News for hackers. Stuff that matters.

AdrianCX

bugs that you can reproduce are the easiest ones to fix, claude opus for example would normally do the unit test and verify everything without much hand holding

how about about bugs that don't have a scenario or easy way to reproduce?, just some crash call stack, some corruption, something that happens once a year and you only have some logs?

Re:Local privilege escalation vulnerabilities in Linux on Thursday November 05, 2026 @02:58AM (#50376409)
those usually come from datasheets that you can't easily find or from other similar code doing the same thing

Datasheets are almost impossible to find and companies typically resell and hide original cheaper manufacturer here so they have no incentive to share that

Show HN: A framework for Raspberry Pi pico projects

https://github.com/AdrianCX/picohive-firmware

Developing Raspbery Pi Pico projects is a very fun hobby for meEnded up with something that makes my life much easierAbove lets me build projects that have tls/mqtt/telegram/calendar/mcp/openai API connectivity within bounds of a microcontroller (256-512KB ram)All i need is to drop some command classes in a folder and some macros and they're routed automatically.I also have encrypted logs over...

( Read More... | no comments | on HN )
Re:$48 e-paper display can be whatever you want it to be on Tuesday November 03, 2026 @02:02PM (#50356567)
You can even out the logic on the microcontroller :)

I did that with a pico: https://github.com/AdrianCX/picohive-epaper

Sharing since this was fun to build standalone

This helps a lot in the the morning

Components are pretty cheap, 3d printed parts took some time figuring out

Firmware, STLs, OpenSCAD sources and wiring are all available on link

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:24PM (#50319772)
so just block multipath and add the firewall rule from article that drops packets with IPv4 options
Re:Breaking the Open Web Won't Stop the Bad Bots on Friday October 30, 2026 @03:20PM (#50308915)
> The crawler operated by technical staff in $foreign_country just switches to compromised smart TVs in your own country

That costs the crawler money, not many do it and is something that can be fixed over time

banning country and AS numbers for cloud companies is pretty effective in my experience

Re:Anthropic hacked to deliver remote access trojan on Friday October 30, 2026 @08:59AM (#50303251)
Why not use claude code directly?

Why risk getting compromised like that?

Re:Anthropic hacked to deliver remote access trojan on Friday October 30, 2026 @08:28AM (#50302987)
Then why even allow employees to use that?

Binance got a pretty expensive lesson if that was the cause for their recent hack

Re:Backdoors in official Claude Code extensions on Friday October 30, 2026 @08:23AM (#50302952)
OpenVSX has no extension signing, no verification, nothing...

So really, there's no way to say what was compromised and where.

This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed

Re:Anthropic hacked to deliver remote access trojan on Friday October 30, 2026 @08:19AM (#50302919)
Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

Re:Backdoors in official Claude Code extensions on Friday October 30, 2026 @08:03AM (#50302777)
https://www.reuters.com/business/media-telecom/cursor-says-u...

> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday

So is this or isn't this from Anthropic and how did this happen?

They wouldn't get fired. They are protected both in the US and Spain.

At most face unlikely discipline.

Here they would even have valid reason to refuse - order was given for full speed, regulation says low speed ready to stop.

So a "No, i'm not doing that, you're moron" would be justified.

The "random blinking green light" is generally more reliable

Being a snowflake here has 2 benefits:

1. Getting company managing tracks to fix the lights (they need to deal with angry customers and pay off damages for delays and more), so there's a direct path from unreliable lights to economic damage.

2. Avoid crashing and killing yourself and passengers on the offchance the person on the radio is a moron

so in this case, couldnt conductor just say - make it green, not my problem, staying still until then
The train driver's job is to say: "it's red, I'm no moving, not my problem, you make it green if you want me to go"

That's why it's a union job

Also he's the first person to die on accident so it's that and the safety of everyone else

They do not 'need' to follow others, they just need to refuse unless all safe and green.

If they never start to drive it's the companies problem to deal with angry non-dead customers

Why is that?

I remember a long time ago I was stuck in a train in a field a considerable time because of a similar failure and conductor just wouldn't move unless green

I was expecting the same here, conductor is the first to die so just refuse until the idiots fix their system