News for hackers. Stuff that matters.

bigiain

Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Saturday October 31, 2026 @12:25AM (#50313201)
Yeah. There's a huge difference between how a 5-10 person start up or a 50-100 person business can handle this, compared to a tech giant or hyperscaler who's already got 1000 engineers in a dozen or more timezones.

It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.

Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Saturday October 31, 2026 @12:13AM (#50313147)
"We have fully automated multi-cloud follow-the-sun platform migrations. All your code runs in datacenters where it's currently office hours."
Re:Dolly Parton's Imagination Library on Sunday October 25, 2026 @10:19PM (#50238337)
I'd like to hope that at least for the majority of children who age out of the Imagination Library, both the child and the parents have "become people who read" and most likely the child gets a membership to their local library.

I remember my family getting taken to our local library every couple of weeks to return and then borrow books while I was in infants school. That made me 9 or 10 years old at the very oldest, and my youngest sister would have been at most 5 or 6 years old. So I'm pretty sure aging out of the Imagination Library is a pretty reasonable time to start that child using a "real" library, and start having several books a month available for free that way.

(I fully acknowledge the immense privilege I had having parents who understood and supported the importance of reading and education. I remember being extremely bored in kindergarten - 4 or 5 years old - and getting told to sit in the back with a few other kids who could read already and we'd read books while most of the other kids were being taught to read.)

Re:Active incident at Dreamhost forcing password reset on Sunday October 25, 2026 @06:21PM (#50236624)
i wouldn't be so sure. I know I move in privacy and "anti big tech" circles, but I (and a lot of people I know) am moving a lot of my personal/recreational internet time to rss feeds of personal websites, mailing lists, and Mastodon. And there's a fair bit of discussion and small but growing use of private and very small group federated Mastodon hosts.

Having said that, very little of that is being done by the sort of people who'd host it on a service like Dreamhost.

"They recently had a baby and now they suddenly don't" is probably a datapoint they sell to ambulance-chasing medical malpractice lawyers and PE-owned grief counseling clinics...
I have a Watchy, a kit "smartwatch" built around an ESP32, that now runs firmware that listens for Axon/Taser and Flock bluetooth and wifi prefixes, and vibrates on my wrist when it detects them.

Also, 10 or 15 years back, I wrote an Android app to do ALPR on the live camera view with the phone in a holder that let it see out he windscreen. I collected licence plates by spending an hour or so every few days over a few weeks sitting at cafes that had a good view of the marked and unmarked cars arriving and leaving the three major police stations nearby. It did work, but the camera in the Galaxy S3 and S4s I had to try it on couldn't get images good enough for OCR until the cop car was so close it wasn't useful... I contemplated experimenting with a drone camera gimbal when I was building and flying camera drones around 2014/2015, possibly using one of those clip on telephoto lens's that were common back then - but by then I'd ditched the car and I didn't figure I;d be able to build that to work on any of my motorcycles.

Re:Orkut.com on Thursday October 08, 2026 @06:19PM (#50013194)
Mastodon and Lemmy might be close to what you're looking for?
Re:Erdosproblems.com Succumbs to the AI Onslaught on Tuesday October 06, 2026 @06:37PM (#49985145)
Interestingly, I see Daniel from curl has recently been saying the problem of clearly slop vulnerability reports has largely dried up, and the majority of A I assisted bug reports are now reasonably high quality.

I wonder if that's a natural progression when AI users and tools first start to get involved in something, or if it's more that the curl codebase and maintainers/contributors are special and unusually high quality, so there's little left to find by people with little understanding prompting tools trhey are incapable of judging the results generated?

Re:Erdosproblems.com Succumbs to the AI Onslaught on Tuesday October 06, 2026 @06:31PM (#49985079)
> One of the nerds is now saying "I don't find it fun anymore".

To be fair, it isn't just "one of the nerds", it is the nerd that was hosting the party that all the AI bros were gatecrashing. He's not saying the competitive AI-powered and reputation-seeking performative math problem solving shouldn't happen, he's just saying you don't get to do it in the little corner of the internet that he runs any more, showing off to all his friends. Go find some other website where the owner enjoys that, or build your own and create your own community and friends.

