News for hackers. Stuff that matters.

bramhaag

Re:CorridorKey 2.0 on Monday October 26, 2026 @07:28PM (#50252645)
You would think so considering the creator constantly calls it that, but it is merely source-available. This has been repeatedly brought up along with other very questionable license decisions [0]. The charitable interpretation is that the creator is very confused about what open source is and isn't.

Here's a summary:

- The project is licensed under the "Corridor Key License" [1], which is CC BY-NC-SA 4.0 with extra clauses that permit commercial use of you have their blessing (That's right, CC BY-NC with commercial use allowed).

- CC licenses should not be used for software, and the non-commercial restrictions make this project not open source.

- This project is based on Hiera, which licenses its weights under CC BY-NC 4.0 [2]. Again, non-commercial. He is selling this.

- The license was changed a few times after the community rewrote large parts of this project. The contributors should've retained their copyright to their contributed code as there was no CLA or similar, but to my knowledge their code was relicensed without their consent.

[0] https://github.com/nikopueringer/CorridorKey/issues?q=licens...

[1] https://github.com/nikopueringer/CorridorKey/blob/main/LICEN...

[2] https://github.com/nikopueringer/CorridorKey/issues/152

Re:Show HN: Steal My Bitcoin on Saturday October 24, 2026 @06:34PM (#50226114)
A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.

If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.

[0] https://youtu.be/SP7y1h0laN0

Ask your LLM about "reproducible builds".
Re:PHP 8.2.35 on Wednesday October 21, 2026 @10:15AM (#50181395)
Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).
Re:Someone on Torrent Sites Kept Fucking with My Sonarr on Thursday October 15, 2026 @07:46PM (#50111909)
> or you have to pay to join (lol!)

There are zero good private trackers that you can pay for to enter. Buying invites will get you banned, and paying the site directly is only possible on scummy trackers.

There is a lot of good information here [0]. Most notably RED is open via interviews conducted on IRC, and has a big invite forum to join other trackers. But yes, they do force you to contribute through maintaining a ratio.

[0] https://igwiki.lyci.de/wiki/Private_trackers

Re:Passkeys are a trap. Do not use them on Monday October 12, 2026 @04:43AM (#50053334)
I'm not sure how common this is as I don't voluntarily use passkeys, but some platforms have a device manufacturer whitelist. OpenAI for example forces the use of hardware passkeys in some cases and seemingly determines this based on whatever name the device reports.

I'm not looking forward to when passkeys become even more forced upon us and you have to carry around multiple devices by different manufacturers because platform A and B don't support the same devices.

See e.g. https://community.openai.com/t/daybreak-does-not-recognize-t...

Re:Fuck Android Developer Verification Program on Thursday October 01, 2026 @02:39AM (#49918425)
My account got closed for inactivity while I had multiple apps published. Google does not understand the concept of a finished app apparently, and requires you to continuously push updates or else you permanently lose your account with no way of reopening it.
Re:HomelabFest will be in St. Louis in September 2027 on Saturday September 26, 2026 @03:56AM (#49854254)
Everyone draws their own boundaries based on what is important to them. I do not think your example is unreasonable.

But the homelabbing scene, and many parts of tech in general, are generally more inclusive than many other scenes, perhaps partly because we have a very diverse community in the first place. I think it is important context, and not just a needless detraction, for a physical gathering that the organizer does not share these views.

Regardless, I do not think any interpretation of "positive community" can include the dejection of homosexuality.

Re:HomelabFest will be in St. Louis in September 2027 on Saturday September 26, 2026 @02:14AM (#49853720)
> he's an excellent advocate for a healthy and positive community

The reactions about this when announced on Reddit seem to contradict that:

  > I'm a little disappointed that u/geerlingguy is the one running it, since he's posted some shitty beliefs about gay people that, to my knowledge, he has never retracted or disavowed. 

  > So he can tell all the women there they have no right to their own body? 

  > Hmmm I didn't know Jeff was anti-gay and anti-women's rights. 

  > Hi u/geerlingguy ! Are gay people allowed to attend your event?

etc.

https://www.reddit.com/r/homelab/comments/1wq04et/im_startin...

https://www.reddit.com/r/selfhosted/comments/1wq2orh/jeff_ge...

Related: How to Land the Space Shuttle... from Space https://youtu.be/Jb4prVsXkZU
Re:GrapheneOS' rewritten Messages app is released on Saturday September 12, 2026 @05:08AM (#49670490)
I think in this context it's fair to call out /e/.

In some ways /e/ and GOS are trying to achieve different things (/e/ is not hardened and does not claim to be), but /e/ is severely lacking security wise compared to AOSP.

This [0] is, in my opinion, a fair review that mentions many of the issues. That Fairphone is ok with these is telling about their position on privacy and security.

[0] https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-...

