain when I can't easily get somewhere 100 miles away
Re:QBittorrent breaks out of sandbox to commit crimes by Dylan16807 on Sunday September 06, 2026 @12:49PM (#49588330)
Showing a paragraph of text with some social links around it is like going down the block. If that requires a car you do have a problem.
Re:QBittorrent breaks out of sandbox to commit crimes by micromacrofoot on Sunday September 06, 2026 @01:01PM (#49588481)
yeah but it's an extreme fringe choice... I too make extreme fringe choices but I don't expect 99.9% of the people who don't make my extreme fringe choice to change on my behalf

hell, use a browser in a sandbox if you're that paranoid

there are a number of ways to do this securely, at this point it's practically a child's tantrum

but sure maybe it just needs a couple more decades of complaining in obscure comment sections and everyone will finally get it and switch back to mailing lists

Re:QBittorrent breaks out of sandbox to commit crimes by rezonant on Sunday September 06, 2026 @01:30PM (#49588789)
ooh, don't forget irc
Re:QBittorrent breaks out of sandbox to commit crimes by kevin_thibedeau on Sunday September 06, 2026 @01:45PM (#49588940)
JS is a vector for browser exploits and privacy invasion. No other language is commonly used for these things.
Re:QBittorrent breaks out of sandbox to commit crimes by alt227 on Sunday September 06, 2026 @02:21PM (#49589300)
Not even things like batch files and visual basic scripts on windows? Everyone seems to forget we had decades of dodgy scripts and activex controls in our browsers for years before javascript became the thing it is today.
Re:QBittorrent breaks out of sandbox to commit crimes by kevin_thibedeau on Sunday September 06, 2026 @04:30PM (#49590581)
They were never widely disseminated over a network. Office VBA exploits only lasted as a widespread threat until MS locked down macros by default. JS has been around much longer than that.
Re:QBittorrent breaks out of sandbox to commit crimes by Dusseldorf on Sunday September 06, 2026 @05:07PM (#49590963)
I can't recall ever needing to run a batch script to read a paragraph on a website, so doesn't seem like a very apt comparison. Are you claiming there's some group of people who have JavaScript disabled but would be happily running Activex if it were still around? Seems reasonable for some people to dislike and disable JavaScript in 2026, even though another, separate group of people had ActiveX enabled in 2009.
Re:QBittorrent breaks out of sandbox to commit crimes by micromacrofoot on Sunday September 06, 2026 @02:49PM (#49589577)
pngs in emails are used for this

http headers and CSS is used for this

flash drives left on the ground outside are used for this

Re:QBittorrent breaks out of sandbox to commit crimes by account42 on Monday September 07, 2026 @08:09AM (#49597378)
That's because no other language is pushed in a place where people are requesting documents.
Re:QBittorrent breaks out of sandbox to commit crimes by mdp2021 on Sunday September 06, 2026 @01:39PM (#49588877)
JS or installing special software to view HTTP served text from the web?! Yes, that makes no sense at all.
Re:QBittorrent breaks out of sandbox to commit crimes by account42 on Monday September 07, 2026 @08:08AM (#49597368)
You don't start being sane just because you stubbornly keep the insanity up for long enough.
Re:QBittorrent breaks out of sandbox to commit crimes by mindslight on Sunday September 06, 2026 @12:29PM (#49588105)
It's understandable when you see that the ethos is to have software that represents the user in charge of the rendering, rather than centralizing it all on the server. There is a major difference between common "app store apps" or hostile javascript bundled with websites, versus software that's been written to work in the user's interest. However as they use similar delivery methods, it's understandable that it takes a minute to think through and revisit your assumptions that have lead to being default anti- javascript or app.
Re:QBittorrent breaks out of sandbox to commit crimes by Dylan16807 on Sunday September 06, 2026 @12:44PM (#49588283)
That makes sense until you remember what "rendering" is supposed to mean. Forming the HTML has no reason to be client side when you're using the site-provided experience. Yes provide a json version for other clients, but for direct viewing just send the paragraph of text in a usable form and let the javascript be an optional upgrade.
Re:QBittorrent breaks out of sandbox to commit crimes by peri-cl on Sunday September 06, 2026 @12:29PM (#49588110)
Mastodons will also respond to a plain "application/json" HTTP request, no cruft,

    curl 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content'
Re:QBittorrent breaks out of sandbox to commit crimes by kevin_thibedeau on Sunday September 06, 2026 @01:41PM (#49588898)
If only we had a tool that could directly let us browse through this as human readable text.
Re:QBittorrent breaks out of sandbox to commit crimes by nozzlegear on Sunday September 06, 2026 @01:53PM (#49589020)
Mine's called Safari
Re:QBittorrent breaks out of sandbox to commit crimes by throawayonthe on Sunday September 06, 2026 @08:54PM (#49592546)
what, like an app?
Re:QBittorrent breaks out of sandbox to commit crimes by jasonm23 on Sunday September 06, 2026 @10:03PM (#49592997)
obscure fruit based cli tool.
Re:QBittorrent breaks out of sandbox to commit crimes by lucas_t_a on Monday September 07, 2026 @10:00AM (#49598570)
i think they call it a web browser, but it looks like it does not do that most of the time.
Re:QBittorrent breaks out of sandbox to commit crimes by jasonm23 on Sunday September 06, 2026 @10:03PM (#49592994)

