News for hackers. Stuff that matters.

KingMachiavelli

I really wish building minimal, custom kernels was easier. NixOS makes it somewhat sane but it's still a mess of custom kconfig, defconfig target hacking, and manually splicing out the necessary firmware and kernel modules. The kernel doesn't even have an interface to show what firmware blobs have been loaded. You can do some firmware signature enforcement but I guess no one cares about random binary blobs are running just to work your laptop webcam.

It would be very useful if I could just boot a kernel and get an instant report of what kernel config, firmware and modules are actually used/needed. You can kind of do this but

Re:Why are car keys so expensive to replace? on Monday November 02, 2026 @08:32PM (#50346839)
Like others have said it's a revenue stream for the automotive company and the dealerships. The actual software/security side of car keys is "cat & mouse" game because automotive companies either outsourced the design or picked the cheapest/logistically easiest to implement.

The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.

It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.

If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.

212MB for MacOS and 25MB for Windows? Why are MacOS binaries so large? Is it typical for them to be 10x Windows binary size?

That said, I'm really looking forward to small and quick (latency wise) models are a reality. I can easily see a world where every keystroke, terminal command, etc. goes through a "autocorrect" type model. You could even blend natural language plus terminal program segments and the AI just infers what you intend. Either built-in or a second classifier model, determines if the autocorrect change needs human review first.

Re:Today, we hacked what we'd set out to hack: the iPhone on Friday October 23, 2026 @05:33PM (#50215679)
Crazy, you would think Apple would have already done AI-assisted vulnerability scans using the latest and most expensive models.

Absolutely crazy how PDF parsing and image rendering are still exploitable.

Re:Apple broke an essential presentation feature of iPads on Tuesday October 20, 2026 @01:33PM (#50169812)
Another stupid quirk is USB-C HDMI output sometimes outputs 4:3 mirroring of the iPad screen even when in a full screen video. If you reconnect and fiddle with pausing/playing the content while screen locked, you can “trick” it to use presentation mode at the screens native resolution.

Half the problem is flagship apps like HBO/Netflix don’t implement this correctly.

Oh and this is all different if you have a keyboard attachment because only then are you allowed to “extend” display which can use the screen’s native resolution.

While I disagree with lower property taxes and would advocate we switch to Land Value Taxes across the board.

I do agree that taxes in general should not be a fixed percentage that taxes people more just because valuations increased (be that land, property, tax).

We should instead have fixed taxation totals (pegged to local inflation) and just use property tax or land value taxes to establish the relative amount of tax between people/property.

If a housing shortage is causing increased costs for schools, local governments should say “Either vote for higher taxes to raise teacher wages or vote for denser housing so teachers can live here”. Instead taxes go up automatically, the money is spent on $X random shortfall.

People don’t care about cutting property taxes because local governments are historically and perceptually mismanaged so people assume that the roads and schools will decline regardless of higher or lower taxes.

Completely different architecture, but would be amazing if another device could control what message (or photo, embedded video) is displayed.

There's a huge industry around digital signage and I've always felt it could be replaced with a simple Chromium kiosk + auto-refreshed webpage content. There's really no need for expensive HDMI connections or custom video streams when we already have browsers.

Re:Federal judge calls Flock 'indiscriminate mass surveillance' on Saturday October 03, 2026 @06:41PM (#49948485)
That’s more like a therapeutic/occasional recreation dose and habitual users consume it multiple times a day.

A survey found that average daily consumption was 0.9g and median 0.35g.

92lb=41.73 kg = 41730g / 0.9g / 365 =127.032 average-user-years. Or basically a month’s supply for a small town.

Like most consumption, the top 10% easily account for >80% of total consumption.

All of this is nearly pointless unless the photo itself is in the barcode and also signed. You only need a leak of a few hundred real IDs to cover all of the identifiable characteristics (hair, eye, skin color, approx height and weight). Leak a few hundred thousand a year and now you can’t even flag leaked IDs without some false positives.

A fake photo plus a valid barcode will pass any current check right? Unless you still do a secondary proprietary photo lookup that I don’t think exists.

Re:AirPods 5 on Wednesday September 09, 2026 @04:32PM (#49633769)
Super annoyed they did not announce a new AirPods Pro or Apple TV. My NVIDIA Shield is getting a bit old (not really an issue unless I want to stream raw 90GB Blu-ray).

A bit strange for Apple to let fairly popular products just go so long without a refresh. Just the vision component of the new AirPods could have been delayed, not really a critical feature anyway.

Apple Watch seems to be getting pretty good, might finally switch away from Garmin if the Apple one is as durable.

