News for hackers. Stuff that matters.

Helmut10001

Re:Malware uses LLMs to rank victims by how much they're worth on Saturday October 31, 2026 @03:17PM (#50319153)
Usw VMs and isolate them according to separation of concerns. Same with mobile phones. Nix OS is also a good idea.
Re:Is this the new cyber normal? on Friday October 23, 2026 @08:09AM (#50207688)
It is not just code, it is also deploying Software. I constantly have to correct or steer the 'ai' in conversations towards safer directions or better following even the most basic security practices. Here I feel it is still more the overambitious intern that needs to be carefully overseen, but has a lot of time and energy at hand.
Re:Quad9 (DNS Resolver) to Exit France on Thursday October 22, 2026 @01:12PM (#50198236)
> The French courts have fundamentally misunderstood the working of the internet and the role of the domain name system

I think thus is the real problem. And you can easily replace France with Germany or US here.

There's no need for GUI based apps linke these anymore: RevealJS, Typst, Grist. They are CI&CD native and give you infinite reproducibility.
Re:An agent used DNS to reach an external chatbot on Sunday September 27, 2026 @05:07AM (#49864800)
I don't know. You can poison a prompt with less than <1% of its input or RAG-Token-Content. Anything that the Agents retrieved or viewed could have included instructions that they misinterpreted allowing them to hack into something.
Yeah, Germany is different here. I am not 100% sure, but in Germany it is allowed if you are not focusing on any particular individual person. It is difficult to argue in absolute terms, which is why most consider public photos forbidden completely (unless for private/personal, very narrow use). Nowadays, in Germany, it has helped me to consider everything forbidden, unless it is explicitly allowed somewhere.
Re:I don't want to read what you didn't write on Tuesday September 22, 2026 @12:33AM (#49796817)
I agree. But there's still a valid use here for LLMs: If I have 1 Million bits of information and I want to communicate a synthesis of 500 bits to you, LLMs can be a viable helper. It is rarely done that way - I agree, but the way I use LLMs: Drop in all the relevant context information (PDFs, HTML, Markdown, Pictures etc. - up to usually 200-300k tokens), then compile a synthesis/summary prompt (usually 1-2 A4 pages of handwritten text. Then copy the output (1-2 A4 Pages), manually edit and send off (often, including an archive of the full original conversation, so the human on the other side can consult the unfiltered original prompt + inferencing, if wanted).

In other words: If I didn't reduce the 500 pages of text for you, you wouldn't know what I mean or what is relevant, or how to filter it yourself.

If there is no business model and no one wants to pay, what then? We'd have a lot of vacant properties that would need to be renovated by the city. We see this in lots of places in Germany already, where there simply aren't buyers (because of demographics, primarily). Further, if you devalue properties with such a law, then you'd have a credit/dept property - landlords couldn't pay their dept, if property prices devalue by state law. Lastly, no one would build properties anymore under such a law.

.. Cities also rely quite a bit on property and real estate transfer taxes. By reducing property values, cities destroy their own tax base while needing lots of additional money to renovate state-acquired, vacant properties.

Such a law existed in San Francisco since 2022 and it was just cancelled by court order. The problem is: there are so many edge cases for empty apartments that it is impossible to account for. In Berlin, e.g., just imagine all the empty apartments in 10 years because no one wants to rent unrenovated, uninsulated apartments because of energy prices. The landlord cannot pay renovation. Forcing landlords to pay an empty apartment penalty doesn't help here.
Re:Backups Aren't Simple on Thursday September 17, 2026 @01:19AM (#49736694)
I really like ZFS snapshots with offsite pull-mode sync using Jim Salter's sanoid/syncoid [1]. ZFS is the base for all OS/filesystems on top of it. If you have a good system for organizing ZFS datasets, and separating ephemeral from persistent data (e.g. [2]), then this is 90% of the backup requirements already fullfilled.

    [1]: https://github.com/jimsalterjrs/sanoid
    [2]: https://du.nkel.dev/blog/2026-05-16_rootless_docker_virtiofs_proxmox/
Re:Alternatives to MinIO for single-node local S3 on Tuesday September 15, 2026 @08:42AM (#49711673)
I run Scality S3 (Zenko Cloudserver in the blig) since about 2 years and it is quite capable and frequently updated. Just make sure to point it to the latest Github Registry, not the outdated Docker.com one.
Re:Writing a better reality: The case for optimistic sci-fi on Monday September 14, 2026 @02:23AM (#49692697)
I really liked Paradox (1: On the Brink of Eternity, 2: Beyond Eternity, 3: Eternity). It is foundationally positive and optimistic, yet still "realistic", as far as sci-fi goes. Also not much known on the US-side, as far as I know, which is unusual for good sci-fi.
Re:Pandas Should Go Extinct on Saturday September 12, 2026 @02:16AM (#49669425)
Data scientist here. I still use pandas. It is a work horse. But today, the progress in data science is much more in integrating sources and outputs. I find Grist (via API) and n8n much more applicable and process oriented than core DS pandas - although all of these components fit together somewhere. Most of the time, there is very little binding glue needed, e.g. a bash script or standard python file. DS is still fun, but it is much more process oriented today!
Re:We have a year to fix security everywhere on Tuesday September 08, 2026 @03:23AM (#49606709)
Yes, you are right and I agree, there's little empathy with non-coders generally.
Re:We have a year to fix security everywhere on Tuesday September 08, 2026 @02:21AM (#49606198)
Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.
I love immich! On board since June 2026. But, here's a brief report on my evening installation project.. setting up Immich: Ingesting a 1.7TB library (160k+ RAW photos) is apparently not a standard task!

