News for hackers. Stuff that matters.

SXX

Re:AI Isn't Replacing SREs. It's Deskilling Them on Friday October 30, 2026 @01:45PM (#50307515)
Obviius fix:

AI Isn't Replacing SREs. It's Destilling Them.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Thursday October 29, 2026 @08:40PM (#50298419)
That's classic, but whole point with Monero is that no one cant really tell who sent money and who get them.

It doesnt exactly solve on-ramp / off-ramp, but it hides very well how much you actually have in total.

With nornal crypto you create direct track from a CEX to every place where you spend the money.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Thursday October 29, 2026 @08:30PM (#50298313)
Cryptocurrencies that are transparent to government tracking are also transparent to whatever criminals want to beat you up and take everything from you.

Your usual non-crypto millinare likely have less money to steal on them than average grandma. Fiat millionare likely have two credit cards and $100 in a pocket. Or useless iPhone with Apple pay. So there is zero profit in trying to rob fiat millionare or billionare and tons of downsides.

And moving any amounts of transparent crypto over $100,000 just paints huge "rob me" target on your person.

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Thursday October 29, 2026 @08:10PM (#50298117)
It work exactly same way as debt collection agencies work: banks sell them bad debt for cents on dollar. Then they try to get more money out of debtors.

Imagine someone offered you to buy $1,000,000 of that dirty money for $100,000? $10,000? $1,000?

At some point there will be people who would buy it and deal with money laundering.

You dont interact with anyone. You just set your own hotspot and people will connect to it.
Re:Apple introduces the new 14‑inch MacBook Pro with M6 on Tuesday October 27, 2026 @05:40PM (#50266237)
Quite messy and wonky as in Linus Tech Tips testing. Require plugging displays in right order to get desired resolution / refresh rate.
Re:Genie 4 on Tuesday October 27, 2026 @05:10PM (#50265851)
Surprising how Tencent's HY-World 2.0 open weights world model didn't get as much attention:

https://github.com/Tencent-Hunyuan/HY-World-2.0

Re:Kimi K3.1 Pro and K3.1 Pro Highspeed on Friday October 23, 2026 @01:30PM (#50212525)
It's not like US companies spend trillions on training itself.

Mostly it's datacenter build out and circular financing magic when the same dollars being commited multiple times by multiple companies passing hot potato to each other. They basically commit capacities 2-3 years ahead.

Not a country, but it's free in Belgrade, Serbia for last two years.

Due to weird goverbnment statistics and unaccounted expats officially it's 1.1M to 1.6M of people, but actually there likely well over 2M people living there.

Public transport is pretty good there and it cost their budget $300M-$400M a year.

Re:There isn't an easy exploit for this PHP vulnerability on Thursday October 22, 2026 @09:29AM (#50195050)
That's not what CGI is. CGI is just mode of operation where full php process being spawned on each request and then killed. It's kind a less prone to security actually because no memory or state is reused ever.

But yeah since it's inefficient I doubt it used much after 2010 when php-fpm matured and nginx got popular.

Re:There isn't an easy exploit for this PHP vulnerability on Thursday October 22, 2026 @05:42AM (#50193229)
IDK why someone flagged your reply, but basically your list shows that since 2015 there been practically no security issues that can really be exploited in default configuration.

10 years like thid seem pretty stellar for me considering half of internet runs on PHP.

Re:There isn't an easy exploit for this PHP vulnerability on Wednesday October 21, 2026 @11:16PM (#50190738)
> The difference is that PHP has a long history of vulnerabilities while platforms like Java don't.

Some software written in PHP has a long history like that.

PHP itself mostly dont. Tbh runtime itself has fairly stellar track record on security considering it written in C.

CCP is shit and bans tons of stuff, but this is not how it happened:

> Or when Xi told Trump, “no thanks” to buying NVidia cards

US banned sales of high-end compute tech to China for years. Now when they actually catching up on production of their own SSDs, DRAM and compute silicon they no longer need US offers.

The S in loT Stands for Security
Re:Show HN: WhatsApp MCP running free on Cloudflare on Sunday October 18, 2026 @10:32PM (#50147717)
WhatsApp obviously more encrypted than Telegram since later have no proper E2EE whatsorver by default and also sync all history from server.

Its still preferable to use Signal since now it actually supports numberless registration. Hopefully they will actually fee payable not via credit card at some point.

Reddit already hides 18+ content for UK IPs unless you show them your passport.
Finally after decades of struggle and hot potatoing between parties UK government found a way to fix the country. /s

I guess they should next ban depiction of hanging government officials on a trees and lamp stands. Otherwise population might get some wrong ideas.

Robin Hood movies shall all be banned for sure.