Re:Show HN: Copperhead – Hardware as Fast as Software on Tuesday September 08, 2026 @03:09PM (#49615235)
Computationally what’s the difference between a human and an LLM besides scale and speed? Trained humans are still using heuristics and shortcuts. Just because these are subconscious and only possessed by talented, trained professionals doesn’t make the skill computationally special.
Not sure why people are latching on to this. I'm 95% sure the AI agent was not "trained" on this intellectual property but rather the IP was just analyzed and it's usage and details were recorded to the AI agents memory (typically markdown/JSON summary of previous sessions).

The defense IMO is just trying to muddy the waters between "irreversible AI training that updates weights" and "AI learning by just storing secrets in text files".

Even in the 5% chance this AI model actually was fine-tuned or fully-trained (i.e the weights were updated), the employee did this while employed at Apple and used Apple IP as the training data. Even if the output is under fair-use (because it's transformative), (1) any IP created while employed during work duties almost always belongs to your employer and (2) the act of accessing Apple's IP would be (trade secret or regular) theft if done outside normal work duties.

Re:Can Intel finally beat ARM on performance per Watt? on Saturday August 08, 2026 @06:13PM (#49226379)
Hmm, I'm using the CachyOS kernel but on NixOS. What CPU/GPU are you using?

I tried using the flatpak Chromium in case it was some NixOS build optimization oddities but didn't see much of a difference.

Re:Can Intel finally beat ARM on performance per Watt? on Saturday August 08, 2026 @04:30PM (#49225610)
A more accurate title is can Intel (Linux/Windows) beat Apple?

If you don't want to run Windows, is there even a choice? My issue now with the non-Apple computers if you want to run Linux it's really hard to predict how awful Chromium/Firefox will be. My work Dell Laptop is only a 3 year old CPU with integrated GPU (and unused Nvidia GPU) but Chromium and Firefox are both slow as shit just loading pages like Slack and Outlook. Even resizing the browser windows seems 4-5x times slower than my M3 Macbook Air.

Maybe this is strictly a Linux issue but it hardly matters when the Windows ecosystem is pretty stagnant, full of junk-ware, and software development is much, much better on Linux/MacOS.

Re:New cars are getting 1.2cm longer and 0.5cm taller each year on Wednesday August 05, 2026 @02:33AM (#49179296)
As much as I like to hate on larger cars. In reality, I use my SUV (3 row, Subaru Ascent) all the time for camping and outdoor activities (80% of weekends or so). I just took out the middle seats to build a full-size bed platform (75x45” or so).

My wife also drives a smaller Forester that we realize could have been an EV or hybrid. Although in CA, electricity is so expensive that it’s not much improvement over gas especially if you spend more on the car itself. Really, just a same model year but more fuel efficient sedan or one of those old 100-mile range EV cars is what you have to “downgrade” too.

Of course, it’s silly seeing all the oversized, sparkling clean massive trucks and SUVs on my commute while I’m driving my heavily scratched glorified minivan (since that’s what SUVs are now days).

Don’t many medications and medical devices contain microplastics either on purpose (fillers) or un-avoidable (plasticizers in IV tubing). Unless the FDA has an existing microplastics policy, it would be weird to inconsistently apply it.

Lots of dental stuff like Invisalign or even regular braces involve keeping plastic and adhesives in the mouth for long periods of time. I think even some gum (non-nicotine or otherwise) contain plastics technically.

Re:CarPlay Is Additive on Friday July 03, 2026 @02:49AM (#48771711)
In some states you no longer can interact with a phone at all unless mounted. Phone mounts kind of suck or you’ll be in a rental without your nice mount. A 15” screen is easier to read than a small phone bouncing on a mount.

If I’m spending $10K on something, I want the Android/iOS experience to be first-class instead of some shitty UI designed be people who I presume don’t drive cars.

Cars are otherwise fungible between brands. If one has CarPlay/Android Auto there is little reason to pick a brand that lacks support.

Window units can be added to basically any existing home. And like you said roofs are an option. France could afford AC with their relatively cheap power but it’s just culturally and politically unpopular despite heat related deaths being extremely high and loss productivity it’s certainly more than the cost to retrofit.
Re:Shrinking a NixOS ISO from 458 MiB to 183 MiB on Tuesday June 23, 2026 @11:26PM (#48654729)
> build an image from scratch with the packages you want

Using what? Using NixOS to configure a system is orthogonal to the system actually running the Nix binary. Nix/Nixpkgs provide well maintained package derivations and module configuration for the largest amount of software of any ecosystem. IMO it's far simpler than Yocto or Buildroot or the dozen OCI container builder ecosystems that go in and out of favor.

