News for hackers. Stuff that matters.

0x457

Re:WTF Ubuntu? on Monday November 02, 2026 @03:03PM (#50342850)
The other day, I sent a friend a link to my project. He asked, “When can I use it?”

I was confused because the project was already available, with detailed setup instructions, an `llms.txt`, and everything else needed to get started.

Then he showed me a screenshot of him asking ChatGPT about it. Apparently, ChatGPT was using some outdated cached information or something, because it gave him a wall of text explaining that the project was still “coming soon” and wasn't ready to use.

If he'd just opened the landing page, he would've seen that the project was already available.

Re:The Federated Code Forge on Friday October 30, 2026 @01:35PM (#50307345)
I wish I knew this before I setup mirroring of my personal forge to github haha.
Re:The Federated Code Forge on Friday October 30, 2026 @01:20PM (#50307107)
Are there plans to add http(s) support to knot? I was planning on hosting my own knot at home, but didn't want to expose my home IP (I use cloudflared for other services that need to be exposed)
Re:AlpineBSD on Friday October 30, 2026 @12:44PM (#50306509)
I agree and understand that, but I'm talking about purely technical reasons to use. IMO majority of alpine/musl usage is cargo cult. At my work, I'm yet to hear reason other than "its smaller" and "what is that? I just copy pasted it from X repo."

I won't deny that there is a use for portable binaries that don't depend on specific version of glibc, but its such a niche.

This exploit depends on the deployment. With PHP-FPM, an OOM during request startup terminates the child, so the corrupted state wouldn’t survive for subsequent requests to exploit. The challenge used PHP’s built-in server, where the worker was reused.

Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.

My Qwen3.8-27B was able to do it.
Re:AlpineBSD on Thursday October 29, 2026 @01:28PM (#50292785)
> people who needed a relatively full-featured build environment against musl

Yeah, I called this out as the main appeal of alpine. IMO no one should be using musl, but its another story.

> or people who had a test/deploy/debug cycle on environments that necessarily had no layer cache (ephemeral VMs, one-shot kubernetes clusters, OpenWRT routers that lost the layer cache on reboot). Or people with network-constrained traffic from registries or mirrors thereof.

Debian slim is ~30 MB compressed, and distroless/static is ~2 MiB. Small images aren’t unique to Alpine. With a fast local mirror, the extra download is negligible.

> Or people in environments that took container security findings (perhaps too) seriously and were tired of triaging endless reports for random dependencies in "FROM ubuntu" containers, and wanted a default required-by-policy base image that didn't come with the world.

1) Nobody’s forcing you to use a full Ubuntu image.

2) Alpine images still get plenty of security findings, often in the same dependencies your application needs regardless of the base image.

3) Nix is the best container builder anyway.

Re:AlpineBSD on Wednesday October 28, 2026 @02:12PM (#50278331)
Well, `FROM scratch` implies that if there is something that works with linux syscalls (i.e. Linuxulator) then it generally runs. Unless, like you said, it needs special filesystems.
Re:AlpineBSD on Wednesday October 28, 2026 @01:43PM (#50277725)
Alpine selling point was that it's small, which was selling people only for people that either don't understand docker layers or can't make Dockerfile correctly.

Alpine’s connection to static linking is mainly that it provides a convenient musl build environment. A fully static binary can run in `FROM scratch`.

Re:New iMac with M6 on Tuesday October 27, 2026 @03:39PM (#50264639)
Well, I got M4 iMac because I wanted a screen on my workbench with minimum cables and must be VESA mounted. I also needed a mac to build iOS apps. iMac was perfect fit.
Re:PHP2Shell: Exploitation Attempts and Remediation Trends on Tuesday October 27, 2026 @01:09PM (#50262303)
I was trying to steal those, but when I setup my local version, I things a little different: php-fpm and glibc because I thought this how everyone would run php with nginx. PHP-FPM recycled OOM workers, so there were no corrupted state to exploit and then when I switched to "php -s", glibc with ASLR made it not very practical to exploit.

Changed my lab to use the same alpine + php = tada working exploit.

Point I'm making: vinyl is a lossy format and not just lossy, it degrades with plays even if your turntable is super-duper calibrated. It even degrades just by sitting in a sleave if environmental conditions aren't close to perfect.
Vinyl is far from open source CD due to limitations of phisical format and the fact that good vinyl contains specifically mastered for vinyl with those limitations taken into account.

You can still easily buy Bluray player and open source your discs with ARM (not CPU/SoCs, different one)

Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @04:09PM (#50214615)
Older PDFs support PostScript XObjects: literal embedded PostScript code. Not sure it counts tho, because IIRC it was never executed by PDF viewer itself. It was "gives this to printer when printing"
Re:Apple Music 404 Not Found on Friday October 23, 2026 @02:08PM (#50213087)
Clicking sound unlocked some memories.
Re:Remove pgrust: the entry is cheating on Friday October 23, 2026 @02:02PM (#50212998)
> If the Ai came back to me with a 1600x improvement (still in pgrust readme), I would be highly suspicious of the Ai and the code it wrote

Depends on who wrote the original code. With postgres its sus, but if it's another AI...I wouldn't be surprised. I also saw code writtem by humans that is a result of "I can't figure out how to make this safe and concurrent, so imma just place giant mutex here", and it like 100 lines change to fix that.

