News for hackers. Stuff that matters.

ShowalkKama

Re:CorridorKey 2.0 on Monday October 26, 2026 @06:47PM (#50252232)
it's already open source, only the plugins are paid.
Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming on Tuesday October 20, 2026 @05:56PM (#50173241)
I even double checked, I'm so blind.
Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming on Tuesday October 20, 2026 @05:38PM (#50173055)
Those CVEs refer to vulnerabilities in wordpress plugins (not php) and the vulnerabilities are not RCEs.

Am I missing something?

https://nvd.nist.gov/vuln/detail/cve-2026-9618 https://nvd.nist.gov/vuln/detail/cve-2026-9619

Re:OpenCode Hacked: User credentials leaked on Saturday October 17, 2026 @02:57PM (#50133948)
The title should say "OpenCode Console" not "OpenCode".
>Would a reasonable jury determine this to be Attempted Second-degree Murder?

would you?

I would certainly consider him guilty, if not of exactly that crime.

Re:Someone on Torrent Sites Kept Fucking with My Sonarr on Thursday October 15, 2026 @05:52PM (#50110896)
Joining private trackers is hard only if you are trying to join the niche ones which is totally unnecessary if you are trying to watch relatively recent and popular movies.

Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with more seeders and better tagged content so your "4k" download will never be 480p again)

Re:FBI Probes Service Selling 153M+ Drivers Licenses on Wednesday September 02, 2026 @07:59AM (#49534980)
Italy doesn't have crypto keys (as the average person would just lose/leak them) but they offer SSO login with the ID card. Basically whenever you need to verify your identity you pick "sign in with CIEid", you get redirected to a goverment website where you can authenticate (typically by scanning a qr code + scanning your physical id card on your phone) and then you approve/deny the authentication request (you can also clearly see which data is shared (name, last name, dob, etc)).

it's stupid easy to setup, the app is not overly bloated and it has different options to authenticate.

>If you want a robot to do your chores

you mean like a dishwasher or a washing machine?

>I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content".

that's a false dichotomy since piracy exists. Stop giving them money until their behavior changes. If it doesn't... oh well, you still get a better service.

I may be silly but why would you ever want to validate the structure of an opaque authentication key? Couldn't you just hit an harmless endpoint (e.g. /rate_limit) to see if it returns 401 or not?
Kiwifarms back in 2022: https://news.ycombinator.com/item?id=32706673

"Our decision today was that the risk created by the content could not be dealt with in a timely enough matter by the traditional rule of law systems."

because unless they are remarkably stupid they didn't pay with their own credit card. That doesn't mean that the information is necessarily useless but I'd not expect them to kick a door down any time soon.

(Moreover since cloudflare has a free tier you could use their service while handing over only a single email)

to """"""""""prevent piracy""""""""""
you can already gather the same information by searching online.

Do you want to know how to kill yourself? forums are for nerds. Here is wikipedia: https://en.wikipedia.org/wiki/Suicide_methods#List

Do you want to make a bomb? the first thing that came to my mind is a pressure cooker (due to news coverage). Searching "bomb with pressure cooker" yields a wikipedia article, skimming it randomly my eyes read "Step-by-step instructions for making pressure cooker bombs were published in an article titled "Make a Bomb in the Kitchen of Your Mom" in the Al-Qaeda-linked Inspire magazine in the summer of 2010, by "The AQ chef"." Searching for a mirror of the magazine we can find https://imgur.com/a/excerpts-from-inspire-magazine-issue-1-3... which has a screenshot of the instruction page. Now we can use the words in those screenshots to search for a complete issue. Here are a couple of interesting PDFs: - https://archive.org/details/Fabrica.2013/Fabrica_arabe/page/... - https://www.aclu.org/wp-content/uploads/legal-documents/25._...

the second one is quite interesting, it's some sort of legal document for nerds but from page 26 on it has what appears to be a full copy of the jihadist magazine. Remarkable exhibit.

What else do you want to know? How to make drugs? you need a watering can and a pot if you want to grow weed. want the more exotic stuff? You can find guides on reddit.

Do you also want to know how to be racist? Here are some slurs, indexed by target audience, ready for use: https://en.wikipedia.org/wiki/List_of_ethnic_slurs

>There's literally no reason whatsoever to hide the metadata unless he is the one.

privacy?

Re:Women were never meant to give birth on their backs on Monday April 06, 2026 @12:58PM (#47663555)
knowing and thinking / assuming are two different things. Saying that "that's why people have done it" is simply and categorically wrong.

It is no doubt something that could prove interesting if shared when presenting the research (e.g. I went down this route, find this weird thing here, that unusual story there) but this article does accompany you through that process, it just presents the findings which makes the inclusion of this fact quite questionable.

Re:Talk like caveman on Sunday April 05, 2026 @08:09AM (#47648543)
the fact that more tokens = more smart should be expected given cot / thinking / other techniques that increase the model accuracy by using more tokens.

Did you test that ""caveman mode"" has similar performance to the ""normal"" model?