Err, the email list has like 13+ bad addresses? I get a lot of "Address not found" responses.
Re:Is it time for a new Embedded Linux build system? on Tuesday June 23, 2026 @02:52PM (#48649617)
Actually, quite an honest and in-depth review with many genuine good points about the state of Nix. If you genuinely need sub 1GB image sizes, you would have to reimplement many of the Nixpkgs conventions like glibc/systemd.

I’d still probably just implement this in Nix/Nixpkgs so I could leverage the rest of the ecosystem but that’s not trivial at all.

I wouldn’t even say Nix as a language is better than Starlark. The author is certainly well informed in the choices made.

Re:Is it time for a new Embedded Linux build system? on Tuesday June 23, 2026 @02:45PM (#48649503)
My toolchain for both is managed by the Nix derivation wrappers. It’s trivial to set custom C/C++/Rust/Go/NodeJS flags. As long as I have one flexible build tool, I can customize it for both server and embedded.
Re:Is it time for a new Embedded Linux build system? on Tuesday June 23, 2026 @02:41PM (#48649452)
IMO the nixos-rebuild scripts are unnecessary and just obscures what’s being built.

build-vm is the same as building the configs “config.system.build.vm” attribute.

nixos-rebuild is fine for getting started but you end up needing to use the attribute path to do anything more complicated like CI caching or inspecting the drvPath.

Re:Is it time for a new Embedded Linux build system? on Monday June 22, 2026 @09:30PM (#48639010)
What do you mean by image? In Nix you instantiate a NixOS system and specify the architecture. There are a number of tools to build a disk image from a NixOS system.

$ my-arm-system = nixpkgs.lib.nixosSystem { system = "aarch64-linux"; modules = [ ./configuration.nix ]; };

$ :b arm-system.config.system.build.images.iso

Re:Is it time for a new Embedded Linux build system? on Monday June 22, 2026 @09:26PM (#48638972)
Embedded just means ARM 99% of the time and it's cheaper and easier to use native ARM servers (AWS has them cheap) than to make 100% of software cross compile. Some parts of the firmware might need to be cross compiled but those projects are designed to cross compile.
Re:Is it time for a new Embedded Linux build system? on Monday June 22, 2026 @09:22PM (#48638934)
I've been using Nix for "embedded" systems for few years now and it works fine. I don't quite understand why "embedded" has historically meant learning a completely separate tool. I've been building for x86 and ARM servers for 5+ years now, so why should targeting an ARM board be any different?

Like the article points out, the software stacks people use for embedded devices are the same as people use non-embedded use; Rust, Go, NodeJS, and sure still C++. The only real difference with embedded devices is non-OS components like the bootloader (u-boot, EDK2) and customizing the device tree. (And of course firmware flashing). Fundamentally those are all just packages that I can describe in Nix. I don't need a separate tool just because the board is small.

IMO the embedded space, especially in the US, is already pretty Niche. Most companies either just ship the vendors BSP example (Ubuntu/Debian/Yocto) and pay very little attention to the detail or re-useablity. Once you vendor declares the BSP EOL you are stuck unless you re-implement it yourself.

Using Nix (or Guix) has the massive advantage of a large and active community that isn't fractured like the Yoctoo/Buildroot community. (By fractured I mean there may by many, many people using those tools at $DAYJOB but due to vendor BSP customization they likely share much less with the upstream community maintained sources).

Re:Did my old job only exist because of fraud? on Monday June 22, 2026 @01:46PM (#48633395)
Doesn't running consistent losses eventually cause tax issues with the IRS? If the losses are offsetting profit elsewhere, I would assume the IRS would become very interested in challenging the validity of the hobby business?
Sure but homeowners can literally have their cake and eat it too. Homeowners who like where they live and don’t want to sell are best served by scarcity.

Unfortunately that means they can play both cards, they can benefit from scarcity while pretending to be anti-gentrification. And they can claim any pro-housing group is actually “pro scary capitalist developer”.

Is there something systemic behind these frequent incidents with military aircraft? It is using old, legacy equipment? Is it due to using rushed, streamlined procedures designed for war-time even outside an active battle environment? Are there just many, many military flights daily so statistically one will be in the news every couple weeks?

IMO the danger to US service members outside of combat seems way too high. It's a well known fact most fatalities occur during training than during combat. (Sure this due to there being many more training exercises than active combat engagements but from a policy perspective it is very worrying).

https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

Assuming they would not have liquidated it earlier (perhaps via some semi-legal instrument) to cover past or future bad decisions. Crypto certainly isn’t doing well now.

The 7.84% state would probably be significantly diluted over this time frame so 4-5% is probably a more accurate estimate but perhaps high estimate.

Older »