News for hackers. Stuff that matters.

arcfour

I swear I have seen plenty of PCs attempt a PXE boot before failing and continuing on to the next boot option. It probably isn't the default for most "personal" machines but... That's not really a guarantee I would want to hang my hat on...
You need to compile a device tree for every single device you want to support individually, whereas x86 has ACPI to avoid that mess. ACPI is its own mess, yes. And UBoot is great. But it isn't a standalone replacement for a unified firmware interface/"BIOS"/whatever.
Re:AI promised less work. I've never worked more on Tuesday October 27, 2026 @09:13AM (#50258712)
It would be even nicer to be carried by a bunch of servants and fed exotic fruits and not have to work, too, but isn't comparison the thief of joy?
Re:AI promised less work. I've never worked more on Tuesday October 27, 2026 @09:12AM (#50258697)
Seems excessively pessimistic.
Re:GPT-6.1 Terra on Tuesday October 27, 2026 @12:43AM (#50254780)
Probably never? Unless they get super far out of sync, a "medium" model just isn't the right choice for a "large" (or "extra large") model task.
Re:GPT-6.1 Terra on Monday October 26, 2026 @11:53PM (#50254534)
I use Sol 6.4 because it's newer (and "big") unless there is a specific benchmark that 6.1 Astra scores better on that I think I need.

Or I might try both and pick whichever I prefer for a given task...

Re:There isn't an easy exploit for this PHP vulnerability on Thursday October 22, 2026 @03:44AM (#50192409)
So I have been failing to do half of my career this whole time?

The people you hear from are famous personalities... That's the nature of being a famous personality. There are plenty of us who are just normal people with opinions of our own and no desire to cultivate a public name or face for ourselves...

Re:EMudhra Intermediate CA Compromise on Tuesday October 20, 2026 @01:14PM (#50169562)
Rare in public PKIs, yes; not so much in private ones, I would imagine.

From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually!

- OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/

- GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API...

- go (crypto/x509) supports everything except DirectoryName constraints, https://pkg.go.dev/crypto/x509#Certificate.Verify

- Python (pyca/cryptography) has full support, https://cryptography.io/en/stable/x509/reference/#cryptograp...

- Windows/Schannel has full support, https://learn.microsoft.com/en-us/windows/win32/seccertenrol...

- Java has full support, https://docs.oracle.com/en/java/javase/21/docs/api/java.base...

- I know that NSS also supports them from experience but (sorry!) couldn't find the docs in a few seconds of searching

- I know that Strongswan supports them well because I actually opened an issue about it a few years back and got it fixed :-)

(Just a few off the top of my head)

Re:EMudhra Intermediate CA Compromise on Tuesday October 20, 2026 @12:05PM (#50168441)
It doesn't have to, you can set X509 name constraints which say "the CA may only issue/may not issue certificates for these Subjects," or you can set CAA in DNS, for example.

(Of course, the former isn't really intended to constrain trusted Root CAs, moreso internal PKIs. But it is an option people should know about!)

Would be nice if we could choose, say, multiple 4090s or otherwise customize the configuration (or maybe I just missed the button for that?)
Re:Claude reveals ECDSA curve origins on Friday October 16, 2026 @05:10PM (#50124774)
Why would you be blocked? I cannot imagine why you would be for this specific task unless the supposed backdoor turned out to be real.
Re:Wanted to download an ISO, ended up writing a kernel exploit on Thursday October 15, 2026 @04:15AM (#50100774)
I am in CVP too as I have worked professionally as a security engineer for various reputable companies for almost 10 years now and I got refusals to reverse engineer MS-DOS malware from 1994 because Anthropic has placed a blanket ban on reverse engineering any malware at all. Even the model would admit that was ridiculous.

OpenAI has no such restriction and I don't even need to use my Daybreak access, either, to analyze modern malware samples.

It's asinine, truly.

Re:Do not install Zod 4.6.6 – might be infected on Monday October 12, 2026 @08:34AM (#50055521)
This happened 3 weeks ago and no release was published on NPM containing the code.
Re:Do not install Zod 4.6.6 – might be infected on Monday October 12, 2026 @08:32AM (#50055482)
A very pertinent comment from zod's maintainer, from that page:

> EDIT Sept 24 — All of my packages on npm have migrated to use environment-scoped staged publishing triggerable only by workflow_dispatch. This means 2FA is always required, so even if (god forbid) an npm or GitHub token is compromised, it will not be possible for the attacker to publish new versions.