Re:Major ICQ security hole (1998) on Friday October 16, 2026 @03:29AM (#50115273)
CVE-2012-2122: A Tragically Comedic Security Flaw in MySQL

https://www.rapid7.com/blog/post/2012/06/11/cve-2012-2122-a-...

> ... Since the authentication protocol generates a different hash each time this comparison is done, there is a 1 in 256 chance that ANY password would be accepted for authentication. ...

I wouldnt mind Epic if their platform wasn't so intentionally anti-consumer. I dont have any issues with Epic other products - I dont play Fortnite, but Unreal was net positive for gamedev and Epic also sponsored a lot of open sourcr software including Godot which is nice of them.

Unfortunately literally everything is wrong with EGS specifically.

Their stance on intentionally not having user reviews because consumers shouldn't have power to react to publisher or developers decisions.

Their giving away games for free and then revoking licenses then removing them from accounts even though it was purely their own fault. They were most successful company ever back then and could certainly eat that loss.

Their shitty account system that certainly got hacked multiple times because it's the only gaming platform where someone constantly trying to access my accounts even though I'm Linux and cybersecurity nerd with random 32-char passwords. They also dont have straightforward way to change account region without trying to deal with their shitty support.

Tim Sweeney decided to make a platform to fuck over gamers and we gamers returned favour.

Valve have my trust just by being privately held company that can actually plan for decades ahead instead of try to appease major shareholders or black rock.

It took them 10 years to make Linux a competetive gaming platform.

They invested in VR early and still do a lot for this niche market.

They brought back hanfheld PC from being niche chinese devices to being mainstrean and maintain support for Steam Deck for 5 years.

As game developer I do find 30% cut abysmal, but it's not any worse than consoles and I dont like Epic as a gamer for being awfully anti-consumer. I certainly dont want PC game market to be controlled by chinese Tencent subsidiaries.

Re:Gemini 4 Argon on Tuesday October 13, 2026 @01:43PM (#50075673)
Now when another uninteresting frotier model been released Google can finally start doing what we actually waiting for:

Start preparing Gemma 5 release.

Re:GLM-Legal: Advancing Agentic Legal Intelligence on Tuesday October 13, 2026 @12:57AM (#50066907)
There are a lot of bad things you can say about China that gonna be true, but it's not well known for running scam call centers - quite opposite.

Authoritorian state with highly controlled internet and financial system isnt exactly a good place for running criminal enterprises.

There just 1.4 billions people in a country and many of them well educated and tech-savvy, so it obvious there just more scammers in total. But I doubt higher percent of population doing scams than average in the world.

Re:GLM-Legal: Advancing Agentic Legal Intelligence on Tuesday October 13, 2026 @12:37AM (#50066790)
Once chinese models will stop being open we can all stop using them. There is no moat and switching models take 10 seconds.
Re:Making big downloads resumable in Firefox on Monday October 12, 2026 @07:25PM (#50064469)
That website reminds me of US Robotics Courier 56K :-)
Re:Yandex bot traffic down 99% after data center attack on Monday October 12, 2026 @11:47AM (#50058134)
> hosting in Russia is actually a lot cheaper.

I'd say you never checked Yandex.Cloud pricing. That's just not true - it's not cheaper.

All the countries have rules about it. Except if your credentials been compromised it can take weeks before you find out that money gone from your account.
Re:Yandex bot traffic down 99% after data center attack on Monday October 12, 2026 @08:26AM (#50055406)
Why on earth would they host orchestrating applications in Russia? AWS, Hetzner, DigitalOcesn work just fine.

In Russia it's higher latency, way more expensive and there are lots of connectivity issues. Its not like Russia have ministry of social network botting that require to host it within country.

Reason why these bot networks are effective and hard to find is because it's not some "KGB" minister respobsibility.

Botnets, malware, botting in Russia is someone small criminal enterprises with a lot of people doing it independently. They might be affilated to government or not at all - might be they just sell services to highest bidder.

Very often this is not the case. Debit / credit cards payments are quite reversible, but once a person send $100,000 or even $10,000 to a scammer it can be quite hard to recover.
Re:Yandex bot traffic down 99% after data center attack on Monday October 12, 2026 @02:44AM (#50052236)
I hope at least fellow IT people can recognize that "social media bots" are not running on Yandex datacenters neither they have IP adresses from Russia.

This is just not how social media botting works. If you try to "bot" facebook, instagram or any major social network via browser from datacenter IP let alone ones from Russia you'll soon get all your accounts banned.

Social media are botted via apps on mobile phones set in large farms; read: thousands of mobile devices. They either jailbroken or have some advance automation.

Neither they use Russian IP. Instead they go for residential proxies kindly provided by Israeli firms where bandwidth cost a leg, but it worth it. Or they just use their own botnets instead.

Older »