News for hackers. Stuff that matters.

bradleybuda

Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @04:02PM (#50309399)
Yes, I think if you trust Binance with anything in 2026 then you deserve to lose all your money.
Re:Binance-hacker-1029 – $5.6B stolen from Binance on Friday October 30, 2026 @01:18PM (#50307058)
If you are willing to accept an asset as collateral that can be frozen, then the onus is on you as the lender to take some steps to Know who Your possible Customers are.
Re:OpenAI: Securing our frontier model training environment on Friday October 23, 2026 @05:36PM (#50215714)
“Completely air-gapping this infrastructure—that is, disconnecting it entirely from external networks—isn’t currently feasible, since we need external connections in order to run and monitor experiments”
How are you harmed by your loan being sold?
Re:Redesigning Source Control at Anthropic on Tuesday October 13, 2026 @04:27PM (#50078205)
The person who most famously got rich selling shovels in the Gold Rush was Samuel Brannan. You'll find the street named after him just a short walk from both the Anthropic and OpenAI HQs.
And crucially, the DoD, through the normal procurement process, agreed to Anthropic’s terms and made the purchase. Much later, the Secretary of Defense threw a political fit and tried to change the terms.
Re:Fable 5 – Median thinking declined in August on Monday September 21, 2026 @04:16PM (#49792771)
My comment is what is on the tin. As a consumer, yeah, I find this annoying. But do I want to bring the full force of government regulation on it? That's quite a strong reaction
Re:Fable 5 – Median thinking declined in August on Monday September 21, 2026 @03:06PM (#49791830)
Anthropic terms of service:

> 12. General terms

> Changes to the Services. Our Services are novel and will change. We may sometimes add or remove features, increase or decrease capacity limits, offer new Services, or stop offering certain Services.

> Unless we specifically agree otherwise in a separate agreement with you, we reserve the right to modify, suspend, or discontinue the Services or your access to the Services, in whole or in part, at any time without notice to you. Although we will strive to provide you with reasonable advance notice if we stop offering a Service, there may be urgent situations—such as preventing abuse, responding to legal requirements, or addressing security and operability issues—where providing advance notice is not feasible. We will not be liable for any change to or any suspension or discontinuation of the Services or your access to them.

You're not buying a gallon of milk or a pound of flour. You're buying hosted software that the host reserves the right to modify.

It's implied (but sadly not stated) in the post that they asked for baseten's permission before conducting this research.

What's interesting to me as someone who has sold a lot of software to a lot of software companies is that many enterprise vendor agreements explicitly allow companies to pentest their vendors with advance notice and coordination. I don't think any of our clients ever exercised that clause; I expect it's going to be exercised a lot more going forward because it's so easy to do now.

Re:A Design Space Exploration of Async/Await on Friday September 11, 2026 @06:11PM (#49666107)
I answered the quiz and it said "you must be a Javascript developer", which is true enough - that's probably my second-most-proficient language. In fact, I'm a Ruby developer partially because I hate the idea of async/await and I'm feeling very smug about my choice after reading this.

Some of these design decisions seem indefensible to me. For example, what the authors call "Suspension":

-> Static: Await points guaranteed to suspend -- JavaScript

-> Dynamic: No guarantees on awaiting tasks -- C# · Swift · Tokio · Smol · Asyncio · Trio

What is "await" if not a synonym for "suspend"?!?

async/await is one product of a long line of thought that says "threads are too hard for programmers to get right". Threads (really, shared memory) have real usability issues for developers, but once you grok the semantics (which largely map to the physical execution model in a CPU) that knowledge is transferrable across virtually all languages and runtimes.

Re:Growing proof that autonomous cars save lives on Thursday September 10, 2026 @12:12PM (#49646171)
I agree. It's too easy to get a license and too hard to lose one. You should lobby your government for these things. I have; good luck.

Meanwhile, profit-driven private industry is actually out there making things better.

