TekMol

There is a strong indicator that this is true:

There is no news about hacked websites due to this vulnerability.

If anyone could ask Claude for an exploit, one would expect a lot of PHP sites to be hacked just for the fun of it, right? Like putting a message on some popular website or something.

This is about the code itself. Not about the availability.

Can it really take over 10k additional lines to fix a pointer issue bug like this, where the problem is that the code uses memory that it has freed already?

I wished they had put the tests in a commit on their own so it would be immediately clear how large the patch itself is.

Why is the description of "RCE via OOM corruption" mentioning all these settings like memory_limit, post_max_size, max_input_nesting_level etc under "Mitigation" but not blocking multipart requests? Isn't that a solution?

The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?

I have not seen confirmation that the exploit is for the bug that is going to be patched.

It seems the published exploit can be easily prevented by filtering out multipart post requests. So people actively watching the situation can already prevent that issue by filtering those.

Many here call for an earlier release of the patch.

But it is not clear if releasing the fix early would make the damage smaller or larger.

Having the patch probably makes creating an exploit easier. So the number of attacks would increase.

There is no way to coordinate the whole world on an earlier time. I would guess the number of people who have to patch their instances is in the hundreds of thousands.

Everybody who actively watches the topic already has the option to shut down their instances.

So ringing the bell and getting as many people as possible to shut down their webservers now and patch at 14:00 might be the best in terms of damage minimisation.

By the way, it is not enough to just "shutdown -h now" and then later restart and "apt update && apt upgrade". The moment the machine comes back, it can get hacked. So you should make sure the webserver does not start after the next boot. For Apache this would be something like "rm /etc/systemd/system/multi-user.target.wants/apache2.service" and then after patching recreate the symlink via something like "ln -s /lib/systemd/system/apache2.service /etc/systemd/system/multi-user.target.wants/apache2.service".

What about servers that run PHP from the Debian repos?

How fast will the repos be updated?

Swift, Shell, Python and Objective-C

Does one need 4 programming languages to draw something on a mac?

I still don't get how copying copyrighted content to your own website and then asking for donations can be a legal business model. Nor how it can be morally justified.

I get that many people like such an archive to be around for consumption. Me too. But, keeping emotions aside, I can't find a justification to violate the rights of creators.

I'm sure many people here will have the knee-jerk reaction to immediately downvote this question. But I know there are also thoughtful people on HN. If some of you have ideas about the legal and moral justification for archive.org's actions, I would like to hear them.

This seems to be the demo:

https://chat.webllm.ai/

I am getting:

    WebGPUNotAvailableError: WebGPU is not supported in
    your current environment, but it is necessary to
    run the WebLLM engine.

On both, FireFox and Chromium on Linux.

I never understood why a program installed in Flatpak is not just a directory on disk.

When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk.

The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach.

SQLite has so many advantages over PostgreSQL.

No deamon. Single file per DB. Less configuration overhead.

I switched back and forth between "with account"/"without account" a few times now and it seems to work just fine. I stay with the no-account state, as it not only removes the nags, the interface is actually much cleaner and more logical

No idea about Lens, because I never used it. Aren't there webapps or web services for everything these days? I do everything that I do only occasionally via webapps. Barcode parsing for example.

Oh, that looks good!

I closed the app, stopped it and cleared the cache. Then restarted it.

The UI is surprisingly sane now. My first impression is that it is much better than before. Everything is neatly layed out in a series of albums, for each the latest images are shown and I can click on the album name and it displays them all.

So I do see my albums. Those seem to be just directories in /Pictures/ which it seems I can edit with the files app?

Am I missing out on anything this way? I don't need search.

All the usualy edit functions like cropping, adjusting colors etc also seem to still be there.

Just tried that.

Unfortunately, it seems to completely mess up the interface?

I couldn't even see all photos anymore. Even though I do not use backup at all. So it is not possible that those photos are in the cloud or something.

I'm only interested in the state-of-the-art model by each provider.

For Google, this is still gemini-3.1-pro-preview, right?

You could just as well use any other coding agent via ChatGPT then, right?