Re:Burning Man Death Rates – A Short Lesson in Statistics on Wednesday September 30, 2026 @07:24PM (#49915773)
Wasn't there a suspicious death there last year (or maybe '24) that could easily have been a "violent death"?
Re:Burning Man Death Rates – A Short Lesson in Statistics on Wednesday September 30, 2026 @07:21PM (#49915751)
it did go on to talk about the uncertainty, especially given the low numbers:

There is a 27% chance that we would observe 3 deaths or less, given an average rate of 4.9 deaths. This is also known as a p-value.5 6Why isn’t our p-value greater? Seems like 27% is quite low. By scientific standards, this isn’t abnormal at all. Observing 3 deaths is completely within reason.

However, the relative uncertainty of our point data is quite large at about 58% (1/sqrt(3)). This is the size of the error. If we were talking about death rates in the thousands, we might have an error of 3% or less. But the reality is that at such low counts, our data is considered quite “fuzzy”.

(I haven't been on over 10 years, but back in the early 2000s there were always rumours about deaths that the organisers managed to ensure ended up categorised as not happening at the event. People who died in ambulances on the way to hospital, or in hospital after injury at the event, or on the road in or out of the event...)

Also, when people operate equipment know to cause harm when accidents happen, such as cars, they're required to undergo training and testing before being granted a license to operate them, and to have insurance to ensure other people can be made whole in case of damage or injury. And there is an organization and profession that monitors people's use of that equipment, handing out fines or license suspensions based on actual or even just potentially dangerous operation.

Sadly, software "engineers" are not held accountable for their profession like everybody else with a real engineer title. And AI companies are all building Ford Pintos as fast as they can, and competing with each other about who's product makes the biggest explosion.

And, you've boasted about it in media releases, blog posts, and financial filings.
Re:S3 Is the Future, S3 Is the Past on Sunday September 27, 2026 @11:22PM (#49873228)
Is S3 priced in actual power-of-two GB? Or the shrinkflation power of ten GiB?
illudium q-36 space modulator
Re:OpenAI breaches Medicare, Albanese reveals on Wednesday September 23, 2026 @07:24PM (#49824073)
I saw an analogy recently.

If you dog bites the postman, you are liable, even if you didn't tell or encourage you dog to do it. You are responsible for your dog's actions. You get to pay the postman's medical bills, you may get fined, and your dog may get put down - especially if this isn't the first time it's bitten someone.

OpenAI has "bitten the postman" many many times, and it's "owners" have boastewd about it and used it in their marketing.

How many more times should society allow this to happen before we say "enough" and hold Sam Altman and the board responsible and make them pay restitrution, and put it down?

If Albanese actually had a spine (as claimed elsewhere in this discussion), Sam and the board will be getting an invoice for all the time/expertise spend investigating this intrusion, and restitution for everybody who's PII and PHI was exposed. (Although I suspect a good deal of responsibility for the data exposure rests with the people who designed and deployed the system that was breached. )

Re:OpenAI breaches Medicare, Albanese reveals on Wednesday September 23, 2026 @07:13PM (#49823948)
> So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?

I'm not the person you're responding to, but...

If I hear my neighborhood has started to become targeted by people checking houses for unlocked doors and stealing stuff, I think an appropriate response for me is to ensure it is difficult or impossible for me to "inadvertently" leave my own doors unlocked so my stuff doesn't get stolen, and also to encourage or perhaps even enforce[1] my neighbors to ensure their doors are always locked to make this sort of theft impossible and remove the temptation for that sort of crime.

1 - Where I'm from, you can be fined for leaving you car unlocked, and cops have been known to walk round testing doorhandles and issuing fines: https://www.sydneycriminallawyers.com.au/blog/is-leaving-you...

Arguably, there's at least two kinds on "average HN people", which I think of as participants and spectators.

For me (and I'm not claiming my opinion is any more than a probable "No true HN person" fallacy), people who never or extremely rarely comment are spectators. And while they quite likely outnumber people who comment regularly by 100 or 1000 to one or more, they are not part of "the HN community" because they do not participate in it.

