News for hackers. Stuff that matters.

SignalsFromBob

Re:There isn't an easy exploit for this PHP vulnerability on Thursday October 22, 2026 @03:55AM (#50192488)
The video looks like it's making this whole thing out to be a joke. Everything about it conveys a lack of seriousness. The dancing cartoon character, the ascii art, the music, the whiz-bang visual effects that obscure anything interesting or useful.
Yes, although resources might be a better word than tools in that case. If I'm at the library and I'm asking the librarian to help me locate some information, they are definitely an educated resource that I'm using. The same for interacting with any other person who is an expert whose opinion or advice I'm seeking.
The author is making the same mistake that they're claiming other news outlets have made. They're placing too much responsibility on the AI chatbot rather than the end-user.

The problem that needs correcting is educating the end-user. That's where the fix needs to happen. Yet again people are using a new technology and assuming that everything it provides is correct. Just because it's in a book, or on TV or the radio, doesn't mean that it's true or accurate. Just because you read something on the Internet doesn't mean it's true. Likewise, just because an AI chatbot said something doesn't mean it's true.

It's unfortunate that the young man mentioned in the article found a way to reinforce his delusions with AI. He just as easily could've found that reinforement in a book, a youtube video, or a song whose lyrics he thought were speaking directly to him and commanding him to do something.

These tools aren't perfect. Should AI provide more accurate output? Of course. We're in the early days of AI and over time these tools will converge towards correctness. There should also be more prominent warnings that the AI output may not be accurate. Like another poster said, the AI mathematically assembles sentences. It's up to the end-user to figure out if the result makes sense, integrate it with other information and assess it for accuracy.

Sentences such as "Tech companies have every incentive to encourage this confusion" only serve to reinforce the idea that end-users shouldn't need to think and everything should be handed to us perfect and without fault. I've never seen anyone involved with AI make that claim, yet people write article after article bashing on AI companies as if we were promised a tool without fault. It's getting tiresome.

This is why I dislike the word "hallucination" when AI outputs something strange. It anthropomorphizes the program. It's not a hallucination. It's an error.
Re:Ask HN: one-liner 'Kill Process by Name' – Bash Scriptable on Tuesday November 09, 2021 @03:41AM (#29159168)
Use pkill.
Re:Not being an asshole will make you more money on Friday March 06, 2020 @03:49PM (#22507178)
I hope you cut that client lose. If they'll do something like that on the POC they'll do it on the big contract and in numerous other ways. You'll have to double-check everything with a client like that and not be able to trust them. Life's too short to put up with that.
Re:Google's ambitious push into gaming is floundering on Monday March 02, 2020 @02:02AM (#22462301)
Google Maps was also an acquisition. https://en.wikipedia.org/wiki/Google_Maps#Acquisitions
I feel that we've done ourselves a disservice by referring to them as ad blockers rather than content blockers or, better yet, virus blockers. With malicious ads being the primary vector for compromising a person's computer, calling these tools virus blockers would not only be more accurate, but it would make it harder for sites to counter their use from a public relations point of view.

Could you imagine visiting a web site only to have it tell you to disable your virus blocker to view the web page? Yet, web sites make the same requests of your "ad blocker" even though the end result is the same. They want you to disable your security protections and risk infection to view a web page.[1]

Sadly, I believe we've already lost this battle and are worse off for it.

1. https://www.networkworld.com/article/3021113/forbes-malware-...

Re:Five Years of Btrfs on Tuesday January 28, 2020 @08:07PM (#22176092)
> The ZFS on Linux project gets around this restriction by running ZFS in user space

ZFS on Linux is a kernel module. You may be thinking of ZFS-FUSE which runs in user space using FUSE, but I'm not sure if it's being maintained any more.

Re:Persistant SSH Threats? on Thursday January 23, 2020 @03:07PM (#22131323)
Yes, it's normal. Just people scanning for SSH ports to attack.

What I did was take the IANA IPv4 address space list[1] and add firewall rules to drop packets to port 22 coming from /8's that I would never connect from. I'm in the US, so it made sense for me to drop connections from subnets assigned to RIPE, APNIC, etc. It didn't eliminate the problem, but it reduced the connection attempts considerably.

1. https://www.iana.org/assignments/ipv4-address-space/ipv4-add...

Re:The Y2K bug is back, causing headaches for developers again on Wednesday January 15, 2020 @12:20PM (#22056093)
I appreciate all you do as a moderator to fend off obvious trolls and griefers. I'm sure it must be a thankless job. However, I feel that your comment is not helpful or constructive. People have legitimate reasons for not wanting to create too long of an online trail so they can remain anonymous. That's okay. If their comments are "actually pretty good" then that's good enough; The user name that's attached is irrelevant. They are contributing value to the site.

Guidelines such as "throwaway accounts are ok for sensitive information, but please don't create accounts routinely" are naive. Non-sensitive information can reveal sensitive things when aggregated. We've all read articles about how anonymized data sets can still contain enough data to identify, or come close to identifying, individuals. I'm sure a number of those articles have been linked to from this web site. Practicing user account rotation is a useful tool for mitigating such risks.

Maybe it's time to rethink this particular site guideline. Let's not throw out the baby with the bathwater when it comes to users making contributions to the site.