So at least that's good to see. It would be nice for them to actually remove the commit from git history, though...

Re:Do not install Zod 4.6.6 – might be infected on Monday October 12, 2026 @08:28AM (#50055434)
He is (evidently) the product manager of NPM, so while external, I guess he should have a good idea of what's going on. Claude generated, yes, appears so, though it appears to be factually correct and fairly brief, from my quick perusal.
Re:New PlayStation 5 Console Jailbreak Released on Wednesday September 30, 2026 @03:21PM (#49913135)
Stadia worked great for me on a typical 100Mbps cable connection in the US. Online multiplayer was okay with latency, not wonderful but not bad either.
Was it not essentially confirmed that all of the frontier labs have much stronger models internally that don't make sense to serve at scale yet, which they use for development and to train models that are able to be served at scale?
Re:America.gov – Whatever you need from government, start here on Wednesday September 30, 2026 @05:02AM (#49906241)
I prefer to spend my time thinking about other things - not the opinions of others that I cannot change and which ultimately do not affect me.
Re:America.gov – Whatever you need from government, start here on Wednesday September 30, 2026 @01:48AM (#49904849)
I figured it would make sense to avoid commenting on rebellions, riots, terrorist attacks and similar things generally, but it answered "What happened during Shays rebellion?" and "What happened on 9/11?" So I guess that can't be it.

But I will say that it makes sense to avoid commenting on anything that could be interpreted as politically divisive (which Shays and 9/11 are not, really) regardless of factuality. It certainly doesn't seem to serve the intended purpose, since it's suggesting I ask it how to do things and not to ask it about history.

It did refuse to comment on whether or not the Vietnam war was viewed favorably by the public though. So I don't think it's the case that there is some specific exception coded in for Jan 6th.

Re:Prompting Claude Opus 5.5 on Monday September 28, 2026 @12:23PM (#49880471)
It's basically just a MIME boundary but in a pseudo-XML format which the model understands more readily. Seems pretty reasonable to me, even though it may not be an ideal solution in every regard.
Re:Claude Code reads AGENTS.md only when telemetry is on on Saturday September 26, 2026 @11:25AM (#49857457)
Huh? I like my functional OS? How am I going to submit PRs to fix Windows?

Are you alright?

Re:Claude discovers a novel enzyme system with CRISPR-like repeats on Wednesday September 23, 2026 @05:55PM (#49823122)
As infuriating as AI generated prose can be to read, I agree; I do enjoy these sorts of "realizations" in reasoning traces and stuff.
Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @12:33PM (#49818667)
I see, well I'm not particularly concerned with being right on this topic (call it a difference of opinion or matter of taste), so I wish you a pleasant day.
You're aware that Canada is not a state of the US, right?

(This should be a sign that you need to turn off the TV and delete Facebook).

Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @11:09AM (#49817357)
Yes, I prefer to use functional operating systems, or at least ones I can fix myself, without incurring a "huge performance hit" by wrapping them in spyware disguised as an OS ;-)
Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @11:09AM (#49817338)
What's your point? Nobody can hold themselves to a higher standard because they didn't in the past?
Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @11:07AM (#49817309)
Okay, so we agree that this fix isn't quite as simple as it sounds then, yes? We've just had 3+ paragraphs of discussion around potential edge cases and additional considerations beyond "read one of two files."
Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @11:05AM (#49817284)
Which order do you prefer them in? Since CLAUDE.md is no longer necessary, but was for so long, what happens when users only update AGENTS.md going forward while keeping a stale, unchanged CLAUDE.md around?

We're talking about changing default behaviors here in ways that can be surprising to users. It's reasonable to try and accommodate existing setups, future setups, and - yes - careless users.

Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @11:03AM (#49817255)
Is accusing someone of "shilling for Anthropic" for suggesting that a bug fix might not be so simple really the level of discourse HN has devolved to now? Is it the kind of HN you want?
Re:Claude Code reads AGENTS.md only when telemetry is on on Wednesday September 23, 2026 @10:19AM (#49816608)
Some people might have a different CLAUDE.md and AGENTS.md because they use Claude to do one thing and $other_agent to do another thing. Or because Claude does XYZ by default, and other agents do ABC, and they want to give the correct guidance to both.

This is, to me, a completely reasonable and believable use case that could break if you implement this fix without "overengineering" it.

A setting to disable what? Be specific. See? Not so simple...

Older »