News for hackers. Stuff that matters.

Eufrat

> Reverse Engineering became much easier, it is plus. Finding vulnerabilities also became much easier, another plus. Models are getting better.

I think the models are good at this because we can just set them loose and they can permute through their training and because a lot of things are common patterns, this can work, but is also generating massive amounts of slop that people are dumping on maintainers who are getting overwhelmed by it. I really want to know how many failed iterations a successful run cost.

One unanswered question is if this is economical. Like, if this is just gobs of money and is unsustainable, what did we just spend the last few years doing? I think these things have value, but not like this.

It’s different sides of the house.

Operators understand how important having them connect to PLCs and various bits because failure can mean you can take out parts of whatever it’s controlling, the power grid, oil pipelines, etc. So, you need to be very aware of what you are doing when you do these upgrades. There’s a lot of process to ensure you don’t break things.

But, you tell them about network security and or having to have Modbus messages wrapped in TLS and some of them will tell you to shut up and get out of their way. These systems have literally been just ported from the equivalent of a PDP/11 to Linux. So, not the most robust things when you come from a network security perspective. They really are 1970s systems and it’s really annoying, but I don’t think there’s any money in really doing anything about it and a lot of people make good money consulting around for these things.

Re:GLM-Legal: Advancing Agentic Legal Intelligence on Monday October 12, 2026 @10:41PM (#50065899)
> Legal practice demands an unbroken chain between facts, statutory doctrine, analytical reasoning, and client-ready work product.

I really find legal models kind of insulting and the people who think they are a good idea are being intentionally obtuse. The law isn’t based of base axioms and we literally just make stuff up a lot of the time. Everyday law usually isn’t breaking new ground, but if that’s the target, these models don’t have much value there either.

I think for the big players, it often is, my impression is the more systemic risk is smaller players (like very local utilities) these are sometimes run by very unserious people.

Most SCADA systems date from the 1970s and a lot of them don’t really think about network security or even have a concept of it. So, they don’t think about the consequences of connecting it to the Internet for remote access. It’s just a feature they want.

This slowness also means it sometimes has a hard time understand new risks and a lot of industrial systems are not operated by people who understand those risks and do…very stupid things.
I believe the entire basis of their profitable quarter was getting a discount on compute from Musk.

All these figures are so utterly weaselly. AAR is a made up measure to make them look good. If they cannot show GAAP numbers, they are hiding something. Full stop. While as private companies they are under no legal obligation to show us their books, their PR and intent to go public requires it.

Re:OpenAI Withdraws 3 Math Papers on Thursday October 08, 2026 @01:59PM (#50009442)
This ship kinda sailed when OpenAI came out of the barn by claiming it could replace people. The narrative of the AI bubble has always been this cynical management driven replace your human capital/labor with stupid bots.

Trying to actually get the framing to be more reasonable is just hard because so many people have oversold it and large swaths of the public are sick of hearing about it.

Re:Decisions API is in public beta on Wednesday October 07, 2026 @12:44AM (#49988294)
Every time something comes during the AI bubble we get a wave of me-toos. I think the Jev wave is noticeable for how muted it is.

The fact that this keeps happening demonstrates there is no moat. The fact that each wave gets a little less attention demonstrates there is no killer product here.

I have to stress this is not a real use case. It is a tech demo with no practical application. Doesn’t mean the tech might not have some application later in other places, but this is silly. The Unitree G1 costs $13,500.00 and does what? Clean a house? Show me actual demand and I’ll show you an actual market.

> that’s just the start.

Every single absurd AI claim can only speak about the future. We have invested more than the annual GDP of a Nordic country into this stuff in the last few years and have only forward thinking statements to show for it.

> Physical AI is exploding right now with robots getting tantalizingly close to actually being workers irl.

Citation needed, I have not seen any sign of this. I mean, China having humanoid robots running around is a cool demo and none of that is useful.

I am not suggesting that these don’t have value or won’t be used, but there are perfectly reasonable businesses that could have used these that are just going to get caught as collateral damage because LLMs are going to be a swear word in corporate planning for a while after all this.

There is always blowback during the collapse that is just as irrational as the bubble that caused it.

It’s not a bet, it’s just mania. There’s no rational basis for any of this, the entire thing is artificial. This impending disaster has more aligned with an oddly missing bubble in their diagram…the 2008 housing bubble.

I think we’re at the phase were people are trying to make wash their hands of culpability. That the bubble was not rammed down by a small group of people and was not entirely illogical when examined by more than 5 seconds of care, so that people can point to this in a little bit and go, “Nobody could see this coming!”

