News for hackers. Stuff that matters.

9x39

Pain is a good teacher, for a better or worse.

Too often it takes repeated failures to clock in as a persistent problem at the necessary levels in an org.

If neither law nor insurance nor a CEO require it, it often doesn't get done.

Re:Astra can read and write weights to improve Qwen on Monday November 02, 2026 @02:25PM (#50342248)
Is integrity checking of weights even common right now? What about upstream integrity from where we're getting weights? The open-weight supply chain is ... wide open.

Makes me think about hostile hot-patching of weights of models we use, maybe they exfil data, perform tool use, or have triggers for specific types of responses. Would we even recognize what's going on?

If you had them on camera doing it and proof they did it knowingly and willingly, then you could.

Discovery forces evidence to be turned over, but only if it exists and you know about it. Does the evidence exist?

It did in Swartz’s case, unfortunately for him. We don’t excuse an individual just because it’s harder to hold a corporation accountable. States have immense power over corps old and new, btw, it’s a failure of the people to not demand that be exercised, but this whole discussion is a non sequitur already.

What if they get blocked from the network and repeatedly change accounts, IPs and then MACs repeatedly to get around progressively escalating blocks from the network admins?

What if they hide a laptop in a wiring closet and then try to come back for it while covering up their face to hide from a camera inside of it?

What if they run from the police who try to stop them?

In any case, we don't have to have quibble over shades of gray, it's all in the well-documented write ups and court docs. Mens rea is easily established here.

>He was charged with felonies for stealing PDFs for publicly funded research papers, he was tried as if he hacked these systems.

He did hack these systems and MIT's network. They had video of him in the MIT wiring closet and a mountain of circumstantial evidence. I'm not saying it wasn't pursued aggressively out of political motivations, which seems supported if you dig enough, but the facts of the case were about more than PDFs.

https://en.wikipedia.org/wiki/United_States_v._Swartz

Cautiously optimistic for them. Sigma faces some steep competition against Canon/Sony/Nikon but might be able to find a niche like Fuji has with price on one hand and lens+color fans on the other.

No IBIS is rough, because its definitely a useful thing - the R6 III has 8.5 stops for $2.7k, same price as the FP2 with an EVF. At $2.2k, the partial stacked sensor might reduce the jello effect, might not. It's an interesting tradeoff and it'll come down to whether the AF is good enough to make the 20 fps it shoots at usable. For example, if you shoot 30 fps but the AF doesn't work, 28/30 shots being blurry is a waste. The flagship cameras can get 60-90% keep rates if you do your part, so I'm curious what Sigma's system can pull off outside of a studio.

I think the biggest problem with a minimalist ILC is that a commodity body stops making sense bc once you throw in even a few decent lenses and the usual other spend on memory and lights, you're outside of the budget range. You don't _have_ to have Art lenses and nice gear - one of my favorite fun lenses is a $150 lensbaby experiment, but the gap between a decently rounded Canon kit and a Sigma kit closes in price and widens in capability fast once you get started, at least gear-wise.

$2.2k retail and 20 fps AF could work with the right lens and light, if the AF pans out to be at least partly as good as Canon & Sony.

Sigma's entire differentiator is quality at price for clear tradeoffs, and their lenses often succeed, curious if this might. Tough market, though.

Re:OLED iPad Mini on Monday October 26, 2026 @01:53PM (#50248002)
Luckily absolute performance still exists, it's just that we've normalized shipping less efficient software slopped out because there'll probably be new silicon in a few years so it doesn't matter.

Commodity hardware is plenty powerful and can be taken advantage of should prices signal efficiency is important again.

Re:Ofcom Concedes Defeat in the 4chan Case on Tuesday October 20, 2026 @12:37PM (#50169005)
I think the conclusion is more like mandating home and business web access is proxied at a national level and most other protocols disallowed. Use of VPNs without a VPN tax stamp and key escrow is prima facie evidence of violation of the Counter-Terrorism and Security act. Use of non-standard protocols is assumed to be criminal intent. Check with your approved internet provider for how to access the Internet safely.
Re:Suicide rates highest ever among middle-aged men on Wednesday October 14, 2026 @04:57PM (#50095115)
Internal vs external.

The midlife crisis is probably better described as a change or unease in the self and not knowing why you get out of bed in the morning anymore and that entire adventure, whereas this anomie is the social environment you're moored to breaking down.