- Thumbnails and ML vectors consumed hundreds of gigabytes. I had to move the library folder to a dedicated ZFS HDD (700GB currently).

- ImageMagick uses 20GB RAM per Nikon RAW file (this triggered the Linux OOM-killer)

- Container crashes filled the OS drive with 2GB _per_ core dump.

I added `ulimits: core: 0` to the `docker-compose.yml` to stop core dumps and increased VM RAM to 48GB. I also added the following `.env` tweaks:

    ```
    NODE_OPTIONS=--max-old-space-size=8192
    VIPS_DISC_THRESHOLD=750m
    VIPS_CONCURRENCY=1
    MAGICK_MEMORY_LIMIT=8G
    MAGICK_MAP_LIMIT=4G
    ```
Also, make sure to limit max logging size in `docker-compose.yml` - this alone cleared up 17GB of logs that were generated in just 4 hours for me:

    ```yaml
        logging:
          driver: "json-file"
          options:
            max-size: "10m"
            max-file: "3"
    ```
Then, setup offsite backups with sanoid/syncoid zfs snapshots in pull zero-trust-mode (next evening project :)
Re:My Business Is Dying on Friday August 28, 2026 @08:47AM (#49477765)
Really, upgrading in the background is not calm technology to me: Windows Upgrades almost daily and my PC slows down, Firefox upgrades in the background and my tabs become unresponsive daily. I prefer the apt-Linux approach, even Ansible, or chocolatey. Anyway, I am not surprised that there are different definitions of what calm means (no offense!).
Re:My Business Is Dying on Friday August 28, 2026 @05:15AM (#49476227)
This sounds all like Mark Weiser's "Calm Technology" from 20 years ago [1]. I can't await when that future arrives! (I also self-host and have zero subscriptions, except the Proxmox community license - which is, beyond all, a free choice)

[1]: https://calmtech.com/

Re:Tell HN: PayPal Blocks GrapheneOS on Thursday August 27, 2026 @09:21AM (#49464514)
Why do you need PayPal APP? I have grapheneos and just tested logging in to PayPal web. Works.
Re:How Europe is killing makers and micro-entrepreneurs on Monday August 24, 2026 @09:58AM (#49419876)
Living in Europe, I find that with LLMs, it is possible to navigate the federal & law jungle. However, LLMs don't protect you from institutional envy or the resistance of people trying to block progress simply because it is perceived as 'too modern' or disruptive. I find this the hardest challenge. And I have the feeling during times of general decline, like these, it gets worse.
Re:Ask HN: Alternatives to GitHub on Monday August 17, 2026 @10:44AM (#49331892)
Yes! And for those complaining that gitlab CE selfhosted is resource hungry: It can be tuned to only use 2 GB memory in total and run perfectly fine for a single developer or limited concurrency. Gitlab CI is awesome.
Re:Asus Bike Booster on Sunday August 16, 2026 @06:01AM (#49318557)
Yes, we already have this (Follow-Me - the swiss company). However, my 9yo and his bike is too heavy for that. I was able to carry/drag his bike from about 3y till about 6yo.
Re:Asus Bike Booster on Saturday August 15, 2026 @11:52PM (#49316739)
This would be great to add to my 9 year old's bike. We couldn't do long bike tours anymore because he would stop biking after 100m, telling is he is completely exhausted and must go home. I was looking for something like this!
You make it sound like there is a causality here. I would be careful. German GDP is declining for other reasons, not for their commitment to renwables. Also, by all measures, living in Germany still means you get one of the most comfortable, secure and free lives on earth. I wouldn't give up on Germany so fast. They still know how to work and often work, even if there is no reason to work (i.e looking at their current regulations, which rather motivate you to _not_ work).
I use local seedvault backup and then sync via round sync daily trigger to my Nextcloud WebDav Server (native seedvault was not able to use this, for some reason).
Re:Em dashes are fucking amazing on Friday July 24, 2026 @03:39PM (#49040677)
The best advice is often: Use a dot and start a new sentence. The best writers use very short sentences in a row and simple words. They flow easily and do not break reading. This works particularly well in science and for difficult topics.
I am very happy with Moonlight/Sunshine combo. Runs neatly on my RTX 4000 Pro GPU Server. The only thing I miss is automated resolution adjustment to connected Clients, but I was able to script this with Home Assistent Windows client.
Re:Migrating from Proxmox to NixOS and Incus on Thursday June 25, 2026 @11:07PM (#48681929)
I get your point and this is likely also not what you mean, but I am very happy with a simple git tracking approach that I use across Proxmoxes and VMs [1].

[1]: https://du.nkel.dev/blog/2026-05-16_rootless_docker_virtiofs...

Older ยป