News for hackers. Stuff that matters.

DSMan195276

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @10:49AM (#50304777)
Well actually, no. The Tether T&C says that they can basically do whatever they want with your wallet, all disputes have to be resolved via arbitration, and you waive your right to a jury trial.

Sure, you _can_ still sue them anyway and maybe get around the T&C, but you can sue the government to, the important question is if you can actually win.

Re:Anthropic S-1 on Monday October 26, 2026 @03:12PM (#50249368)
The only reason to buy this stock specifically is if you think it will outperform the market though, otherwise you're taking a more risky position with no upside.

Put another way, the risk has to be worth the potential reward - expecting Amazon-like returns might be unrealistic, but what level of returns would be necessary to counteract the amount of risk you're taking on if you buy Anthropic stock? And what kind of valuation would Anthropic have to reach for that to be possible?

Re:Do dentists know what they're doing? on Thursday October 15, 2026 @04:11AM (#50100748)
Worth keeping in mind that no medical test has a false positive rate of zero, so whether a test is worth doing becomes a statistical question - and the accuracy of some of those tests is different depending on whether a doctor first screened you to be likely to have a certain condition.

If you were to do something like run every cancer test possible then _eventually_ you'll find one that says you have cancer, but it's not a valuable result because statistically one of them was eventually going to say that. I don't think most doctors are doing significant statistical analysis to determine what tests to give you, but the general concept that you don't simply run every test you can for fun is very sound, screening beforehand can rule out a significant amount of false positives while hopefully not significantly increasing the chance that something is missed.

As somewhat more real example, rapid strep throat tests overall rarely give an inaccurate positive result, meaning that if the test shows a positive result you can be pretty confident you have strep throat and need antibiotics. However the false positive rate of rapid strep throat tests is extremely dependent on the patient first being screened for symptoms of strep throat - there are lots of asymptomatic strep throat carriers who have no symptoms but do have the bacteria, they don't need treatment but do give a positive result on the test. Thus if you were to give a rapid strep throat test to an entire school to try and eliminate all cases of strep throat then you'd find that ~10% to ~20% of the school gets a positive result. In that situation at least the tests are cheap and you could potentially resolve the situation over a number of weeks, but not every test is so simple.

Re:Whatever became of holography? (2011) on Monday October 12, 2026 @11:47AM (#50058135)
> Though that also is part of the reason that a they're not more common. Each hologram is the film rather than a "print".

This might be true for current processes but it seems like it should be possible to duplicate a hologram - use a hologram as a stand-in for the original scene when creating a new hologram. The result might have some blur (that progressively gets worse the more 'generations' you are from the original) but that seems like a solvable problem if someone worked at it.

I think the real reason we don't see them is more practical - it's amazing tech but a bit too much of a novelty in its current state, it's just not something that most people would want to put on their wall.

> if they wanted to properly triage and annotate vulnerabilities, and provide reasonable assessments of what is or isn't likely to be a security risk, they absolutely could.

I'll challenge this, I don't think that's really possible, at least not to any high degree of confidence. Nobody can realistically evaluate if any particular out-of-bounds read/write or use-after-free is "safe", and if you're going to consider all of those as security risks then there's not really a point in trying to filter out the few bug fixes that might not lead to those things.

Try going to the linked page, pick any random CVE, and read it. I've checked a bunch and I'd say _at least_ 8/10 of them are variations on those two things.

Re:New PlayStation 5 Console Jailbreak Released on Tuesday September 29, 2026 @03:32PM (#49899108)
Err, Pokemon Champions does not require a Nintendo Switch Online subscription to play online.
Right, and then everybody would be in the comments complaining about how "everybody is using a new term for planet and it's ridiculous, just call them planets". It's not a battle that can be won.
Yeah apparently people are getting harassed on the regular about Pluto, I'm a little confused.
Re:Decompiling a Nintendo 64 Game in 84 Days on Friday August 28, 2026 @10:55AM (#49479489)
Why would you assume that? That's not even true of regular software :D

But also, as long as the game works on the specific hardware it was designed for then that's all that mattered, which was my point. If it reads uninitialized memory or depends on exact cycle counts or some undocumented hardware behavior then that's _fine_ if it still works on the real hardware, plenty of that was even intentionally done to achieve things otherwise impossible on that hardware.

At the same time it makes it almost impossible to verify even trivial changes to a function. Once you start accounting for all the potential state differences the answer to "does this function work the same?" will basically always be 'no' unless the code is identical. The only way to eliminate various kinds of state from being a concern is to analyze where the function is _used_, rather than just the function itself, and that's an entirely different and much harder kind of challenge.