Not one Pringles can utilized. We have failed to pass along the ancient knowledge.
Given that the median household income in the US is $83k, I don’t think that losing $1k on a busted phone is likely to put many into “spiraling debt slavery”
Yes, but landlords are inherently evil so if you want to keep the slopulism going you gotta hit them first.
Inshallah
Is United Airlines “just about making more money”? Yes. Has it done so by offering people a valuable product and generating massive consumer surplus? Also yes.
Re:98% Isn't Much on Tuesday July 07, 2026 @09:16AM (#48817354)
It’s very difficult for the average person to use a ten year old browser; in fact I’d offer that the only way to use a ten year old browser is to be an expert and do so intentionally.
Re:4K years ago, Mohenjo-daro grew more equal over time on Tuesday June 02, 2026 @08:58PM (#48378338)
This could also be a story of technological progress. A thought experiment - imagine you, an archaeologist, recovered the remains of our civilization, from roughly 1925 to 2025, but the only surviving artifact was televisions. You know that televisions are valuable - initially only wealthy families had them - so you used them as a proxy for riches and plotted the Gini coefficient using just the size, quality, resolution, color depth, etc. You could conclude that our society became less unequal over that period, because you miss that technology dramatically compressed the distribution of this resource and that household wealth was freed up to put to other purposes.
Not buy these index funds. If you don’t want to own the entire market, don’t buy funds that seek to own the entire market. Funds like ESGV which exclude companies with poor governance have existed for a very long time - I can’t find a clear answer as to whether or not it will buy SpaceX, but I’m sure you can find funds that cater to your desires.
Re:Spotify will start reserving concert tickets for fans on Thursday May 21, 2026 @03:29PM (#48227810)
> Fewer people go to concerts

Scalpers don't buy tickets and not sell them. The most scalped concerts are obviously the most attended

> fans can’t afford the tickets

See above. I assume what you are upset about is that rich fans are the ones going.

> less connection with the artists, less interest in music overall

I think you need to explain your logic here.

Re:Spotify will start reserving concert tickets for fans on Thursday May 21, 2026 @03:27PM (#48227782)
Standing in line is (today) a digital process that a scalper can trivially scale
Re:Spotify will start reserving concert tickets for fans on Thursday May 21, 2026 @03:24PM (#48227760)
Transferring tickets to friends is functionally indistinguishable from scalping
Re:Waymo in Portland on Tuesday April 28, 2026 @06:52PM (#47941926)
> This is an implementation problem, not a problem with the underlying concept.

I agree. The question remains - why do U.S. municipalities universally and repeatedly fail to successfully implement rapid transit at an efficient price point? Buses, trains, and subways in America have ever-growing budgets (both in absolute and per customer mile terms) with ever-declining quality of service. Just asking for more tax revenue again and again is not the solution.

That wasn’t insider trading. You’re changing the topic.
There was a downward trend during the Biden years [1] but "both sides same" is not even a little bit true.

[1] https://www.citizen.org/article/biden-doj-2024-corporate-cri...

> Unfortunately it is their employees that are paying the price of leadership making it rain [...]

Epic's employees reaped the gains while it rained in the form of paychecks. While it sucks that people are losing their jobs, those individuals received (much of) the upside of this investment and their jobs never would have existed in the first place had the investment not been made. Their paychecks are not being clawed back. Shareholders (including executives who are largely paid via out-of-the money options) are bearing the costs. Consumers also benefit from increased competitive pressure on Valve and subsidized game prices.

Would it be "better" if Epic had not invested in the Epic Game Store and paid a dividend or conducted a share buyback?

Re:Steer your Waymo with your phone on Thursday March 19, 2026 @02:36PM (#47443854)
Re:Wide logging: Stripe's canonical log line pattern on Wednesday March 18, 2026 @01:35PM (#47428720)
This is all good advice but it's not what I would traditionally think of as "logging" - it's something more like what the industry calls APM or tracing.

> For a web service, that usually means one log event at the end of every request.

The point of a log, as I have seen it used, is to understand what's going on during a request. Yes, some of that is timing / success / failure information, but you also need:

- Logical tracing - at a high level, what decisions did we make (authz, business logic) when serving this request

- Partial failures or warnings - the request may have succeeded, but we may have failed or timed out a call to a dependent service and delivered a partially degraded response as a result

- Tracepoints to support active development - how often do we hit a certain codepath (to help developers roll out or deprecate features)

It's useful to distinguish between "context" (things we know about a request), timing, success, and plain old logging (using human language to describe to an operator what the system is doing). Context should be included with every line - I strongly agree with OP's proposal of wide events, don't make operators ever JOIN if you can avoid it - but it won't always be the same because we learn things about the request as we process it. Yes, if you wait until the end of a request, you will have maximal context, but at the loss of fine-grained detail during processing.

XHR requests to cookiebot.com -> dig cookiebot.com -> 141.193.213.20 -> ipinfo.io -> Austin, TX

Older »