Are you sure ChatGPT on IOS connects directly to the VM? Or via a desktop as the middle man sitting somewhere?

If you really only use ChatGPT on IOS and a VM and nothing else, then I would be curious how you set that up. I do not see a "connect to codex via ssh" in my ChatGPT app. I only see "Connect to a desktop".

Oh HOLY MOLY! Now I see there is not only a "Remote" section in the app but also a "Connection" section where you can add an ssh connection. I need to try that.

Thanks!

Wouldn't such language and reasoning from Anthropic be an argument that they needed written permission to train their model on data from websites?

Has any individual somewhere around the world tested this in court by now? Sued Anthropic for copyright infringement because Claude can reproduce information that is only available on their website?

It shouldn't be that expensive, right? If you sue them for - say - $10000 then what would the costs of such a court case be?

Personally, I think "learning" is not a copyright violation. But if they themselves make it one, then they should also face the consequences, no?

Does this mean it is possible to talk to Codex from ChatGPT on a mobile phone now?

When I tried that with the Codex CLI version on a Linux VM, I did not get it to work. Possibly because OpenAI only supports connecting ChatGPT to a desktop installation of Codex?

I tried

    curl -LsSf https://llama.app/install.sh | sh

and then

    llama serve -hf unsloth/Qwen3-4B-GGUF:Q4_0

Then I get:

    W load: control-looking token: 128247 '</s>' was not control-type; this is probably a bug in the model. its type will be overridden
    Terminated

And the web interface says

    Server unavailable

Maybe it gets killed by the OS because it uses too much RAM?

When I try

    llama serve -hf unsloth/Llama-3.2-1B-Instruct-GGUF:Q4_K_M

It seems to work. Nice.

So this is a VM by Docker?

For those who do not trust

    docker run --rm -it -v "$(pwd)":/work -w /work myaiimage /bin/bash

AND do not want to use some other, free VM for some reason?

Not a Show HN:

https://news.ycombinator.com/showhn.html

As I understand it, this "Application Sandbox" is to prevent app A seeing what app B is doing.

The problem here is a different one: The user granting an app access to their files and then having no way to prevent that app from sending that data to the developer of the app.

This is interesting.

I thought granting internet access to apps is not avoidable on Android.

When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something?

Update: I just asked Gemini, and it does not look good:

An Android app without the INTERNET permission is not guaranteed to be isolated from the outside world. While it cannot make direct network connections itself, it can use several other mechanisms to transmit data externally:

Intent-Based Communication (The Browser) An app can launch an explicit or implicit Intent to hand data over to another app that does have internet access.

That means the app can open a system browser using a URL containing the data it wants to transmit.

It can also load a Chrome Custom Tab inside its own UI task, passing data through the URL string.

There is also Inter-Process Communication: If two apps from the same developer share a User ID (sharedUserId), they run in the same process and share all permissions, including internet access.

There is also the concept of Content Providers: Content Providers allow apps to share data. An offline app can write data into a shared database or a public Content Provider. A secondary, online-enabled app can then read that database and upload the contents.

If the algorithm is proprietary, how do you know it is calculating something meaningful?

What does it do? Execute this script nightly?

https://github.com/50YearsPhone/vision-50-years-phone/blob/m...

Is it really necessary to install two huge external dependencies for this, F-Droid and Termux? No easier way to execute a few lines of code?

Also, what does that script even do? As far as I can see: Nothing. It clears files that would not exist if you did not install this whole thing. Is it a complete hoax, or am I missing something?

So is it possible to say "No bots except Google, OpenAI, Grok, Claude and Perplexity"?

As far as I can tell, Google is the only one sending me visitors. And the other big AI players might do so in the future.

Another option would be "No anonymous bots". So at least if a bot would want to crawl my site, they would have to identify themselves. Since the rise of the AI bots, I am getting hurt badly with insane amounts of requests from residential IPs that mimic real humans. The only difference being they don't make me any money. Only produce costs.

By the way, how is the situation over at Amazon's Cloudfront? Do they offer something that helps? Anyone here with them?