Re:How the Military Will Hack the Election on Wednesday October 14, 2026 @03:31PM (#50093663)
I think the strongest point out of this was that the US populace is a dangerous vector for our adversaries.

In 5th gen warfare, the battlefield can be kinetic or information, and might be all around us and omnipresent.

What we're guessing at without this decade's version of a Snowden leak is what the equities of the US military are in this. Are we playing defense, offense, and where? Is the answer just, "yes"?

What about our adversaries, or more importantly, _who_ are our adversaries?

Consider just the usual 3 who are in the news: Russia, China, and Israel:

Russia: https://en.wikipedia.org/wiki/Russian_disinformation#Against...

China: https://en.wikipedia.org/wiki/Chinese_interference_in_the_20...

Israel: https://quincyinst.org/research/the-eighth-front-inside-isra...

Mailers going out in Iowa, reportedly: https://x.com/DMRegister/status/2110328563211567310

There's so little that's public about these wars and so little traction in the mindshare of the electorate, you'd wonder if it was real if you just talked to random people.

Re:Passkeys are a trap. Do not use them on Monday October 12, 2026 @04:25PM (#50062502)
>Passkeys work and make my life better.

Not the concern, it's whether it's worth the time and energy to expand passkeys as the default and getting normies using them. Some people will always surrender and say they have nothing to hide, so be it. I'm more thinking about the practical rough edges that user bases will cut themselves on once you expand past the extremely-online.

From my experience, it's a nonstarter. The expectation that normies will understand and maintain a password manager layer to store their digital keys in and understand that concepts end such as sharing passwords or logging in on a new device without fully bootstrapping the password manager is just too far.

I think sometime after Q-Day when the dust settles and we've had to reissue all the keys today, we'll have a better answer on whether the specter of remote attestation is truly manifesting and in any event I bet there'll probably be an updated passkey concept by then.

If you believe some of the emerging comments out there - try "Danfoss CVE" - you'll see that some of the suspects are 15-20 year old controllers like the Danfoss SM800 (EOS 2021) and SC355 (EOS 2016).

Why don't they just--- no margin. But there were CVEs-- no margin.

The laptop class doesn't always grok that the shift-work labor class has nothing in terms of luxuries like security reviews and gear replaced on cycles and other basics taken for granted.

But I'd setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you're part of a chain and it's centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?

Secure-by-default laws will eventually help, but there's always going to be groaning infrastructure particularly in commodity industries, and we still haven't onboarded most of the disaffected men to the Internet that will commit innumerable more hacks and disruptions.

But you’re going to adopt a platform that meets the needs across your enterprise, so the capability is often there even if one situation may only call for monitoring.

Further, once you have hundreds or thousands of devices, “just call someone to turn it up/down/off” doesn’t scale.

>Why does it require a photograph of the employee's face every 3 minutes in order to determine if they're completing their work? Why does that make any sense at all?

AI image analysis, gives managers a Statuspage-like dashboard of labor engagement. Green across the board, boss.

It seems like a faceless attempt to prune back WFH like you said. Even if it wasn't, nothing activates organizational levels of manager antibodies like open defiance by workers. She was cooked.

Dropbox had basically no competition at the time as the idea of cloud files was barely in the market.

Meanwhile, home routers with meshing and security and built-in cloud management planes with easy apps are already cheap.

What would your pitch be when mom & dad would probably just stumble on Amazon Eero or Netgear Orbi? Someone already brought fire back to the home market, you can't differentiate if you're just putting up a site and a device, unless you hit some absurd low-$ cost in an already low-margin industry.

You'd be better off looking for a niche or industry where the edges are sharp, the tooling is bad or inconsistent, and there's no clear winner.

Re:Passkeys are a trap. Do not use them on Sunday October 11, 2026 @07:30PM (#50049210)
>Especially without offering any advice on how to improve things. >And apparently it’s not even the point of the article.

It wasn't a pointless rant, you're seemingly primed for something that didn't happen here.

It's a good argument that passkeys are a trap while TOTPs offer the security you need but avoid the absolute control passkeys may hand over, so stick with those.

Re:Plunging test scores are a slow-moving catastrophe on Saturday September 26, 2026 @04:26PM (#49860233)
Is that a strategy for the 99th percentile or the 50th?

