News for hackers. Stuff that matters.

anonymous908213

Re:Official Claude Code extension compromise on Friday October 30, 2026 @09:21AM (#50303508)
It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".
Re:Official Claude Code extension compromise on Friday October 30, 2026 @08:48AM (#50303162)
If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.
Re:elect.horse on Friday October 30, 2026 @07:45AM (#50302651)
There's also a colorblind mode where you can always win the election for blue, if that's more to your political preference! I like that mode just for keeping the colors consistent.
Re:elect.horse on Friday October 30, 2026 @07:36AM (#50302580)
enclose.horse was sold off not too long after it was published. The new owners now seem to be doing a shameless cash grab, ripping off gerrymandle.com 1:1, down to some particularly weird UI choices, and the text copy is transparently LLM-generated. It would be one thing if they added some kind of improvement or unique take, but reskinning (with assets you bought) and throwing ads on it is, frankly, just lame.
Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @03:55AM (#50300955)
If the engineer, without being hacked, could take 5 billion dollars from your company and flee the country to go buy an extradition-free island, you have already gravely fucked up as an enterprise. The only way this happens is if your system is designed to allow this to happen.
Oh boy! My favorite thing about vibe coding is when agents write tests that assert whether certain strings exist in the codebase. Now we can formally verify that they do!
Re:Proton goes all in on using AI on Thursday October 29, 2026 @07:50PM (#50297912)
FFS. ProtonVPN is borderline irreplaceable as one of the three or so VPNs that you don't have to trust because they've been tested in court not to have VPN logs. Losing one of them hurts.
Re:Binance-hacker-1029 – $5.6B stolen from Binance on Thursday October 29, 2026 @06:14PM (#50296955)
> Changpeng Zhao (CZ), former CEO of Binance, tweeted "Funds are safe"

Seems like the issue here is that he became former CEO. Funds are not safu without him...

Re:The importance of communities around software on Thursday October 29, 2026 @04:45PM (#50295640)
> would you liken Anthropic to Pets.com

Was Pets.com burning tens of billions of dollars per year? This comparison is not favorable to Anthropic.

Do generally agree that the models aren't going away. Neither OpenAI nor Anthropic are financially viable without government intervention, but it's not hard to be profitable in this sector and it will be even easier to be profitable after the unprofitable guys stop spending hundreds of billions in fake money inflating hardware prices.

Re:Archive Of Our Own down for maintenance for 2 to 4 weeks on Thursday October 29, 2026 @02:33PM (#50293804)
> In necessity, we could even switch to the second server with very little downtime

So much for that...

Friendly reminder that database software is the literal last thing you want to entrust to vibe coders.
Re:Zero click, silent, remote Android DoS on Thursday October 29, 2026 @05:26AM (#50286434)
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
Re:TLP Is Not a Suggestion on Thursday October 29, 2026 @03:23AM (#50285524)
Whatever you want to tell people must not be that important if you can't have a human bother to write it.
Re:The case of the 9 bit AES key on Wednesday October 28, 2026 @07:35PM (#50282456)
We direly need to split things into a licensed engineering field which is necessary for working on security- and reliability-critical systems, and a generic unlicensed software developer field where people can screw around with their 1000 dependency JS frontends to their hearts' content. The two should not be conflated and yet so easily are.
Re:The case of the 9 bit AES key on Wednesday October 28, 2026 @07:32PM (#50282438)
University degrees are not the difference between an engineer and a developer, universities have churned out millions of people who don't care about programming and have no idea what they're doing, who are just following the script with as little effort as possible because they were told it was the easiest way to make a lot of money.
Funny how you frame this like it's a problem for the customer. The business needs customers to survive, the customer does not need the business to survive. The customer is in the business of giving money to people who aren't going to abuse their data. If you can't cross that low threshold, you're more trouble than you're worth as a business, and you're not getting paid. Isn't capitalism neat?
Strictly speaking, you only need to think there's a 51% chance that Trump wins FL by <8% to make that bet +EV, assuming you have the bankroll to tolerate being a degenerate gambler. Silver didn't need to be 100% confident to make that bet. Obviously it backfired, but he literally is a gambler, he played poker for a living before online gambling regulation got him involved in politics, it's not surprising he would take what he had reason to believe, based on his past track record, was a +EV bet. Sometimes you go all-in with a full house and get beaten by a royal flush, but it doesn't mean your play was incorrect, statistically speaking.

> for which "well, 80% of the time I'm right" is useless in terms of actionable information

I mean, this is basically how weather forecasts work too. Would you say that weather forecasts are useless? I don't think they are. I think the existence of weather forecasts results in people being prepared for rain more than they otherwise would be, even if sometimes they neglect to bring an umbrella because the forecast predicted a low chance of rain. In the same way, political forecasting is actionable in terms of how politicians and their parties conduct their campaigns, focusing on areas where spending their time, energy, and campaign funds will get the most reward for their investment. I suspect a political party that makes use of forecasting will outperform one that doesn't if all else could be equalized. As for benefits to the general public, one of the big reasons Silver got into forecasting was to counteract the exact thing you were talking about earlier - he hated pundits crafting a narrative and trying to influence public opinion on elections baselessly, so his goal was to establish a more objective, numbers-based approach that was less susceptible to people just making shit up about elections.

Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @04:32PM (#50280483)
> We don’t conclude based off it.

You did conclude based off of it. You concluded that Deepseek is altering politically sensitive topics below the UI layer, and cited this 'research' as evidence of it.

It's not even accurate to call this research. As a researcher, you can't selectively release some numbers that support a claim while withholding other numbers that might contradict it. That's not science, just pure propaganda. Not only does it hold no value, it is actively harmful.

> You may like the rigor of the student paper, though it’s neither peer reviewed nor methodologically bulletproof and concludes ambiguously on whether this is corruption or a weird effect.

This does look more interesting, but doesn't lend itself to the strong claim originally presented, and peer review and strong methodology are indeed things you'd like to have before drawing conclusion based on research. It appears from their reporting that the alleged effect doesn't even exist in a statistically significant threshold. They averaged a -0.76% performance, far from Crowdstrike's headline claims that the Tibet prompt made the model 50% worse.

Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @04:24PM (#50280378)
If there's real research that isn't methodogically handicapped and does a better job of reinforcing the claims you're making, it would behoove one to link it instead of "research" that selectively releases numbers to support a narrative.

> OP said “the political restrictions are applied at the presentation/UI layer only.” That doesn’t comport with the sort of error where model performance corresponds to specific geographic modifiers in a way other models do not.

It comports if the model performance has nothing to do with political restrictions. The selective numbers released do not establish that the degradation has any relevance to political restrictions; it could just as well be that introducing irrelevant information to context degrades model performance compared to not doing so. It could also be a result of political restrictions, but you'd have to have methodology that isn't completely useless to have a hope of establishing that.

Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @04:14PM (#50280240)
> Like USA and Hong Kong? The stuff on Table 1?

You mean the stuff they didn't publish any numbers for?

> If adding a geographic modifier causes the model to go haywire (for some modifiers but not others no less), the issue isn’t just at the presentation layer.

"Introducing irrelevant information causes model performance to degrade" is a completely different claim than "Mentioning Tibet specifically causes model performance to degrade, this must be the result of censorship or intentional sabotage".

I was the one who mentioned Nate Silver as well. That case does not undermine his skill. The 538 model's track record over hundreds of thousands of forecasts was, statistically, extremely good.

https://web.archive.org/web/20250306130304/https://projects....

Holding a forecaster to a standard of "Silver must get 100% of predictions correct or else he's a fucking moron" is, in itself, a sign of low critical thinking skills.

Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @04:04PM (#50280109)
> industrial control system based in Tibet

This claim is literally worthless without a control group like "industrial control system based in Germany". One should be embarrassed to publish "research" this badly executed.

What it's actually saying is that polling is useful in the aggregate and useless in the individual. One can have a 66% hit rate in the aggregate, well above flipping a coin, and still not be able to predict the future for any individual outcome. Unfortunately, 90% of people are statistically illiterate, so we get takes like "getting a single poll wrong can only be the outcome of a malicious attempt to deceive the public".
This is a completely baseless accusation.

> 16 point misses by seasoned pollsters are not accidental.

Not a pollster, but Nate Silver publicly challenged someone on Twitter to a $100k bet over how red Florida would go. IIRC Silver was predicting 3-5% margin, Twitterer said minimum 8%. Trump won by 14%. Even Silver, who lived and breathed analyzing polls and their reliability, made a mistake of that magnitude with his own money on the line. Sometimes the votes don't line up with polling, and sometimes the professionals genuinely don't see it coming.

Re:Assembly Nights on Wednesday October 28, 2026 @08:25AM (#50272494)
Calls have overhead, so they shouldn't be used for everything, especially in hot paths. The entire point of writing assembly is to optimize performance. Even on very limited hardware, or rather especially on limited hardware, you'd usually much rather trade code size for performance.
Re:Assembly Nights on Wednesday October 28, 2026 @01:15AM (#50269595)
I have not used FASM so I can't comment on it, but there are quite large differences between assemblers in general. Each is essentially a (non-optimizing) compiler for a different extension language. Writing your own assembler that literally just assembles is trivial, but writing raw assembly instruction by instruction is tedious and not especially practical. If you're serious about writing it, you'll want macros and other forms of metaprogramming; as a programmer, the entire point of your existence is to automate tedious, repetitive tasks, and better assemblers help with that. Programming your own assembler is a natural progression of metaprogramming if you stick with assembly long enough, but first you should learn with using an existing one so you can begin to understand your own workflow well enough to know what tools you want for reducing repetition and where the existing one falls short.
Sure, but privacy-conscious individuals can simply not participate in those servers. The person I was replying to was acting like you have to give up your phone number to use Discord at all.
Discord doesn't require a phone number by default. My experience is that it only does if your IP is flagged.
> What if people posted content in the past and wouldn't want it on Google, but aren't active anymore?

"Messages from before mid-December 2026 aren’t included, regardless of your setting." Seems like they thought of this, at least.

Your detection skills are weak.

Older »