Re:How I Reverse Engineered a Board Game on Friday October 23, 2026 @12:41PM (#50211765)
Or with self-signed cert
Re:Docker Is Weird on Thursday October 22, 2026 @10:41PM (#50203880)
It's about using go to develop container runtime being terrible and not that "if it was C it would be faster". OS runs the container, docker just does the setup and some managmenent.
Re:What Is Gridifcation on Thursday October 22, 2026 @02:02PM (#50198929)
> Well you’re not just listening to music, you’re also watching a performance. Seeing someone’s fingers on the guitar, touching the keyboard, gripping the drumsticks, watching the expressions on their face and their body posture - none of that adds to the art for you?

I can see that in a music video. At a live performance, I see a bunch of people in front of me and maybe some distant figures onstage. I definitely can’t see the drummer doing drummer things or anyone’s fingers on a guitar. And some performers just sound like dogshit live.

IMO, live performances are about the atmosphere, which can be hit or miss depending on the performer and the crowd. I’d probably like Rammstein live, but I’d also probably hate the crowd.

A studio recording is also a performance, just not a live one. Movies are similar: we don’t watch “the first take of the day”; we watch the result put together from the best takes.

Re:No More Icons in Every Menu by Default on Thursday October 22, 2026 @12:41PM (#50197800)
Sure, Fig Newtons got redesigned because after seeing something over and over again it kinda blends, and design refresh and suddenly it catches your eye again.

No idea why UPS keeps redesigning other than signal "we still up to date with trends", its not like its rebranding going to make me want to ship anything that I don't already need to (and will ship with USPS unless its overnight in which case I will go with FedEx).

Interfaces get redesigned, in opinion, either because: a) just because (bad) b) certain things worked the way it worked only because it had to fit existing design and eventually old design just couldn't fit new feature(s) (can be good or bad, depending on execution)

Re:No More Icons in Every Menu by Default on Thursday October 22, 2026 @12:36PM (#50197726)
To be its Car Play, amount of times I thought I have selected "Go", but it's actually "Back" that is selected. Drives me crazy. Partially fault of my car having shitty "touchpad" instead of a knob.
Re:Crystal 1.22.0 on Thursday October 22, 2026 @11:38AM (#50196913)
Crystal is for when you want to write C with Ruby-ish syntax. It's been around for awhile, all the way back to when Ruby was required to get VC funding.

In my opinion, it doesn’t excel at anything beyond being pleasant to read. Maybe if Go hadn’t come along, it would have gained more traction and developed a better concurrency runtime. Very few companies are publicly using it.

Plus, since 00s Ruby = Ruby on Rails, so it didn't appeal to ruby (on rails) developers back then.

Re:What Is Gridifcation on Thursday October 22, 2026 @11:16AM (#50196587)
Maybe controversial, but this is why I don't like live performances. If tickets were cheap, maybe, but paying a high price to hear a mediocre reproduction of the digital copy I already have is a pass for me.

I literally do not care that someone can "hit high notes" or that "unlike this other artist, my favorite artist can actually sing." I'm listening to music, not grading music class students.

Re:Setting Up SSH Keys on macOS with Touch ID on Wednesday October 21, 2026 @04:33PM (#50187234)
You should never have a single ssh key as mean to login anyway. My keys never leave device that created them, but every device has its own pair, plus yubikey-like key.
Re:PHP 8.2.35 on Wednesday October 21, 2026 @12:47PM (#50183948)
So how is PHP being distributed in your funny world? Because I can tell you, even if you put it behind “register with your work email,” whoever seeks the binary will find it.
Re:LayerFS: The filesystem for AI coding agents on Wednesday October 21, 2026 @12:27PM (#50183615)
"btrfs is battle tested"

Only in a sense that i went to a battle and lost all of its data to corruption. Should be removed from in-tree so people don't accidently use it.

Re:PHP 8.2.35 on Wednesday October 21, 2026 @11:50AM (#50183013)
Did start writing software this week?
> So you don't think it does more harm than good, and think something else instead.

I don't think it does more harm than good. Maybe I'm biased because it's been very good for me and the people around me.

> Isn't the criticism rather that the poll distinguishes between you and the people polled?

No. The argument being made in this thread is that people hate AI slop (people just hate slop), rather than AI in general. This poll was linked as evidence that people hate AI. My argument is that the poll is flawed and does nothing to counter the point being made in this thread about slop vs. AI.

As for Steam...ever since they opened up who can publish and how publishing works, there been _a lot_ of slop pre-AI. I'd rather have more interesting and more controvesial filters. People will get surprised how few recent games aren't going to be filtered by "No AI"

Well, poll does not distinguish between "I hate AI slop" and "I hate any use of AI"

While I hate nightmarish ai slop pictures some restaurants use and some very ugly banners some street vendors use, I recognize some some AI generated assets are pretty neat.

Same as when I got annoyed that library I wanted to use turns out does not check any of the boxes it claims to check, because its pure untested slop. I would have no issues with it being AI if it worked because I used it to make my own versio of that library that in fact works as advertised.

Older »