I think most people's (including spectators) "sense of who the average HN person is" probably aligns reasonably well with the average HN _participant_.

It wouldn't surprise me at all to learn that was purely automated based on 4chan organised Gamergater's dogpiling and looking exactly like voting rings and/or manufactured controversy.
I wouldn't be too surprised if the ranking system worked pretty much exactly as the article describes still.

But I also assume the automated (and manual) penalty system has evolved significantly. I'll bet it's evolving rapidly right now, in response to attacks trying to game ranking by people deploying agents. I'd be a little surprised if YC/HN are not right up there with state of the art bot detection tech.

I wonder how many of the companies sending you those sort of emails are YC backed?

(and how many of them are disgruntled founders who were rejected by YC?)

It's a pity GrapheneOS is allowing AI code contributions...
Re:The First New Cat Species Discovered in 100 Years on Friday September 18, 2026 @10:52PM (#49762852)
Australia also uses pspspsps - at least my part of it and my family and friends.

(and for some Australians some of the time, "ps ps fuckin ps, ya cunting cat!" of course. ;- ) )

Your phone isn't going to have a "very high end HSM" any time soon. n Not until you're paying mid range car prices or more for your very specialised secure phone (and then that phone will probably be factory backdoored AN0M-style).
Same. I wonder if my Yubikeys have anything to mitigate this sort of attack. My gut feel says that at their pricepoint and form factor, probably not.
That's cynical, but without doubt true for some people.

I wouldn't want to be someone the NSA is "interested in".

I wouldn't even want to be someone that a customer of NSO Group is interested in. (Just ask Jamal Kashoggi's family or friends)

Hell, where I live they're about to give cops powers to let then hack your phone with a Cellebrite UFED at roadside stops. And it's not even just cops, fisheries enforcement officers Australia have been using UFEDs at least as far back as 2017 during illegal fishing investigations.

If you're doing things that might make someone rich or powerful enough unhappy, or someone in law enforcement - you pretty much need to stop using the internet. And the bar for "how powerful" your potential threat is keeps dropping lower and lower. Just look at all the stories about local cops abusing Flock cameras to stalk ex girlfriend or people critical of them, how could anyone possibly believe those same sort of cops aren't going to use roadside phone forced data extraction tools in exactly the same petty and personal ways, and with exactly the same lack of oversight and consequences?

We've beer-o-clock wargamed this a bit.

If I had an "important enough" client, I think I'd store all out local (Sydney + Melbourne AWS cross region) data to AWS Singapore (to protect against Australian jurisdictional and political risks) and to a non AWS cloud provider in the EU somewhere. I reckon thatd be close to as resilient a pile of hard drives in an underground bunker, for significantly less setup and ongoing cost, while also being much more available when needed. (Can you imagine the queue at the underground bunker when multiple AWS regions get bombed? Or even imagine getting to the bunker in "a friendly jurisdiction" while a shooting war is taking place?)

We haven't worked out a decent solution to Visa and Mastercard payment network going down for more than a couple of cloud billing cycles though.

I'm comfortable enough with the Sydney and Melbourne AWS regions - about 700km (400 miles) apart and with (at least) 3 AZs in each. If something takes out enough AWS datacenters to lose some of work's or client data stored across all that, the uptime and resilience of the CRUD platforms I'm responsible for will not be very high on my personal priority list. (At least on AWS datacenter is within 10km of my home. I'm hoping that well before Australia gets involved in the sort of geopolitical conflict that might mean missile strikes against civilian infrastructure, I'll have headed bush to hang out with my off grid friends)
Isn't S3 claiming eleven nines of data durability?

https://aws.amazon.com/s3/storage-classes/

"Additionally, S3 stores data redundantly across a minimum of 3 Availability Zones by default, providing built-in resilience against widespread disaster."

I wonder if "can't restore some data" includes any S3 data?

I'd expect to lose EC2 instance EBS data in the event of a datacenter being destroyed, but I kinda assume I wouldn't lose S3 data? Now I'm wondering if RDS backups are more like EBS or S3...

Older »