Re:Google no longer provides direct URLs in search results on Saturday September 12, 2026 @03:21AM (#49669826)
Aside from the privacy concerns and inconveniences this brings to Google users, it matters for users (of services) that rely on SerpApi too. Kagi for example has started showing these goto URLs in search results.
Re:GrapheneOS' rewritten Messages app is released on Friday September 11, 2026 @05:01PM (#49665339)

  > Fairphone has said they don't plan to add a secure element. It can be seen from their current devices that they don't fully keep up with privacy/security backports and lag a year behind on shipping yearly OS releases. They skip over the monthly and quarterly releases entirely. They replaced their own non-GMS Fairphone OS with a dramatically less secure /e/OS option in partnership with Murena. They clearly demonstrate that security and even privacy are not the priorities.
https://grapheneos.social/@GrapheneOS/114733211017800480
Re:GrapheneOS' rewritten Messages app is released on Friday September 11, 2026 @04:02PM (#49664535)
I do not see Electron anywhere? It looks like a native Android app that uses Jetpack Compose.
Re:GrapheneOS says Pixel 11 has MTE support after all on Wednesday September 02, 2026 @10:42AM (#49537059)

  > The security implication here is that the telephonic operating system has access to the same system resources as the application operating system at the same time, right?
It shouldn't. As per https://grapheneos.org/faq#baseband-isolation:

  > The baseband is isolated on all of the officially supported devices. Memory access is partitioned by the IOMMU and limited to internal memory and memory shared by the driver implementations. The baseband on the officially supported devices with a Qualcomm SoC implements Wi-Fi and Bluetooth as internal sandboxed processes rather than having a separate baseband for those like earlier devices.
Re:Fastpotify on Tuesday September 01, 2026 @06:01AM (#49519974)
I wouldn't.

> The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance.

Slop text on the homepage does not scream "quality" to me.

The code is worse, somehow. Endless paragraphs of comments that say nothing: https://github.com/crmne/fastpotify/blob/d9aafbf8e0b0c4d2da3...

Re:Ask HN: What's your daily driver keyboard? on Saturday August 22, 2026 @07:46PM (#49404951)
Kinesis Advantage with brown switches. Some of the switches are starting to double input, and sometimes a modifier key gets stuck. Can't complain though, it's about to turn 18 years old soon.
There is the extension Bypass Paywalls Clean[1] which fetches content from archive sites and displays it on the original page.

[1] https://en.wikipedia.org/wiki/Bypass_Paywalls_Clean

Re:Palomar: A registry of Lean verified mathematics on Wednesday August 19, 2026 @03:11AM (#49358001)
It seems that Lean keeps re-inventing everything Isabelle has had for decades (https://isa-afp.org/) in worse ways. There is no reason this has to depend on GitHub.
> Text watermarking is another EU rule made without real world input.

Except for the input of the hundreds of stakeholders they consulted, Anthropic included [1]?

> The Union is stuck on major economic crises (electricity prices for instance) because nobody can agree on anything.

That sure seems relevant for the implementation of AI watermarking...

> However, the bureaucracy forces tech into a privacy nightmare.

No, this transparency allows consumers to more easily detect AI generated content.

[1] https://digital-strategy.ec.europa.eu/en/policies/code-pract...

Why did the US gov decide to rely on a TLD controlled by Montenegro for this seemingly important and sensitive service?
Re:How Claude marks AI-generated content on Tuesday August 11, 2026 @07:33AM (#49256576)
I cannot wait for the inevitable "I've always used Claude watermarks in my writing, even before we had LLMs!" when someone gets caught using an LLM.
Re:How Claude marks AI-generated content on Tuesday August 11, 2026 @04:40AM (#49255037)
How exactly does this impact proofreading? You can manually apply the suggestions (typo here, unnatural sounding sentence there, etc.) the LLM gives you to your own content, and it would stay watermark-free.

Unless with "proofreading" you actually mean having the LLM write your content for you.

This is just LLM output pasted on some forum, submitted to HN by the person who presumably made that post. What an incredibly low effort submission.
Re:Let's Make the Worst Htmx on Saturday August 01, 2026 @02:55AM (#49131817)
Since you tried both, what made you choose datastar over htmx?
Re:Ah, the Codeberg Drama on Friday July 24, 2026 @09:46AM (#49035542)
You are simply not the target audience of Codeberg. That's okay.

If you are on Arch, you can do this simple fix (instructions are similar for other distros):

  sudo pacman -S forgejo
  sudo systemctl enable --now forgejo
Re:Codeberg Bans Cryptocurrency Projects on Thursday July 23, 2026 @04:08AM (#49018319)
> Cryptocurrency is bad, but LLMs are fine?

No. https://blog.codeberg.org/protecting-our-floss-commons-from-...

> Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor, 17 abstentions), the motion to reject it failed to secure the required absolute majority of 361 votes.

This vote was urgently scheduled for today, the last day of parliament before the summer break. 113 MEPs were not present for this vote, likely having taken vacation days to extend their break. It's hard to believe choosing to do the vote today was done accidentally.

Re:My Thoughts on the Bun Rust Rewrite on Thursday July 09, 2026 @07:46AM (#48844334)
"effort" is a big word to describe typing out a few prompts to create something with 5k+ open issues.
Signal is one example. Their values are simply not compatible with what the Chinese government wants (local data storage, key access, etc.). Instead of complying and putting their users' privacy at risk, they accepted the ban.

Google, out of all companies, also decided to partially walk away from the Chinese market in 2010 over censorship concerns [1].

Nobody is forcing Apple to do business in China, or the UK. They actively choose to do so, and because of that also put themselves in a position where they have to comply with these laws, presumably because it makes them more money.

[1] https://www.nytimes.com/2010/03/23/technology/23google.html

Older »