The real tragedy is not just the jobs and the economic destruction that we’re going to see, but the fact that this tech actually has some pretty cool use cases and it’s almost certainly going to get burned as when things like this collapse it just takes everything down with it.

Re:OpenAI breaches Medicare, Albanese reveals on Thursday September 24, 2026 @03:44AM (#49827526)
No, you don’t understand, this is a shining example of AGI! We recklessly deployed it to show you how powerful it is and how much we can’t be trusted with anything, but you need to let us or China will do it!
> Every time I hear this line of argument I cringe.

Because it’s the same kind of fatuous logic that intelligent design proponents use. This thing is so complex so we can’t possible understand it. Therefore, it’s magic.

People specialize for sure, but it’s not like the average person can’t figure this stuff out with some motivation.

I’m suggesting that having a model wander around stochastically is not necessarily a great way to gain any insight or understanding. LLMs do not think, they cannot really debug anything. Attaching intelligence or intent to them is a non sequitur, it’s not happening. A cloud that looks like a toaster does not imply anything beyond the human obsession with pattern matching, why do we keep doing this with LLMs? They can randomly wander around and sometimes produce useful output.

I don’t doubt they help by randomly permuting around in a way that people cannot do at scale, but I question the economics of this approach and I think it needs to be used judiciously. Sometimes you just have to do that especially like you said, when you do not have the source or the code is intentionally obfuscated, this can be useful, but a lot of people seem like they’re just vibe coding crap and blowing money on tokens until they get a useful result and I have no idea what the value of that is.

> If we sorted through all those new apps and ignored all the crap, I'm pretty sure we would find an overall increase in actually useful apps. I just shipped a new app myself, and I think it's useful, and I wouldn't have finished mine without AI assistance.

I don’t think this is happening, at least not on any scale that makes any of this actually useful. One off success stories do not make a revolution.

It absolutely has generated a massive amount of slop, though. The problem is that you still need intent and while I think LLMs can help you free up and push through annoying boilerplate or tedious spots where known solutions exist, you still need to design these things and that’s something I’ve not seen an LLM be too helpful with.

The fact that this is an account with a username specifically focused on this specific concern that was created 5 hours ago is real weird/suspicious.

Also, are these even actual decompiles? Sure, playing Wheel of Fortune with a LLM model that at some undetermined point spits out what seems to be a working example is sorta useful, but also…how exactly do you debug this nonsense? Don’t tell me we’ll just have the LLM thrash around a bunch again. What I’m asking is does anyone understand what is going on here other than “lol, it works, shut up”?

Re:Building a Linux GPU Driver for the M4 Mac Mini in One Month on Tuesday September 15, 2026 @11:42PM (#49721840)
I think this comment is missing the forest for the trees. Obviously, ephemeral interaction is going to happen.

The author’s blogpost is sloppy and has some signs of being AI written. This kind of bleeds into the main point I’m going to make.

Asahi Linux folks are clearly more conservative and erring on the side of caution, so, this means that the glibness with which the author is treating any of this is probably sufficient cause to refuse his entries. It is unclear if LLMs should be considered a toxic waste dump in terms of trying to maintain a clean room. We have not established a standard. It is clear the author doesn’t think this is a big deal, so that’s one conflict. The other conflict is that it is not clear what their exact interactions with Apple Silicon folks is and their glibness of it doesn’t clarify anything.

If you take a group that is trying to be very careful about the potential legal landmines a still nascent technology has and you get someone that espouses a general glibness about those concerns wanting to merge code…why on earth would you expect that group to accept them as a contributor?

This is not to say this isn’t really cool and a neat use of LLMs, but it is totally understandable why Asahi Linux won’t accept the fruits of this kind of development. If it turns out that Apple can identify its non-OSS code in this, it’ll be a mess.

Based on what evidence?
I really think you are missing the point and the frustration of why people are so hostile to OpenAI. Your defense is kinda irrelevant and very confusing. Why are you defending OpenAI so aggressively?

Sam Altman represents OpenAI whether you want him to or not. The market and public perception hinges on his often questionable actions. The CEO’s job is in large part as a salesman. Him posting “her” on Twitter to try and promote GPT-4o’s voice features is hard to believe that he didn’t know what he was doing and the market and Scarlett Johansson reacted accordingly. A competent person would not have made such an inflammatory statement after she had explicitly declined to permit OpenAI the use of her voice.

Your CEO is going on podcasts and going around saying that AGI is here and also AGI is not important. What blithering marketing is going on here?

