News for hackers. Stuff that matters.

TimJRobinson

It's time for all developers to learn about devcontainers and use them consistently. They're super easy to setup and run and would protect from most of what this worm does. https://code.visualstudio.com/docs/devcontainers/containers is the best guide to get started if you use vscode.
Re:Grok uploaded my user directory to xAI's servers on Monday July 13, 2026 @10:06PM (#48901424)
Devcontainers are a much better solution, super easy to setup with VSCode and ensures the AI can't access your main machine.
Re:Grok CLI uploaded the whole home directory to GCS on Monday July 13, 2026 @10:05PM (#48901416)
Devcontainers are so useful when working with AI. Not only for rogue agents but rogue scripts/libraries they may download that try and exfiltrate your credentials.
Re:Ask HN: What Are You Working On? (July 2026) on Monday July 13, 2026 @01:35AM (#48888329)
I would love this for magic the gathering
Re:Which sparkling water is the best? on Wednesday June 03, 2026 @09:30AM (#48383778)
Disappointed Topo Chico isn't included. I've tried sparkling water all over the world and it's my favourite.
I've had a full shakedown at the airport in Brisbane asking for passwords for phone/laptop and they will confiscate for 2 weeks if you don't comply. I'm an Australian citizen. They also didn't let me call anyone so my wife was left waiting for 3 hours wondering where I was.
They could give all nearby residents free/subsidized solar + battery for their homes.

This empowers people making them feel less beholden to rising energy prices, and gives the data center more energy for its needs as the grid is freed up.

Re:Microsoft forced me to switch to Linux on Friday January 30, 2026 @08:35AM (#46824211)
Honestly Linux has been so much easier to use since Claude / codex came out. Now I don't need to remember esoteric commands or scroll old forums to fix issues, Claude does it all for me.

Been using ubuntu + regolith as my daily driver for over a year now and haven't needed to use windows for anything. Almost all games all work well on Linux now too.

I built something similar a few years ago where the idea was "jackbox but coop games". It was way jankier than this though.

Would love to port some of those game ideas to this platform when you open up the developer platform.

Re:Ask HN: How Do You Journal? on Wednesday October 01, 2025 @10:51AM (#45438383)
I use Obsidian with a "daily-planning" template that has a bunch of typical journaling prompts. I customize it over time, adding new ideas and removing boring bits.

Current sections are: - Things to remember - List of 10 important quotes/mantras - What's on my mind - How am I feeling productivity/mood wise today - What do I most want to accomplish? - What would make today horrible? - Gratitude - Something Mundane, something that happened by chance, something I made happen

Most programmers want to get some final output, they want the application or game rather than some beautiful code.

Most artists want to create beautiful art, it's a form of self expression. Creating art just for outputs sake without adding love seems cold and capitalistic.

So AI enhances and delivers what programmers want, and diminishes what artists want.

Re:Canadian math prodigy allegedly stole US$65M in crypto on Thursday April 17, 2025 @12:37AM (#43713170)
There's a service called Kleros that does exactly this
I wonder if it related to those studies showing couples have more of a shared memory, to manage tasks better. When playing memory games they tend to do much better than two strangers placed on a team.

What if this leads to less of a cognitive workout over time vs having to manage everything yourself which increases dementia risk?

Re:2FA or Not 2FA on Thursday March 20, 2025 @05:13AM (#43421095)
I thought he was going to mention the stupidity of sites like Twitter that when you add SMS as a 2FA option you can now use that to bypass the password and so are vulnerable to sim hijacking, which given how incompetent phone company employees are makes your security weaker.

Always use an authenticator app or physical key, most sites that do SMS 2FA will then allow hackers to use it to bypass knowing your password.

Re:Mark Cuban offers to fund former 18f employees on Sunday March 02, 2025 @11:47AM (#43232260)
This is the same gotcha as "If you like government so much why don't YOU pay more taxes?"

Nobody refuses free government help even if they hate the government, just as no one pays extra taxes even if they love the government. The point is always to distribute their belief more widely so that everyone has to live with it.

Re:Bybit CEO Confirms Exchange Was Hacked for $1.46B on Sunday February 23, 2025 @02:14PM (#43152170)
It's not like they have a choice. If they don't they have to declare bankruptcy because they can't honor customer withdrawals.
Re:Bybit CEO Confirms Exchange Was Hacked for $1.46B on Sunday February 23, 2025 @02:10PM (#43152130)
The wallet is a smart contract (specifically a gnosis safe), the malicious message they signed transferred ownership of that smart contract wallet to the attacker so they could then do whatever they want with it.
Re:Bybit CEO Confirms Exchange Was Hacked for $1.46B on Sunday February 23, 2025 @02:07PM (#43152101)
The contract address will be the same but the transaction address should be different because transactions include the chainid in them. Otherwise you could easily replay transactions on other chains.
Re:Doge.gov site has been hacked on Saturday February 15, 2025 @05:11PM (#43062891)
Can you link to some sources / information here because I have no idea what you're talking about
Re:How public key cryptography works, using only simple math on Saturday November 16, 2024 @07:15AM (#42156031)
Vitaliks intro to ZK snarks article is great: https://vitalik.eth.limo/general/2021/01/26/snarks.html
Re:SpaceX update regarding Starship FAA flight approval on Wednesday September 11, 2024 @05:55AM (#41509783)
We're in a very small window in the battle against climate change where people are even allowed to spend money on space programs.