    curl -s 'https://beige.party/api/v1/statuses/117057396732763183' | jq '.content' | glow
for those terminauts who have incurable presentation ocd
Re:QBittorrent breaks out of sandbox to commit crimes by tomrod on Sunday September 06, 2026 @12:31PM (#49588135)
Treating HTML as a bootloader for an app has always felt like the wrong pattern to me. Outside of Authn/passkeys, it would seem a person could do basically everything in HTML (but, to be frank, I am not a front end dev and would welcome correction).
Re:QBittorrent breaks out of sandbox to commit crimes by tantalor on Sunday September 06, 2026 @12:42PM (#49588262)
Patches welcome
Re:QBittorrent breaks out of sandbox to commit crimes by smart_asslop on Sunday September 06, 2026 @12:51PM (#49588358)
>Patches welcome

Are they, though? Or are you just parroting the meme?

(The last I recall, Gargron's position was essentially "build your own third-party frontend if you want noJS".)

Re:QBittorrent breaks out of sandbox to commit crimes by tantalor on Sunday September 06, 2026 @12:54PM (#49588395)
That's what I meant
Re:QBittorrent breaks out of sandbox to commit crimes by mr_mitm on Sunday September 06, 2026 @12:44PM (#49588286)
How is that different from email, IRC, instant messaging, or anything else nerds use?
Re:QBittorrent breaks out of sandbox to commit crimes by fweimer on Sunday September 06, 2026 @03:44PM (#49590114)
Public email and IRC archives/logs usually work just fine without Javascript.
Re:QBittorrent breaks out of sandbox to commit crimes by Sharlin on Sunday September 06, 2026 @01:30PM (#49588784)
Webmail is perfectly possible, if clunky,without JS. That's how they used to work. IRC and IM require real-time updates of some sort, which is a reasonable use for JS. A Twitter clone shouldn't require JS just to render a page.
Re:QBittorrent breaks out of sandbox to commit crimes by mr_mitm on Sunday September 06, 2026 @02:11PM (#49589205)
You also can run a Mastodon application server side and serve server-rendered pages. I'm not aware of anyone having done that yet, but, you know, be the change you want to see. It's probably got privacy implications.
Re:QBittorrent breaks out of sandbox to commit crimes by padjo on Sunday September 06, 2026 @01:10PM (#49588579)
I really don't think that describes my Mastodon experience. Twitter for people with a conscience would be more accurate.
Re:QBittorrent breaks out of sandbox to commit crimes by GlacierFox on Sunday September 06, 2026 @02:56PM (#49589643)
I've found it to be full of completely out of touch basement-type neck beards with questionable consciences. They're both shit holes.
Re:QBittorrent breaks out of sandbox to commit crimes by AuthAuth on Sunday September 06, 2026 @09:00PM (#49592582)
There are a lot of people on Mastodon who are genuinely as insane as X users. I recently opened up my account and saw people engaging with al quds brigade accounts.
Re:QBittorrent breaks out of sandbox to commit crimes by Imustaskforhelp on Sunday September 06, 2026 @01:41PM (#49588902)
> Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.

https://masto.mirror.forum/beige.party/@intransitivelie/1170...

Source code: https://github.com/SerJaimeLannister/mastoview

(Disclaimer: It's vibe-coded. It does server side rendering to then just give pure HTML to the end user with no JS required.)

I hope that this helps people who want to view Mastodon without JS.

Re:QBittorrent breaks out of sandbox to commit crimes by j3s on Sunday September 06, 2026 @02:52PM (#49589602)
im sorry but expecting sites to work properly without javascript in 2026 is basically denialism
Re:QBittorrent breaks out of sandbox to commit crimes by 1vuio0pswjnm7 on Sunday September 06, 2026 @11:18PM (#49593488)
Alternative URL, no Javascript, no app:

https://beige.party/@intransitivelie/117057396732763183.json

   view-source:http://beige.party/@intransitivelie/117057396732763183.json 
The toot also appears in "<meta content="

   view-source:https://beige.party/@intransitivelie/117057396732763183 

   curl https://beige.party/@intransitivelie/117057396732763183.json \
   |grep -o "<p>.*<p>" > 1.htm

   firefox ./1.htm
Re:QBittorrent breaks out of sandbox to commit crimes by moffkalast on Sunday September 06, 2026 @11:56AM (#49587753)
Get this guy some VC funding stat!
Re:QBittorrent breaks out of sandbox to commit crimes by TacticalCoder on Sunday September 06, 2026 @12:22PM (#49588043)
> and then my copy of Jellyfin broke containment

The really incredible thing is that my computers were already doing similar stuff before LLMs became really a thing... In the BBS days.

Later on they downloaded mp3s from Napster which my computers auto-installed.

And now I gotta say: LLMs and agents at my place are acting like in TFA, downloading movies and series and setting them up in my Plex and JellyFin instances.

Thankfully they've not found a way to share those with the world yet.

Re:QBittorrent breaks out of sandbox to commit crimes by mannanj on Sunday September 06, 2026 @12:47PM (#49588313)
Op just committed a crime. He not only made fun of rich people which is not ok, he also stole from them. The thieving is only ok if it’s rich-on-rich or rich-on-poor.

Let’s remember to follow the rules and the laws we want selectively applied to only the weak.