News for hackers. Stuff that matters.

Aachen

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Sunday November 01, 2026 @03:15PM (#50329308)
> the company can agree to everything and then dissapear.

Isn't that the case for every law related to commitments? Warranty, repair parts and battery longevity is a thing now iirc... haven't had issues with that being avoided so far, at least not in this way

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @10:29PM (#50322212)
Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj But then it turns out that this "applies from" late 2027 :/

Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @09:58PM (#50322081)
Yes, you'd introduce a lot of new bugs because the code is newly written[1], but eventually you'll get to the same maturity as today except you can't have all these devastating memory-handling-related vulnerabilities

The question is whether your software will be in use long enough to be worth the cost of change more than whether it's a good idea in the long run. For Linux, I'd argue that that's likely. At least new code would ideally be contributed in a safe language, where practically possible (there'll surely be places where you need to deal with memory as a kernel)

Relevant article: reducing memory vulnerabilities through a combination of memory-safe languages and an exponential decrease of bugs as existing code ages https://security.googleblog.com/2024/09/eliminating-memory-s..., from which I'll also quote my reference for [1]: "A large-scale study of vulnerability lifetimes published in 2022 in Usenix Security [...] found that the vast majority of vulnerabilities reside in new or recently modified code"

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @09:46PM (#50322029)
https://en.wikipedia.org/wiki/Express_Data_Path for anyone else wondering what that is
> our locations are visible to each other via GPS

... via mobile data or WiFi, you mean. Whether it uses GPS, Galileo, track measurement points, or even "driver calls the control centre to update their position" doesn't have much to do with it. What I assume you mean is redundancy so that two or more systems can communicate train positions independently, where the more relevant problem is how to get the data across in a timely manner. The driver of the stationary train called in their position and it wasn't used: it's a communication problem, not a "where am I" problem. Idk why the focus on GPS and using GPS for communication (which GPS can't do, and newer systems only do at very low speeds for emergency communication) but finding one's position is usually not the problem

I didn't vote on your comment but consider that people might just find the comment nonconstructive or uninteresting (which is what the guidelines say to base votes on) rather than that there is a "rule against criticising Gizmodo"
Re:Why Is This Fingerprinting Script Creating Bioweapons? on Thursday October 29, 2026 @12:59PM (#50292289)
If nobody sees it, same thing in the end? Not that it can be relied on, you can nitpick the technicalities here about under whose control it is at that point, but that's not the point
Re:Why Is This Fingerprinting Script Creating Bioweapons? on Thursday October 29, 2026 @12:53PM (#50292170)
what's the value of that when you can call it with any context? As a proof of concept, you could have it do the attack on a dummy target of your own, take the tokens up until the point where it decides you're authorised, swap out the dummy name with your desired target, and continue the session from there

Reminds me of 'NOBUS', where security agencies would believe that so long as you just don't tell anyone about a vulnerability that you discovered or introduced, nobody else would abuse that vulnerability to exploit a target while you can get access at any time. Training an LLM in such a way that it only generates the desired tokens if its memory demonstrates authorisation (surely nobody else could inject the right context otherwise) feels like a strange anthropomorphisation

Maybe a starting point that nobody would disagree on? You could ask the author, at least I feel like at Fosdem everyone's approachable
Re:Quad9 (DNS Resolver) to Exit France on Thursday October 22, 2026 @05:10PM (#50201087)
The post said they eventually won that case, though
Re:Every AI model has the same "controversial" take on humans on Thursday October 22, 2026 @05:00PM (#50200959)
Especially for someone not "well exposed" to generated text, they might think the words carry meaning the way they do when someone thought about the question and came to an answer. If anyone can interpret this, it's the people who know what they're dealing with (be it from exposure or, better, from a conceptual understanding)
Re:JPEG XL vs. AVIF for web use-cases on Sunday October 18, 2026 @07:01PM (#50146364)
Thanks! Yeah that sorta mirrors what I wrote (Opus allowing me to halve my audiobook library size, making it worth it to switch fully), just that I'd say new generations of people will also grow up with whatever the 'nerds' (including those at large businesses) make the new default or at least ready to use and recommended to anyone who looks it up
Bless the Internet Archive for basically hosting a second copy of the internet with sufficient bandwidth to serve whatever is currently down, while this single site didn't survive the traffic it got individually
Re:Gold is now the top U.S. export on Saturday October 17, 2026 @04:56PM (#50135055)
Would have thought advertising and transaction fees myself, but the article says it's usually oil (ok I should have thought of that), "pharmaceuticals" (mkay, seems cheaper to make elsewhere so that's a bit strange), or aircraft and their parts (wut? How many aircraft can the world need that it commonly tops the export chart of the wealthiest country?!)
Re:Claude reveals ECDSA curve origins on Friday October 16, 2026 @05:05PM (#50124709)
Which brings us back to the war on general computation. So long as people can have computers that they control, at least in one of the countries or regions, there's no putting this cat back in the bag and we are all along for the ride

Sometimes I want a fast-forward button for life, the times are so exciting and I want to know what else 8B people can think of next but there's so far no way to turn pages faster ^^'

Re:JPEG XL vs. AVIF for web use-cases on Friday October 16, 2026 @04:55PM (#50124542)
> I don't think there's a large-enough margin in this space that a new format could chew into to make the general public care

What improvement do you think is necessary for people to care?