In a few decades at our current rate we're going to see so many natural disasters and mass migrations that the general populace will be far more concerned about food and water for the populace than wasting it on extravagances like space, and then we may end up all dying on this rock.

Once we're able to successfully mine minerals from space and have some hope for colonizing other planets the game changes, because people could see it as a lifeline rather than a waste.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Wednesday September 04, 2024 @08:39PM (#41452336)
I didn't mention hashes anywhere in this thread, you were the one claiming you can prove someone's age just based on a hash of it (and still haven't shown how other than breaking the hash with a rainbow table).

I posted this earlier (and it's in the article...) but will reiterate again: ZK proofs are used when the prover (server) and verifier (client) don't trust each other and don't want to give each other data on each other. If you trust the server you can just give it a copy of your passport, if the server trusts the client they can just show a checkbox asking if they're old enough.

I linked to a working library earlier, it's here https://github.com/zk-passport/openpassport

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Wednesday September 04, 2024 @08:11PM (#41452176)
Lol, well yea if you throw away the zero knowledge part or trust the client to tell the truth of course you don't need zero knowledge proofs. Its not zero knowledge though (you just gave the server the info) and/or isn't proving anything. You haven't solved the problem you've just ignored it.

> And for the sake of this kindergarten discussion the hash is computed client-side - that's the whole point, so the server doesn't know your password. The hash is checked on the server side.

This is the exact thing I've mentioned 3 times already but you don't seem to grasp, you can't trust client side code! If you do trust the client then you don't need a proof, you may as well just have a popup that says "are you over 21?"

A rainbow table is just breaking the hash and then you may as well not have it.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Wednesday September 04, 2024 @04:38AM (#41443290)
- Do you not understand that client side checks are insecure?

- As you're still not getting it, how about this: This is a sha256 hash of my birthday, write a function that returns if I'm over 21: `1028d7ea22cbbcb17c4926b08b591506227d7b0e32ce6ce76122461e551a5ab2`

- Nothing I've mentioned needs an append only log, where are you even getting that from? A ZK proof is created from only the data stored on the passport chip.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Wednesday September 04, 2024 @04:34AM (#41443252)
Yea the chip gives the information written on the device. It doesn't answer arbitrary questions about the data.

The whole point of ZK proofs is the zero knowledge part. If you don't care about the person being able to see the information of course there's no need for them.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Monday September 02, 2024 @10:40PM (#41430749)
You think peoples licenses / passports are little computers with API's built into them that return arbitrary information on demand? Over the internet?
Re:Programming Zero Knowledge Proofs: From Zero to Hero on Monday September 02, 2024 @10:38PM (#41430741)
> you definitely do not need "ZKPs" to do this trivial task.

You haven't provided an alternative way though? If you're looking for more complicated things they can do see: https://news.ycombinator.com/item?id=41430157

> Yeah you can, you log them in then link them to that userData with an identifier - typically an email address or unique user ID. You can easily write the login API to know nothing but hashes, or you can write it to respond with - to use your example that user's age - if the password is correct (without ever actually knowing the password).

This doesn't make sense, how do you verify someones age without getting their birthday? Hashes are binary yes/no checks, not range checks.

> Anybody can verify any document with enough identifying information about the document and a registry to match it up to.

So your alternate solution is that every government in the world runs an API you can check a passport against? Instead of them just providing a known public key they signed the passport with? Sounds way over complicated compared to a ZK proof.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Monday September 02, 2024 @08:56PM (#41430157)
A more complex way they are currently used is for proving arbitrary computation.

One of the most obvious flaws of blockchains is that every node needs to re-run every transaction to know that the block is valid, leading to the same computation being run thousands of times.

Instead of having to do this there are new Layer2 chains like Polygon zkEVM or zkSync that post a compressed blob of transaction data and a ZK proof that all transactions in that data are valid according to the rules of the EVM. This makes the chain 1000x more efficient as the computation only needs to be run once and verified 999 times.

The proving is still slow and expensive which is why this isn't fully rolled out, but it's getting faster very quickly with both software improvements and custom ASICs for proving.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Monday September 02, 2024 @08:49PM (#41430131)
Yea you can prove you're some set of users without revealing which one.

This is useful in the case of whistle blowing you can prove you do work at a company, or say a US Senator can show the government is up to no good and prove they are a senator without revealing who they are.

Re:Programming Zero Knowledge Proofs: From Zero to Hero on Monday September 02, 2024 @08:45PM (#41430097)
What do you mean scoped to a particular proof? There are different proof types like there are different hashing algorithms, they can all prove any data just like sha256 and md5 can hash any data.

How do you verify the password meets certain requirements sever side without getting that user data? Client side input can't always be trusted as anyone can modify that regex check.

Here's a project doing passport verification for services without needing to send them a photo of your passport: https://github.com/zk-passport/openpassport

With something like TLS notary you can prove anything signed by a https certificate, so you can prove there are enough funds in your bank to get a mortgage without revealing how much money you have.

Older »