Re:Decompiling a Nintendo 64 Game in 84 Days on Thursday August 27, 2026 @08:08PM (#49472839)
Who said games were well written? Older games are often very sloppy and buggy, and abuse the specific hardware they're designed for to get extra performance, unique graphical effects, etc.

Emulators constantly run into games that don't run because of specific hardware nuances that may or may not have been intentionally used (Ex. relying on exact cycle counts, reading uninitialized memory, changing values while they're used, etc.).

That seems a bit silly considering how many of the most famous paintings and artworks are/were commissions. Do you disqualify anything that was made for monetary reasons?
On its own that seems like a pretty weak justification, at that point we would need to preserve every copy of every book forever because you never know what what useful physical material it has on it even beyond its text. That extends to non-book items as well, and while I understand the idea it's just not realistic in any sense.

I think the more important part is to define what "rare" actually means and save/digitize set copies of those books that are actually at risk of being lost completely (rather than letting them rot away somewhere or get bought up to be privately destroyed). I suspect many of them are just not at all interesting enough to justify the expensive though.

> Point being, the tools have always existed, and always felt inappropriate or convoluted, but my parents at least were happy to do it for their kids 20+ years ago. From what you're telling me, they're now a lot faster and easier to access and use.

No they're not, the systems that exist today often don't even work and there's no alternative of "just mail a letter to Microsoft and they'll sort it out for you".

"Faster" is also a frankly a silly point - it's not like your parents were waiting at the mailbox until the letter came in the mail, the important question is the amount of time actively spent dealing with these things.

> I might be being overly cynical here, but I think part of the problem is parents expect to give their kids the internet so they don't have to spend so much time/attention with them.

> I think this means any solution which involves active parent participation is going to get shunned by a vocal subset.

I don't think that's a fair assessment personally, rather you've missed a key detail that things are significantly more complicated than they used to be, it's not just an 'effort' issue. There is no universal "user is age X" setting that applies to everything everywhere, rather everything has a different system and pretty much all of them are terrible in various different ways.

I'm very tech savvy and I still struggled just to set up a Microsoft/XBox account for my daughter so that we could play some computer games together. Access to all the different age rating settings is spread across something like three different apps and websites and in my experience they don't even all work consistently. That experience is also not dissimilar from the experience with other types of accounts. For people I know who are less tech savvy it honestly doesn't matter how much time they put into it, eventually they give up and turn off age ratings because something isn't work and even if there's a solution it would take them hours to figure out.

Point being, if the existing tools were much better I don't think we would be having this kind of conversation.

Re:Claude Code uses Bun written in Rust now on Tuesday July 21, 2026 @01:47AM (#48988501)
Yeah I agree with that as well, the unsafe keyword takes on a double-duty which makes it unclear how it's actually intended to be used. The idea that you might mark a function that's only made of safe code as 'unsafe' is not that obvious and not always agreed upon, I've seen plenty of debating about it.

The fact that 'unsafe' also enables all unsafe operations in the function body just makes it even messier, since you definitely _don't_ want that unless the entire body is really nothing but unsafe operations. Thus the "mark a safe function as unsafe" has a clear downside since it allows all the unsafe operations you didn't want to use.

Re:Claude Code uses Bun written in Rust now on Monday July 20, 2026 @11:09AM (#48979966)
> But the bug is still almost always in an unsafe block.

That's entirely dependent on how you write your Rust code. If you're derefing an invalid pointer then the bug is usually in how you calculated that pointer value, but the only part that actually requires 'unsafe' is the deref, not the bugged pointer calculation.

Now in properly written Rust code you should be marking all of that code as 'unsafe' in that case and documenting what invariants need to be maintained, but that's entirely on you to do. The only part the compiler actually enforces is that you mark the specific spots where you make use of the operations that 'unsafe' allows.

Re:A grumpy screed about AI in software engineering on Friday July 17, 2026 @11:22PM (#48954900)
I agree and would add to that from my experience:

1. Too many people think that having lots of text makes something impressive, really it's just inconsiderate and nobody is reading it all.

2. Helping people often feels pointless because I can tell I'm just getting a cut/paste AI response back.

> A leap-hour, meanwhile: That kicks the can so far down the road that we'll probably lose track of it completely. 600 years is a very long time; society will be a very thing by then. Leap-hours seem to me to be moral equivalent to the "fuck it, let's just give up" option.

Something to consider: The use of timezones in mostly 1-hour increments over inconsistently placed areas means that the vast majority of people are already living many minutes off from the "actual" time at their precise location, in some cases even more than an hour. "Giving-up" implies that this is something important worth maintaining, where-as for the vast majority of people they gain nothing from leap seconds or even leap minutes. The most important thing for people is simply that everybody agrees on what time it is, which is easier when leap-Xs aren't done.