Re:Gone (Almost) Phishin' on Thursday April 02, 2026 @09:26AM (#47614182)
step 1) use a password mamager step 2) forget your own password step 3) witness the password mamager NOT autofill on phishing sites
Re:Swappa.com for GrapheneOS compatible devices – Stay Away on Wednesday April 01, 2026 @07:47PM (#47608171)
>I don't care about google pay/wallet

and if you did you could use curve pay instead. Basically the same thing with more features, the only catch is that they charge FX fees after surpassing a limit (but that can be mitigated by paying with the same currency of your linked card, thus never executing a change in the first place)

you can get a seedbox with 1T of storage for about 6€/month. That gives you access to basically all popular movies and tv series in 4k, most media in 1080p and spotty access to older/niche releases you'd not be able to watch on mainstream streaming platforms.
https://www.pornhub.com/blog/age-verification-in-the-news

Over the past year, Pornhub had to make the difficult decision to block access to users in the following American states due to Age Verification laws:

    Alabama
    Arizona
    Arkansas
    Florida
    Georgia
    Idaho
    Indiana
    Kansas
    Kentucky
    Mississippi
    Missouri
    Montana
    Nebraska
    North Carolina
    North Dakota
    Oklahoma
    South Carolina
    South Dakota
    Tennessee
    Texas
    Utah
    Virginia
    Wyoming
> You can use them for whatever protocol you want.

the two most commons protocols used for proxying traffic support arbitrary tcp traffic. socks is quite self explanatory but http is not limited to https either!

Of course most providers might block non https traffic by doing DPI or (more realistically) refusing to proxy ports other than 80/443 but nothing is inherent to the protocol.

edit: this is also mentioned on MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

> Aside from enabling secure access to websites behind proxies, a HTTP tunnel provides a way to allow traffic that would otherwise be restricted (SSH or FTP) over the HTTP(S) protocol.

> If you are running a proxy that supports CONNECT, restrict its use to a set of known ports or a configurable list of safe request targets

> A loosely-configured proxy may be abused to forward traffic such as SMTP to relay spam email, for example.

under the doctrine that software "trust" is needed YOU are the attacker. It's entirely about stripping your control (thus ownership) from the hardware you paid for (see the safetynet shitshow).
wer impact?

Just because you have root it doesn't mean it's a vulnerability. Can he read the data of other customers? Can he interact with the internal network? Do you want to know how you can get code execution on microsoft's servers? Easy, go to github and spin up a github action.

The SSRF section does NOT prove SSRF, just because you can make a server interact with attacker supplied urls it doesn't automatically mean it can reach internal things and it does not automatically mean it's exploitable, far from it.

The user location leak is also not a leak since it's fair to assume that the user already knows his own physical location. It'd be interesting if there was a way to reveal the location of other users but alas that isn't mentioned, let alone proved.

Uber could ask for it but the customer does not have more information
No, that's a question. I imagine it's not that since the rest of my comment is dedicated to pointing out how that'd be racist. I was trying to make you explain what exactly the difference is since you didn't clearly define it in your reply.
Re:Why payment fees matter more than you think on Monday March 09, 2026 @04:30PM (#47315030)
If the payment method is skimmer resistant then they cannot use my payment method...

Also my entire point is that I don't need a card, paying with an app would be acceptable.

>If someone is presenting themselves to you in person for entry into your bar, you have far more information to make a judgement on than the color of their skin... so it is not the same.

So the difference between "good" discrimination and "bad" discrimination is the amount of information on which the decision is based upon?

Logically then uber could add a "white only" option, "no queer" and "no leftist". (of course this is arbitrary but you can easily come up with a reason why: if you split any group of real people in two it's only natural that one group has an higher incidence of a negative trait)

This also has a second problem: what if we let the passenger know not only the sex but also if the driver ate fish in the morning (and hundreds of other useless facts)? Does that make it discrimination because they have far more information?

I guess not but then how do you decide what information is valuable in order to decide if there is enough information to judge the individual instead of going off statistics? How can you say that our theoretical racist patron is in fact racist and not going off the only valuable information?

the fact that skin color can be a proxy for socioeconomic factors does not change the statistics. Do you investigate why a rapist has raped someone and then ignore it if the reason is socioeconomic factors?

If applying your logic on skin color leads to discrimination then maybe it's discrimination even when the discriminated party is males.

> Allowing women to make a selection based on this likelihood means that female customers that are alone can make choices to still use the service while reducing the overall risk.

I'm failing to see how anything you say could be used as a guideline to pick between "good" discrimination and "bad" discrimination. The major distinction you draw between "Type II" and "Type I" is the fact that one is fueled by "arbitrary aversion" which is not a particularly useful distinction.

What if I denied entry to black people from my bar because ""they commit more crimes"" and ""are more likely to break stuff"", is it morally ok? Why not? My opinion is that no, it's not ok because the majority of people punished were never going to behave in an uncivil way.

The same logic can be easily applied to this situation. Are men more likely to behave sexually inappropriately (which ranges from verbal harassment to assault)? Sure. Is it the majority? Hell no, it's nowhere close.

(Of course it's worth nothing that the "majority" does not necessarily have 50.01%, it's just an arbitrary line you can draw as long as you are consistent about it)

Older »