The winner of classroom tech is classroom tech vendors, not students, not collective test scores.

Re:Plunging test scores are a slow-moving catastrophe on Saturday September 26, 2026 @04:25PM (#49860223)
Taking care of them was historically about calorie and nutrientmaxxing. Subsidized calories have worked too well, worldwide, and there's no response to it within the current Overton window.
Going from software rendering to hardware acceleration back then was good times.

Quake II & IIIa

Tribes & Tribes II

Half-Life, TFC, Counter-Strike

Morrowind

Unreal

Those moments will never return...

Probably Team Fortress Classic. Hi to all nade and rocket jumping fans.

https://en.wikipedia.org/wiki/Team_Fortress_Classic

Re:I'm being cyberattacked by Tesla, Inc on Monday September 14, 2026 @02:00PM (#49701152)
They didn't hammer the entire internet. That would be like a multi-terabit DDOS. In contrast, the scanner in question sent a trickle of web requests for old vulns, nearly-innocuous at this point.

Fear & the danger aren't the same. anyway, I'll let it go.

>These systems are not accessible via the internet.

How would you know? Are you verifying them? SCADA systems weren't intended to be online, but that didn't stop critical infra for power plants, etc. to show up online. The convenience is too great to not try to remotely maintain them 'securely' & the assurance of airgaps is technical and expensive to get right.

Besides, are you considering the addition of modern AI to these 'offline' systems - factories, power, national weapons? You can get frontier models in a fraction of a rack today, who knows tomorrow. The organizations running these systems want in on the technological possibilities of AI, too.

Not to be a doomer about all this or anything, but there's a lot of evidence technologically superior entities dominate technologically inferior ones. So our home countries are in a Red Queen's Race to keep up, which is why adding "local" or "offline" AI to these systems seems probable. Again, airgaps are hard to maintain. It is within the realm of possibility that what's offline today is accidentally or intentionally networked tomorrow.

Re:I'm being cyberattacked by Tesla, Inc on Sunday September 13, 2026 @07:50PM (#49690016)
> It’s fair to ask if the harm they cause is worth the good they do.

Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples.

Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities.

If we’re talking harm, it should be in the broader context of internet history, imo.

Re:Global Shortage Has Led to Motor Oil Rationing at Costco on Sunday September 13, 2026 @07:34PM (#49689888)
Apart from feigned ignorance, a common trope is arguing X vehicle isn’t used optimally in a way they agree with and thus isn’t necessary to own.

I was pointing out the logical destination of this.

Re:Global Shortage Has Led to Motor Oil Rationing at Costco on Sunday September 13, 2026 @04:39PM (#49688442)
What % of people who have wealth really need that wealth?
It's also increasingly appearing to be the case that checking out yourself is adverse selection.

People with money have others shop for them, or ship to their house. The checkouts are for those who labor in that system who must now submit to the panopticon.

If you stumble into a big retailer like Walmart or Home Depot now yourself, it's like you crossed a zero-trust boundary. Security guards, motion-activated cameras that play sounds and nag you to remind you you're surveilled, manned turnstiles to stop door crashes with loaded carts -- all these adversarial controls suggest you're now in the wrong customer channel.

> I think people who are opposed to them would agree with this, people who are in favor of guns would be alarmed by this.

Bizarrely, I think it comes out backwards. In this article, the comments are surprised that Waymo's gun detection led to someone contacting authorities - it's not over guns, but that it was "young people" with guns, which means they can't use generalizations, there have to be bespoke solutions unique to every individual, calling the police to assess on potential threats is too broad.

The gun crowd would neither use taxis broadly to carry weapons, nor do so in the manner of the "juveniles" found in the article. Generalizing, they're well-versed in the minutiae of gun transport laws and more or less anticipate law enforcement contact, whether inadvertent or from Karens.

One well-known definition of gambling is whether it has 3 components: a prize, runs on chance, and requires consideration (payment).

That consideration > prize isn't part of this common definition.

>The organization is saving “north of 85 percent” in licensing fees compared to when it relied on VMware, the executive said.

Nothing we can't google.

VMWare VCF is, let's say, $350/CPU core.

MVE is $600/socket, so at 32 cores, that's $18.75/core. At 64 cores, $9.38.

An 85% reduction in licensing/support fees is plausible.

100% was already possible, just not with 24/7 support.

Older »