Re:Show HN: I made a journal app for Founders and Makers on Thursday January 09, 2020 @08:02PM (#22007579)
Please forgive the off topic question, but why is your user name on hacker news shown in color? I've never seen that before.
Re:Linus: Don't Use ZFS on Thursday January 09, 2020 @06:13PM (#22006888)
Sure it is. Quiesce your application, take a snapshot, then resume application. Then you can back up the snapshot. The alternative can be a lengthy downtime for your application.
Re:Removing the Linux /dev/random blocking pool on Tuesday January 07, 2020 @06:39PM (#21986517)
Are hardware RNGs, such as the ones that plug into a USB port, of any value when the RNG in Linux is good enough for generating GPG keys? I'm wondering what the use case is for people that buy them.
Re:A harassment campaign on Goodreads on Monday January 06, 2020 @07:22PM (#21975241)
Instagram is another site with this problem. Someone supplied my email address when creating an account in late 2018. I only know this because I started receiving emails to confirm my email address. Then I started to get a bunch of emails telling me about new posts from other users. Gmail account history only showed logins from my browser and IP address, so I don't believe my account was compromised.

I finally got tired of the emails, so I told the site I forgot the password, changed the password to something long and random, then deleted all the content. I remember having to do something unusual to delete the content, like spoof my useragent to pretend to be a mobile device, or something like that. I've never used Instagram before or since, but it really annoyed me that I have a problem due to their lax controls.

Instagram never should have activated the account and allowed any activity until the email address was verified, which I never did. If a big site like Instagram can't get this right, it doesn't surprise me that a small site like Goodreads can't either.

Re:You might literally be buying trash on Amazon on Tuesday December 17, 2019 @04:57PM (#21819377)
They aren't that great for books anymore, either. They've starting shipping books in a padded envelope that don't do much to protect the book. I've ordered a number of books that have arrived all beat up. Not a big deal for a cheap novel that I'm going to read and then give away, or a school textbook that I don't care about beyond the class.

However, the last book I ordered from them was Python in a Nutshell about a year ago. It's an expensive book, so I was less willing to tolerate damage to a $50 book that I want to keep and use a lot. I had to return it twice to get one that wasn't beat all to hell. And even then I feel like I settled for something not in as good condition as I expected.

Amazon used to put books between two pieces of cardboard, shrinkwrap it, then put it in a box with padding. Books always arrived in good condition. Books in the padded envelope always arrive with crushed corners, and sometimes damage to the cover.

Re:You might literally be buying trash on Amazon on Tuesday December 17, 2019 @03:54PM (#21818715)
> Is it worthwhile to 'counterfeit' cat food?

Let me direct you to https://en.wikipedia.org/wiki/2008_Chinese_milk_scandal.

If people are willing to poison milk with melanine to make a dollar, why wouldn't someone do the same to cat food? In fact, it's already happened: https://en.wikipedia.org/wiki/2007_pet_food_recalls

Re:It’s crunch time for Getty Images, and for photographers on Wednesday December 04, 2019 @06:33PM (#21708338)
This has changed. It's hard to tell they're fake. For example, each reload of https://thispersondoesnotexist.com/ produces a new computer-generated image of a person.
Re:Why Is the Migration to Python 3 Taking So Long? on Thursday November 14, 2019 @03:27PM (#21539058)
I suspect that someone, or a group of people, will step up to unofficially maintain Python 2 for the foreseeable future. It's clear that there are a lot of people using it that either can't easily migrate or are unwilling to do so for the various reasons already discussed in this thread.
Re:Taking too much slack out of the rubber band on Monday November 11, 2019 @04:46PM (#21509238)
My employer has Chrome configured to prevent installation of extensions.
Re:How Ambient Chill Became the New Silence on Monday November 11, 2019 @03:43PM (#21508689)
I look forward to the day that society treats combating noise pollution with the same level of seriousness as combating other types of pollution. It appears that day is still far off.
Re:The manager’s schedule is holding remote work back on Monday November 04, 2019 @06:15PM (#21447756)
Then the people that downvoted should provide a correction. I still don't know what IC is supposed to stand for. I'm assuming it's not integrated circuit which is what I think about when I see IC.
Re:Efficient string copying and concatenation in C on Thursday September 12, 2019 @05:09PM (#20956493)
That web page's color choices have made it very difficult to read. I don't know who thought putting light grey text on white was a good idea. I had to copy and paste the text to a text editor in order to read it.
Re:Tmux-xpanes: tmux-based terminal divider on Thursday September 05, 2019 @04:34PM (#20890423)
This reminds me of ClusterSSH, although I think I would rather use ClusterSSH since it will tile a bunch of xterms across all of my monitors and let me point to click to address just one if needed. But, still, this is pretty cool.
Re:Useless Windows 10 Features on Monday August 26, 2019 @08:25PM (#20805083)
Wait, what? There are ads in the OS? That's insane.
ABCs? I don't understand. What does that mean?
Don't forget about your local library. I subscribe to Netflix, but I watch more movies and shows that I get on DVD and bluray from my library than I watch stuff on Netflix.
Re:YAML: Probably not so great after all on Thursday August 22, 2019 @10:22AM (#20768361)
> As an ansible user, I hate YAML and its broken parsers with a passion

Could you elaborate on this? I use Ansible daily and I've never had a problem with YAML once I took some time to understand it. What do you mean by broken parsers? I'm assuming that's something Ansible specific you are referring to.

Re:YAML: Probably not so great after all on Thursday August 22, 2019 @10:20AM (#20768338)
> DDL spec decides that it has label that evaluates a command

This is simply wrong. There is nothing in the spec stating that.

Re:YAML: Probably not so great after all on Thursday August 22, 2019 @10:18AM (#20768326)
That's because there's nothing in the spec stating anything about execution. The parent is simply incorrect. That's why they haven't responded.

Older »