Re:Shutting down our public encrypted DNS on Friday September 04, 2026 @11:28PM (#49572831)
Or that the Nazis are socialist because they have socialist in their name instead of it being a front name to hide their fascist and racist intentions.
Re:GrapheneOS says Pixel 11 has MTE support after all on Thursday September 03, 2026 @12:55AM (#49546107)
Implementing MTE is mostly another step in Apple’s efforts towards memory safety. There are bunch of things they’ve done to try to make this work a little better, but for obvious reasons, this is never going to be turned on by default for user apps and is only enabled for specific pathways.

> Because EMTE tag checking imposes a performance cost, we designed Memory Integrity Enforcement to take advantage of our secure allocators first and use EMTE to protect only smaller individual allocations within a type bucket, which software allocators can’t defend on their own.

Which seems to imply that outside of Apple’s targeted use in the kernel, the developer use of MTE on Apple platforms requires that you migrate your code to use their typed allocators…which I don’t know how many people are going to do that (and it is clear their answer is going to be to point people to Swift since it makes these types explicit for the compiler and even then, I am sure there are bugs in Swift in certain cases). Memory tagging is neat tech, but I don’t know if it’s going to gain all that much traction. It requires a burden that I suspect most app developers are not willing to take on and given that the user interaction is a crashy app. This is a path to nowhere except those of us who understand the trade-off.

For what it’s worth, this comment was not targeted at you, but rather the model kinda forcing it. I get the sense that Anthropic did not think much of this, but it seems to have gotten worse with recent models and it really comes off as a kind of nails on the chalkboard writing style.

I have to image whatever style of writing this was trained on is a lot more pleasant to read and I feel bad for whoever writes like this now being associated as bad AI writing.

I hate this AI style writing because since it doesn’t really understand flow, it’s being inserted in irrelevant places and it is extremely irritating to read.
Re:Progress Linux 7.2 – Asahi Linux on Thursday August 27, 2026 @01:07AM (#49460004)
My understanding is that Apple has an extremely special license with ARM partially because they helped fund ARM when it was spun out of Acorn and they are not required to conform to the specifications like other licensees.
Re:Was Modern Art a CIA Psy-Op? (2020) on Monday August 24, 2026 @10:57PM (#49428577)
Sounds like it was more about spreading American culture as part of the Cold War. This feels a lot more benign compared to Modernist architecture which seems to have fascist tendencies what with Le Corbusier and Philip Johnson being literal Nazi sympathizers.
I think the glib answer is, “Greed blinds all”.

Most of the people pushing this are just hoping that they can cash out before the hype pops and financial gravity crashes the party. Sam Altman recently claiming that the singularity is here is so stupid on its face he should just be treated as what he is, a huckster.

None of this stuff ever made any sense on what it was being sold initially. It was always insulting that the media and business leaders tried to argue that the tech could replace entire call centers or vast swaths of entire industries.

People keep arguing, but it will or it has based on extrapolating certain, reasonable use cases. Klarna has shut up about replacing call centers with bots because Markov chains with memory only can do so much.

Voters don’t go and actually look at the data themselves. They rely on pundits and the news to tell them the salient points.

The problem is that the media has essentially lost most of its usefulness as a bulwark against the most egregious excesses of crony capitalism and cozied up to it instead. It feels like the Gilded Age again, but the people are somehow more insufferable. Cramming the “light of human consciousness into the stars” apparently requires we create CSAM generating machines powered by nitrogen oxide belching gas turbines. Even the folks at non-profit news outlets like Pro Publica have leadership that refuses to understand that it is difficult to prevent AI errors at scale. Nobody reviews drafts with such detail, we make a lot of assumptions, we trust that the person/machine is not feeding us trash.

This is, of course, doesn’t even bring up the fact that a lot of people in the US now get their news—similar to folks in India via WhatsApp (that became such a problem that Meta was forced to curtail the number of forwards you could do in the app)—by passing trash, hate fueling articles around on social media.

> Law and medicine are fundamentally harder fields to obtain decent training data for

I think this bubble has given a lot of people software brain and are trying to apply it to fields it is wholly inappropriate for, though. Law is about argumentation and rhetoric. It is about providing a persuasive argument. This is how it is taught. The actual legal code is a way to formalize parts of it, but increasingly I see people angrily insisting that the only thing that matters is the text.

As you might imagine, I find textualism a load of applesauce, but I don’t think the vast majority of people making this argument even understand textualism as jurisprudence. It seems to stem from Crypto bros and the whole “code is law” argument which is just codswallop.

Older »