Genuinely curious. Spoiler link with my answer to avoid any bias: https://lgms.nl/p/cau/?b64&ZVRNb9QwEL0j9T%2BMKqFtpe1Cqcq9qoT...

Re:JPEG XL vs. AVIF for web use-cases on Friday October 16, 2026 @04:36PM (#50124289)
Oh, that explains! I tried AVIF and JXL a few years ago and one of the two took ages to encode (a minute versus <1s for jpeg) to get similar compression ratios, and the other was somewhat reasonable on cpu complexity but significantly worse quality at the same size / much bigger to achieve the same quality as good old jpeg. I ended up concluding that jpeg is still the best for the specific image I was trying to lossily compress, but that was probably just the encoder then
Re:Claude reveals ECDSA curve origins on Friday October 16, 2026 @04:11PM (#50123916)
> [The model's authors] can do this kind of work with Claude, but if you or I try to do it, we will get blocked.

If this seems concerning, wait until the models get effective enough that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?

Re:The Engineering That Allows Articulated Buses to Bend on Thursday October 15, 2026 @03:54PM (#50109355)
Most metros are like this no? Not much seating, just articulated open tubes(-in-tubes)
Re:The Engineering That Allows Articulated Buses to Bend on Thursday October 15, 2026 @03:52PM (#50109332)
Boarding times though? I agree of course about the cool factor and I was sure to ride one when visiting London, but afaik the slower (dis)embarking times are why double-decked trains are primarily used on intercity trains and not on commuter/local trains or light rail (metro etc.). Typical busses stopping every two minutes are probably similar

Edit: wait, I know one in Germany as well. It's expensive but between Frankfurt airport and another major city, there is a rail line but somehow the bus is significantly faster and they're using double deckers. The front row at the top was, n=3, always free for me (all four seats) so you get a quite unique experience, at least so far as my bus experiences in mainland western Europe go :)

Re:Do dentists know what they're doing? on Wednesday October 14, 2026 @09:53PM (#50098173)
Fun story, but what about the pain all these years?! I'm mostly joking since I assume you'd have mentioned it if it were still there :), but I am curious if it just went away and never came back or if you found and resolved a different cause
Yes, they had these plans from the get-go so launching the necessary hardware is not surprising. The question was whether anything like that went live

Once it does go live, anyone could see the lower ping between two users of this network. If they say it got enabled, that wouldn't be hard to independently verify

Re:StreetComplete on iOS is now in public beta on Thursday October 01, 2026 @11:07AM (#49922673)
That's Apple's native way of going back across macOS and iOS no? I'm not an Apple user and even I've come across this when handling a family member's device for a few minutes

Maybe Android's visual ←back button is the way to go after all instead of hoping someone will accidentally discover implicit gestures

Re:Livenerf: Has Opus 5.5 been nerfed yet? on Wednesday September 30, 2026 @02:00PM (#49912251)
A better product isn't something?
Re:How Delhi cut electricity loss from 50 to 5 percent on Wednesday September 30, 2026 @01:30PM (#49911907)
Isn't it pretty unique to learn from seeing? My cat certainly doesn't understand "monkey see, monkey do". In this case it's about literal monkeys of course, but I'm not even sure all of them have this capacity. Probably also some birds and dolphins and such could learn this way, but not most animals with 'friends' (or late friends)
Re:PipePipe: NewPipe hard fork implementing SponsorBlock on Saturday September 26, 2026 @05:01PM (#49860510)
I have watch history in NewPipe just fine? And I find it very convenient to know what I've already watched. All local, Google doesn't need to store it for you / you can't lose access to it
Re:PipePipe: NewPipe hard fork implementing SponsorBlock on Saturday September 26, 2026 @04:54PM (#49860449)
I tried using Peertube but finding an instance whose content policy fits what you're meaning to upload and responds to sign-up requests isn't trivial. It's basically perpetual storage they're offering for free so I get it, maybe the real surprise is that youtube makes so much money off of us that they can afford this

Found one in the end when I didn't have a choice anymore and put renewed effort into it (Google's algorithm won't let me into my account anymore, saying they don't have enough information to verify it's me (username, password, recovery email.. not enough apparently, but there is nothing else), so I'm a Peertube exclusive now) but iirc I can't use it for everything, like if I wanted to upload something in Dutch I'd have to find a new server that allows my language

They're available if you want them. The main issue is that the userbase is small (in percentages at least, it's probably still an impressive number in absolute terms) and so there are also fewer developers interested in it. But they're functional and available at normal smartphone prices today if you're serious
Re:F-Droid 2.0: A New Chapter for Android Freedom on Friday September 25, 2026 @04:48AM (#49841836)
That's strange, sounds worth reporting. They should be able to tell you if there's anything else to check (maybe some javascript interface says Chinese is the way to go) or if it's really just some strange bug on their end (misdetection of the ip address or so)
Re:F-Droid 2.0: A New Chapter for Android Freedom on Thursday September 24, 2026 @02:56PM (#49835282)
https://wutools.com/dev/testing-debugging/http-header-viewer

First hit for 'check http headers', in case that helps find out why websites think you want Chinese content. Maybe it's a bug in the website; maybe it's set as your first preference. Please report the bug if there is one!

Older »