That said it's also probably true that a leap-hour would never actually happen, but that's not some big issue. By the time we got to the point that a leap-hour would make sense people would have already adjusted their habits and it probably wouldn't be worth it.

Re:Steam Machine on Tuesday June 23, 2026 @04:45PM (#48651132)
For me the problem is that the target performance is in a weird spot - low enough that it's not amazing, but high enough to still be very expensive if you don't plan to play games that actually require that performance.

A cheap $300 mini-PC is a lot weaker but it can still play plenty of indie and other games just fine, ultimately that's what matters. For me, I would have considered buying one of these if they had one at a $300 to $400 price point even though it would have been significantly weaker, but at $1k it's just impossible for me to justify.

Re:Stop Killing Games on Wednesday June 03, 2026 @05:39PM (#48390501)
The government will release it with all the copyrighted code and assets that's owned by a bunch of third-parties?

Ex. if I license my artwork, music, characters, code library, etc. to a game developer and they don't create a legally releasable version of their server, then the government will forcibly break our licensing agreement and I just get screwed?

Re:Stop Killing Games on Wednesday June 03, 2026 @04:58PM (#48389946)
> Wouldn’t it only require action from you if you were trying to kill multiplayer in the first place?

It's a question of when, not if - you're not going to pay to keep the servers online forever. What are the legal consequences of not releasing a functioning server if for some reason you can't? If they're bad enough then plenty of people will not be interested in taking that risk by making such games.

That doesn't sound that unlikely to me personally, not everybody has the best tech habits and some life events can result in losing access to both very quickly. It doesn't have to happen often for it to still be a common event in support cases.
The point is that at a minimum you're supposed to bubble the `unsafe` up if the API does not guarantee safety is maintained for all cases (and documents the invariants that have to be kept by the caller), otherwise the system breaks down.
> Assuming the port is actually 1:1 without any behavioral changes

It's not, that's clear from this kind of bug popping up. Functionally this bug exists because `PathString` was converted into a "safe" Rust API but still works the same internally as the original Zig code did (via using `unsafe`), that introduces UB that wasn't there in the Zig code.

If it was attempting to be a 1:1 with no behavior changes (like c2Rust attempts to do) then this would not have been turned into a "safe" Rust API like this.

> They already have the position of used buying and sales, extending that into in store receiving and listing of items on eBay makes sense.

Why do they need to buy eBay to do that?

Re:GameStop makes $55.5B takeover offer for eBay on Monday May 04, 2026 @04:04PM (#48014223)
Sellers what? You generally don't just drop stuff off at a fulfillment center, when you get to that size you're dealing with large amounts of inventory and you ship it to them.

If you're saying sellers could come into a GameStop to have their individual items packed and shipped out, I suppose, but:

1. They don't really have the space for much shipping volume at any of their stores.

2. You can walk into any USPS, UPS, FedEx, etc. store and do that already, you don't need an 'EBay' store. GameStop would presumably get the packages picked up by one of those carriers so it's not saving any shipping time or expense.

For buyers, in many cases there's already alternative drop-off locations similar to GameStop Ex. For UPS deliveries I can get them shipped to a bunch of different convenience stores near me. GameStop stores might be a nice addition to that list but it's not enabling something you couldn't do before, and I would think for most people they already have a closer location than a GameStop.

Re:GameStop makes $55.5B takeover offer for eBay on Monday May 04, 2026 @11:12AM (#48009715)
Yes but I don't need to go to my nearest fulfillment center if they ship everything to my house, that's why I don't know where it is.

What do you think people need to visit fulfillment centers to do?

Re:GameStop makes $55.5B takeover offer for eBay on Monday May 04, 2026 @11:06AM (#48009648)
> Obviously they're going to need to liquidate a lot of this stuff.

If you read online employees have talked about how they donated it or threw it all out, presumably there is very little of that stuff left at this point (and probably nothing left of any real value).

Ex: https://www.reddit.com/r/GameStop/comments/1qceolz/what_did_...

Re:GameStop makes $55.5B takeover offer for eBay on Monday May 04, 2026 @10:52AM (#48009489)
No, why does it matter? I also don't know where my local GameStop is since the few by me closed a couple years ago :P

Plenty of stuff on EBay offers me 2 day shipping clearly via fulfillment centers, as far as I'm concerned that's all that matters. Do you think the addition of GameStop stores would mean EBay can offer faster shipping than that on a significant number of items?

Re:GameStop makes $55.5B takeover offer for eBay on Monday May 04, 2026 @09:06AM (#48008241)
Yeah this is the funny part to me - if you thought EBay was an amazing business then you could have just bought that stock months or years ago. Maybe the combined company will really be worth more than both companies individually, but for the most part this is just GameStop deciding how you should have invested your money months ago.

Older »